--- /dev/null
+From 0ab2feac32d09c0b478c45456631c0706796ec06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 16:28:48 +0100
+Subject: iio: adc: stm32-dfsdm: fill module aliases
+
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+
+[ Upstream commit cc3304052a89ab6ac887ed9224420a27e3d354e1 ]
+
+When STM32 DFSDM driver is built as module, no modalias information
+is available. This prevents module to be loaded by udev.
+Add MODULE_DEVICE_TABLE() to fill module aliases.
+
+Fixes: e2e6771c6462 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support")
+Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
+Link: https://lore.kernel.org/r/20221202152848.45585-1-olivier.moysan@foss.st.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
+index 1cfefb3b5e56..6592221cbe21 100644
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -1521,6 +1521,7 @@ static const struct of_device_id stm32_dfsdm_adc_match[] = {
+ },
+ {}
+ };
++MODULE_DEVICE_TABLE(of, stm32_dfsdm_adc_match);
+
+ static int stm32_dfsdm_adc_probe(struct platform_device *pdev)
+ {
+--
+2.39.0
+
--- /dev/null
+From 015e279e1fdad37f6ac868904a323287af282738 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 14:45:24 +0100
+Subject: Input: i8042 - add Clevo PCX0DX to i8042 quirk table
+
+From: Werner Sembach <wse@tuxedocomputers.com>
+
+[ Upstream commit 9c445d2637c938a800fcc8b5f0b10e60c94460c7 ]
+
+The Clevo PCX0DX/TUXEDO XP1511, need quirks for the keyboard to not be
+occasionally unresponsive after resume.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Link: https://lore.kernel.org/r/20230110134524.553620-1-wse@tuxedocomputers.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 3a41ac9af2e7..239c777f8271 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -1229,6 +1229,13 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
+ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS |
++ SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP)
++ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "X170SM"),
+--
+2.39.0
+
platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch
net-x25-fix-to-not-accept-on-connected-socket.patch
drm-amd-display-fix-timing-not-changning-when-freesy.patch
+iio-adc-stm32-dfsdm-fill-module-aliases.patch
+usb-dwc3-qcom-enable-vbus-override-when-in-otg-dr-mo.patch
+usb-gadget-f_fs-fix-unbalanced-spinlock-in-__ffs_ep0.patch
+vc_screen-move-load-of-struct-vc_data-pointer-in-vcs.patch
+input-i8042-add-clevo-pcx0dx-to-i8042-quirk-table.patch
--- /dev/null
+From 0270df4b21bf04b9de8f44cca829d00b84c52a38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 09:31:21 +0100
+Subject: usb: dwc3: qcom: enable vbus override when in OTG dr-mode
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit eb320f76e31dc835b9f57f04af1a2353b13bb7d8 ]
+
+With vbus override enabled when in OTG dr_mode, Host<->Peripheral
+switch now works on SM8550, otherwise the DWC3 seems to be stuck
+in Host mode only.
+
+Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20230123-topic-sm8550-upstream-dwc3-qcom-otg-v2-1-2d400e598463@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index ec1de6f6c290..28bc7480acf3 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -836,7 +836,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)
+ qcom->mode = usb_get_dr_mode(&qcom->dwc3->dev);
+
+ /* enable vbus override for device mode */
+- if (qcom->mode == USB_DR_MODE_PERIPHERAL)
++ if (qcom->mode != USB_DR_MODE_HOST)
+ dwc3_qcom_vbus_override_enable(qcom, true);
+
+ /* register extcon to override sw_vbus on Vbus change later */
+--
+2.39.0
+
--- /dev/null
+From 156d91ac8d95d7815f60689a17e7eb5e9886268c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 14:41:49 +0530
+Subject: usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
+
+From: Udipto Goswami <quic_ugoswami@quicinc.com>
+
+[ Upstream commit 921deb9da15851425ccbb6ee409dc2fd8fbdfe6b ]
+
+__ffs_ep0_queue_wait executes holding the spinlock of &ffs->ev.waitq.lock
+and unlocks it after the assignments to usb_request are done.
+However in the code if the request is already NULL we bail out returning
+-EINVAL but never unlocked the spinlock.
+
+Fix this by adding spin_unlock_irq &ffs->ev.waitq.lock before returning.
+
+Fixes: 6a19da111057 ("usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait")
+Reviewed-by: John Keeping <john@metanate.com>
+Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
+Link: https://lore.kernel.org/r/20230124091149.18647-1-quic_ugoswami@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index c9145ee95956..f975111bd974 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -279,8 +279,10 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
+ struct usb_request *req = ffs->ep0req;
+ int ret;
+
+- if (!req)
++ if (!req) {
++ spin_unlock_irq(&ffs->ev.waitq.lock);
+ return -EINVAL;
++ }
+
+ req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
+
+--
+2.39.0
+
--- /dev/null
+From 26b58b4d7e2156aa97c3c23b5f8778d010abda58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 11:16:54 -0500
+Subject: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid
+ UAF
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 226fae124b2dac217ea5436060d623ff3385bc34 ]
+
+After a call to console_unlock() in vcs_read() the vc_data struct can be
+freed by vc_deallocate(). Because of that, the struct vc_data pointer
+load must be done at the top of while loop in vcs_read() to avoid a UAF
+when vcs_size() is called.
+
+Syzkaller reported a UAF in vcs_size().
+
+BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215)
+Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537
+
+CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1
+Hardware name: Red Hat KVM, BIOS 1.15.0-2.module
+Call Trace:
+ <TASK>
+__asan_report_load4_noabort (mm/kasan/report_generic.c:350)
+vcs_size (drivers/tty/vt/vc_screen.c:215)
+vcs_read (drivers/tty/vt/vc_screen.c:415)
+vfs_read (fs/read_write.c:468 fs/read_write.c:450)
+...
+ </TASK>
+
+Allocated by task 1191:
+...
+kmalloc_trace (mm/slab_common.c:1069)
+vc_allocate (./include/linux/slab.h:580 ./include/linux/slab.h:720
+ drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108)
+con_install (drivers/tty/vt/vt.c:3383)
+tty_init_dev (drivers/tty/tty_io.c:1301 drivers/tty/tty_io.c:1413
+ drivers/tty/tty_io.c:1390)
+tty_open (drivers/tty/tty_io.c:2080 drivers/tty/tty_io.c:2126)
+chrdev_open (fs/char_dev.c:415)
+do_dentry_open (fs/open.c:883)
+vfs_open (fs/open.c:1014)
+...
+
+Freed by task 1548:
+...
+kfree (mm/slab_common.c:1021)
+vc_port_destruct (drivers/tty/vt/vt.c:1094)
+tty_port_destructor (drivers/tty/tty_port.c:296)
+tty_port_put (drivers/tty/tty_port.c:312)
+vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2))
+vt_ioctl (drivers/tty/vt/vt_ioctl.c:903)
+tty_ioctl (drivers/tty/tty_io.c:2776)
+...
+
+The buggy address belongs to the object at ffff888113747800
+ which belongs to the cache kmalloc-1k of size 1024
+The buggy address is located 424 bytes inside of
+ 1024-byte region [ffff888113747800, ffff888113747c00)
+
+The buggy address belongs to the physical page:
+page:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000
+ index:0x0 pfn:0x113740
+head:00000000b3fe6c7c order:3 compound_mapcount:0 subpages_mapcount:0
+ compound_pincount:0
+anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
+raw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001
+raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+> ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+Disabling lock debugging due to kernel taint
+
+Fixes: ac751efa6a0d ("console: rename acquire/release_console_sem() to console_lock/unlock()")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Suggested-by: Jiri Slaby <jirislaby@kernel.org>
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Link: https://lore.kernel.org/r/1674577014-12374-1-git-send-email-george.kennedy@oracle.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vc_screen.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index 1850bacdb5b0..f566eb1839dc 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -386,10 +386,6 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+
+ uni_mode = use_unicode(inode);
+ attr = use_attributes(inode);
+- ret = -ENXIO;
+- vc = vcs_vc(inode, &viewed);
+- if (!vc)
+- goto unlock_out;
+
+ ret = -EINVAL;
+ if (pos < 0)
+@@ -407,6 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+ unsigned int this_round, skip = 0;
+ int size;
+
++ ret = -ENXIO;
++ vc = vcs_vc(inode, &viewed);
++ if (!vc)
++ goto unlock_out;
++
+ /* Check whether we are above size each round,
+ * as copy_to_user at the end of this loop
+ * could sleep.
+--
+2.39.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
