5.10-stable patches

added patches:
	net-sched-sch-fix-off-by-one-in-htb_activate_prios.patch
	nvmem-core-fix-return-value.patch

diff --git a/queue-5.10/net-sched-sch-fix-off-by-one-in-htb_activate_prios.patch b/queue-5.10/net-sched-sch-fix-off-by-one-in-htb_activate_prios.patch
new file mode 100644 (file)
index 0000000..4b6eba2
--- /dev/null
+++ b/queue-5.10/net-sched-sch-fix-off-by-one-in-htb_activate_prios.patch
@@ -0,0 +1,33 @@
+From 9cec2aaffe969f2a3e18b5ec105fc20bb908e475 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Mon, 6 Feb 2023 16:18:32 +0300
+Subject: net: sched: sch: Fix off by one in htb_activate_prios()
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit 9cec2aaffe969f2a3e18b5ec105fc20bb908e475 upstream.
+
+The > needs be >= to prevent an out of bounds access.
+
+Fixes: de5ca4c3852f ("net: sched: sch: Bounds check priority")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/Y+D+KN18FQI2DKLq@kili
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_htb.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -407,7 +407,7 @@ static void htb_activate_prios(struct ht
+               while (m) {
+                       unsigned int prio = ffz(~m);
+ 
+-                      if (WARN_ON_ONCE(prio > ARRAY_SIZE(p->inner.clprio)))
++                      if (WARN_ON_ONCE(prio >= ARRAY_SIZE(p->inner.clprio)))
+                               break;
+                       m &= ~(1 << prio);
+ 

diff --git a/queue-5.10/nvmem-core-fix-return-value.patch b/queue-5.10/nvmem-core-fix-return-value.patch
new file mode 100644 (file)
index 0000000..ba93c79
--- /dev/null
+++ b/queue-5.10/nvmem-core-fix-return-value.patch
@@ -0,0 +1,36 @@
+From 0c4862b1c1465e473bc961a02765490578bf5c20 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Fri, 27 Jan 2023 10:40:14 +0000
+Subject: nvmem: core: fix return value
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+commit 0c4862b1c1465e473bc961a02765490578bf5c20 upstream.
+
+Dan Carpenter points out that the return code was not set in commit
+60c8b4aebd8e ("nvmem: core: fix cleanup after dev_set_name()"), but
+this is not the only issue - we also need to zero wp_gpio to prevent
+gpiod_put() being called on an error value.
+
+Fixes: 560181d3ace6 ("nvmem: core: fix cleanup after dev_set_name()")
+Cc: stable@vger.kernel.org
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-10-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -638,6 +638,7 @@ struct nvmem_device *nvmem_register(cons
+                                                   GPIOD_OUT_HIGH);
+       if (IS_ERR(nvmem->wp_gpio)) {
+               rval = PTR_ERR(nvmem->wp_gpio);
++              nvmem->wp_gpio = NULL;
+               goto err_put_device;
+       }
+ 

diff --git a/queue-5.10/series b/queue-5.10/series
index 3c4e9ca106fcf0f540b2907de354804883a70d33..b0829f472064bed154b1059db489257ad75c52ff 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -53,3 +53,5 @@ net-sched-tcindex-search-key-must-be-16-bits.patch
 kvm-initialize-all-of-the-kvm_debugregs-structure-before-sending-it-to-userspace.patch
 alarmtimer-prevent-starvation-by-small-intervals-and-sig_ign.patch
 asoc-sof-intel-hda-dai-fix-possible-stream_tag-leak.patch
+net-sched-sch-fix-off-by-one-in-htb_activate_prios.patch
+nvmem-core-fix-return-value.patch