--- /dev/null
+From bb23f07cb63975968bbabe314486e2b087234fc5 Mon Sep 17 00:00:00 2001
+From: Dan Gora <dan.gora@gmail.com>
+Date: Tue, 9 May 2023 12:51:19 -0700
+Subject: Bluetooth: btrtl: Add missing MODULE_FIRMWARE declarations
+
+From: Dan Gora <dan.gora@gmail.com>
+
+commit bb23f07cb63975968bbabe314486e2b087234fc5 upstream.
+
+Add missing MODULE_FIRMWARE declarations for firmware referenced in
+btrtl.c.
+
+Signed-off-by: Dan Gora <dan.gora@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btrtl.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -1074,19 +1074,33 @@ MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_fw.
+ MODULE_FIRMWARE("rtl_bt/rtl8723cs_vf_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8723cs_xx_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8723d_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8723d_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8723ds_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8723ds_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8761a_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8761a_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8761b_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8761b_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8761bu_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8761bu_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8821a_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8821a_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8821c_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8821c_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8821cs_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8821cs_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8822b_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8822b_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8822cs_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8822cs_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8822cu_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8822cu_config.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8851bu_fw.bin");
++MODULE_FIRMWARE("rtl_bt/rtl8851bu_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8852au_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8852au_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8852bu_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8852bu_config.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8852cu_fw.bin");
+ MODULE_FIRMWARE("rtl_bt/rtl8852cu_config.bin");
+-MODULE_FIRMWARE("rtl_bt/rtl8851bu_fw.bin");
+-MODULE_FIRMWARE("rtl_bt/rtl8851bu_config.bin");
--- /dev/null
+From 29ad6bb313487370f9dfe5441fc8982593b6384e Mon Sep 17 00:00:00 2001
+From: Peng Zhang <zhangpeng.00@bytedance.com>
+Date: Wed, 19 Apr 2023 17:36:25 +0800
+Subject: maple_tree: fix allocation in mas_sparse_area()
+
+From: Peng Zhang <zhangpeng.00@bytedance.com>
+
+commit 29ad6bb313487370f9dfe5441fc8982593b6384e upstream.
+
+In the case of reverse allocation, mas->index and mas->last do not point
+to the correct allocation range, which will cause users to get incorrect
+allocation results, so fix it. If the user does not use it in a specific
+way, this bug will not be triggered.
+
+This is a bug, but only VMA uses it now, the way VMA is used now will
+not trigger it. There is a possibility that a user will trigger it in
+the future.
+
+Also re-check whether the size is still satisfied after the lower bound
+was increased, which is a corner case and is incorrect in previous
+versions.
+
+Link: https://lkml.kernel.org/r/20230419093625.99201-1-zhangpeng.00@bytedance.com
+Fixes: 54a611b60590 ("Maple Tree: add new data structure")
+Signed-off-by: Peng Zhang <zhangpeng.00@bytedance.com>
+Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/maple_tree.c | 41 ++++++++++++++++++++---------------------
+ 1 file changed, 20 insertions(+), 21 deletions(-)
+
+--- a/lib/maple_tree.c
++++ b/lib/maple_tree.c
+@@ -5277,25 +5277,28 @@ static inline void mas_fill_gap(struct m
+ * @size: The size of the gap
+ * @fwd: Searching forward or back
+ */
+-static inline void mas_sparse_area(struct ma_state *mas, unsigned long min,
++static inline int mas_sparse_area(struct ma_state *mas, unsigned long min,
+ unsigned long max, unsigned long size, bool fwd)
+ {
+- unsigned long start = 0;
+-
+- if (!unlikely(mas_is_none(mas)))
+- start++;
++ if (!unlikely(mas_is_none(mas)) && min == 0) {
++ min++;
++ /*
++ * At this time, min is increased, we need to recheck whether
++ * the size is satisfied.
++ */
++ if (min > max || max - min + 1 < size)
++ return -EBUSY;
++ }
+ /* mas_is_ptr */
+
+- if (start < min)
+- start = min;
+-
+ if (fwd) {
+- mas->index = start;
+- mas->last = start + size - 1;
+- return;
++ mas->index = min;
++ mas->last = min + size - 1;
++ } else {
++ mas->last = max;
++ mas->index = max - size + 1;
+ }
+-
+- mas->index = max;
++ return 0;
+ }
+
+ /*
+@@ -5324,10 +5327,8 @@ int mas_empty_area(struct ma_state *mas,
+ return -EBUSY;
+
+ /* Empty set */
+- if (mas_is_none(mas) || mas_is_ptr(mas)) {
+- mas_sparse_area(mas, min, max, size, true);
+- return 0;
+- }
++ if (mas_is_none(mas) || mas_is_ptr(mas))
++ return mas_sparse_area(mas, min, max, size, true);
+
+ /* The start of the window can only be within these values */
+ mas->index = min;
+@@ -5377,10 +5378,8 @@ int mas_empty_area_rev(struct ma_state *
+ }
+
+ /* Empty set. */
+- if (mas_is_none(mas) || mas_is_ptr(mas)) {
+- mas_sparse_area(mas, min, max, size, false);
+- return 0;
+- }
++ if (mas_is_none(mas) || mas_is_ptr(mas))
++ return mas_sparse_area(mas, min, max, size, false);
+
+ /* The start of the window can only be within these values. */
+ mas->index = min;
--- /dev/null
+From 955a923d2809803980ff574270f81510112be9cf Mon Sep 17 00:00:00 2001
+From: "Liam R. Howlett" <Liam.Howlett@oracle.com>
+Date: Mon, 22 Apr 2024 16:33:49 -0400
+Subject: maple_tree: fix mas_empty_area_rev() null pointer dereference
+
+From: Liam R. Howlett <Liam.Howlett@oracle.com>
+
+commit 955a923d2809803980ff574270f81510112be9cf upstream.
+
+Currently the code calls mas_start() followed by mas_data_end() if the
+maple state is MA_START, but mas_start() may return with the maple state
+node == NULL. This will lead to a null pointer dereference when checking
+information in the NULL node, which is done in mas_data_end().
+
+Avoid setting the offset if there is no node by waiting until after the
+maple state is checked for an empty or single entry state.
+
+A user could trigger the events to cause a kernel oops by unmapping all
+vmas to produce an empty maple tree, then mapping a vma that would cause
+the scenario described above.
+
+Link: https://lkml.kernel.org/r/20240422203349.2418465-1-Liam.Howlett@oracle.com
+Fixes: 54a611b60590 ("Maple Tree: add new data structure")
+Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
+Reported-by: Marius Fleischer <fleischermarius@gmail.com>
+Closes: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com/
+Link: https://lore.kernel.org/lkml/CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com/
+Tested-by: Marius Fleischer <fleischermarius@gmail.com>
+Tested-by: Sidhartha Kumar <sidhartha.kumar@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/maple_tree.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/lib/maple_tree.c
++++ b/lib/maple_tree.c
+@@ -5368,18 +5368,18 @@ int mas_empty_area_rev(struct ma_state *
+ if (min >= max)
+ return -EINVAL;
+
+- if (mas_is_start(mas)) {
++ if (mas_is_start(mas))
+ mas_start(mas);
+- mas->offset = mas_data_end(mas);
+- } else if (mas->offset >= 2) {
+- mas->offset -= 2;
+- } else if (!mas_rewind_node(mas)) {
++ else if ((mas->offset < 2) && (!mas_rewind_node(mas)))
+ return -EBUSY;
+- }
+
+- /* Empty set. */
+- if (mas_is_none(mas) || mas_is_ptr(mas))
++ if (unlikely(mas_is_none(mas) || mas_is_ptr(mas)))
+ return mas_sparse_area(mas, min, max, size, false);
++ else if (mas->offset >= 2)
++ mas->offset -= 2;
++ else
++ mas->offset = mas_data_end(mas);
++
+
+ /* The start of the window can only be within these values. */
+ mas->index = min;
drm-check-output-polling-initialized-before-disabling.patch
drm-check-polling-initialized-before-enabling-in-drm_helper_probe_single_connector_modes.patch
+bluetooth-btrtl-add-missing-module_firmware-declarations.patch
+maple_tree-fix-allocation-in-mas_sparse_area.patch
+maple_tree-fix-mas_empty_area_rev-null-pointer-dereference.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
