5.15-stable patches

added patches:
	md-select-block_legacy_autoload.patch
	media-uvcvideo-avoid-invalid-memory-access.patch
	media-uvcvideo-avoid-returning-invalid-controls.patch
	mtd-rawnand-cadence-fix-unchecked-dereference.patch

diff --git a/queue-5.15/md-select-block_legacy_autoload.patch b/queue-5.15/md-select-block_legacy_autoload.patch
new file mode 100644 (file)
index 0000000..26d8350
--- /dev/null
+++ b/queue-5.15/md-select-block_legacy_autoload.patch
@@ -0,0 +1,39 @@
+From 6c0f5898836c05c6d850a750ed7940ba29e4e6c5 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Mon, 13 Mar 2023 13:29:17 -0700
+Subject: md: select BLOCK_LEGACY_AUTOLOAD
+
+From: NeilBrown <neilb@suse.de>
+
+commit 6c0f5898836c05c6d850a750ed7940ba29e4e6c5 upstream.
+
+When BLOCK_LEGACY_AUTOLOAD is not enable, mdadm is not able to
+activate new arrays unless "CREATE names=yes" appears in
+mdadm.conf
+
+As this is a regression we need to always enable BLOCK_LEGACY_AUTOLOAD
+for when MD is selected - at least until mdadm is updated and the
+updates widely available.
+
+Cc: stable@vger.kernel.org # v5.18+
+Fixes: fbdee71bb5d8 ("block: deprecate autoloading based on dev_t")
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/Kconfig |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/Kconfig
++++ b/drivers/md/Kconfig
+@@ -16,6 +16,10 @@ if MD
+ config BLK_DEV_MD
+       tristate "RAID support"
+       select BLOCK_HOLDER_DEPRECATED if SYSFS
++      # BLOCK_LEGACY_AUTOLOAD requirement should be removed
++      # after relevant mdadm enhancements - to make "names=yes"
++      # the default - are widely available.
++      select BLOCK_LEGACY_AUTOLOAD
+       help
+         This driver lets you combine several hard disk partitions into one
+         logical block device. This can be used to simply append one

diff --git a/queue-5.15/media-uvcvideo-avoid-invalid-memory-access.patch b/queue-5.15/media-uvcvideo-avoid-invalid-memory-access.patch
new file mode 100644 (file)
index 0000000..8af8137
--- /dev/null
+++ b/queue-5.15/media-uvcvideo-avoid-invalid-memory-access.patch
@@ -0,0 +1,38 @@
+From f0577b1b6394f954903fcc67e12fe9e7001dafd6 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Wed, 1 Dec 2021 06:22:17 +0100
+Subject: media: uvcvideo: Avoid invalid memory access
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit f0577b1b6394f954903fcc67e12fe9e7001dafd6 upstream.
+
+If mappings points to an invalid memory, we will be invalid accessing
+it. Solve it by initializing the value of the variable mapping and by
+changing the order in the conditional statement (to avoid accessing
+mapping->id if not needed).
+
+Fix:
+kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI
+
+Fixes: 6350d6a4ed487 ("media: uvcvideo: Set error_idx during ctrl_commit errors")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1708,7 +1708,7 @@ static int uvc_ctrl_find_ctrl_idx(struct
+                                 struct v4l2_ext_controls *ctrls,
+                                 struct uvc_control *uvc_control)
+ {
+-      struct uvc_control_mapping *mapping;
++      struct uvc_control_mapping *mapping = NULL;
+       struct uvc_control *ctrl_found;
+       unsigned int i;
+ 

diff --git a/queue-5.15/media-uvcvideo-avoid-returning-invalid-controls.patch b/queue-5.15/media-uvcvideo-avoid-returning-invalid-controls.patch
new file mode 100644 (file)
index 0000000..fab79ed
--- /dev/null
+++ b/queue-5.15/media-uvcvideo-avoid-returning-invalid-controls.patch
@@ -0,0 +1,33 @@
+From 414d3b49d9fd4a0bb16a13d929027847fd094f3f Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Wed, 1 Dec 2021 06:22:18 +0100
+Subject: media: uvcvideo: Avoid returning invalid controls
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 414d3b49d9fd4a0bb16a13d929027847fd094f3f upstream.
+
+If the memory where ctrl_found is placed has the value of uvc_ctrl and
+__uvc_find_control does not find the control we will return an invalid
+index.
+
+Fixes: 6350d6a4ed487 ("media: uvcvideo: Set error_idx during ctrl_commit errors")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1709,7 +1709,7 @@ static int uvc_ctrl_find_ctrl_idx(struct
+                                 struct uvc_control *uvc_control)
+ {
+       struct uvc_control_mapping *mapping = NULL;
+-      struct uvc_control *ctrl_found;
++      struct uvc_control *ctrl_found = NULL;
+       unsigned int i;
+ 
+       if (!entity)

diff --git a/queue-5.15/mtd-rawnand-cadence-fix-unchecked-dereference.patch b/queue-5.15/mtd-rawnand-cadence-fix-unchecked-dereference.patch
new file mode 100644 (file)
index 0000000..1460e16
--- /dev/null
+++ b/queue-5.15/mtd-rawnand-cadence-fix-unchecked-dereference.patch
@@ -0,0 +1,36 @@
+From 60255f3704fde70ed3c4d62f919aa4b46f841f70 Mon Sep 17 00:00:00 2001
+From: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
+Date: Sun, 16 Feb 2025 11:15:36 +0800
+Subject: mtd: rawnand: cadence: fix unchecked dereference
+
+From: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
+
+commit 60255f3704fde70ed3c4d62f919aa4b46f841f70 upstream.
+
+Add NULL check before variable dereference to fix static checker warning.
+
+Fixes: d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for sdma address")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/e448a22c-bada-448d-9167-7af71305130d@stanley.mountain/
+Signed-off-by: Niravkumar L Rabara <niravkumar.l.rabara@intel.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/cadence-nand-controller.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/raw/cadence-nand-controller.c
++++ b/drivers/mtd/nand/raw/cadence-nand-controller.c
+@@ -2934,8 +2934,10 @@ free_buf_desc:
+ static void cadence_nand_remove(struct cdns_nand_ctrl *cdns_ctrl)
+ {
+       cadence_nand_chips_cleanup(cdns_ctrl);
+-      dma_unmap_resource(cdns_ctrl->dmac->device->dev, cdns_ctrl->io.iova_dma,
+-                         cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0);
++      if (cdns_ctrl->dmac)
++              dma_unmap_resource(cdns_ctrl->dmac->device->dev,
++                                 cdns_ctrl->io.iova_dma, cdns_ctrl->io.size,
++                                 DMA_BIDIRECTIONAL, 0);
+       cadence_nand_irq_cleanup(cdns_ctrl->irq, cdns_ctrl);
+       kfree(cdns_ctrl->buf);
+       dma_free_coherent(cdns_ctrl->dev, sizeof(struct cadence_nand_cdma_desc),