--- /dev/null
+From 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Fri, 23 Feb 2024 12:36:23 -0500
+Subject: Bluetooth: btintel: Fixe build regression
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 6e62ebfb49eb65bdcbfc5797db55e0ce7f79c3dd upstream.
+
+This fixes the following build regression:
+
+drivers-bluetooth-btintel.c-btintel_read_version()-warn:
+passing-zero-to-PTR_ERR
+
+Fixes: b79e04091010 ("Bluetooth: btintel: Fix null ptr deref in btintel_read_version")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btintel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/bluetooth/btintel.c
++++ b/drivers/bluetooth/btintel.c
+@@ -435,13 +435,13 @@ int btintel_read_version(struct hci_dev
+ struct sk_buff *skb;
+
+ skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
+- if (IS_ERR_OR_NULL(skb)) {
++ if (IS_ERR(skb)) {
+ bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
+ PTR_ERR(skb));
+ return PTR_ERR(skb);
+ }
+
+- if (skb->len != sizeof(*ver)) {
++ if (!skb || skb->len != sizeof(*ver)) {
+ bt_dev_err(hdev, "Intel version event size mismatch");
+ kfree_skb(skb);
+ return -EILSEQ;
--- /dev/null
+From 025f8ad20f2e3264d11683aa9cbbf0083eefbdcd Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Thu, 22 Feb 2024 15:03:10 +0100
+Subject: net: mpls: error out if inner headers are not set
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 025f8ad20f2e3264d11683aa9cbbf0083eefbdcd upstream.
+
+mpls_gso_segment() assumes skb_inner_network_header() returns
+a valid result:
+
+ mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
+ if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
+ goto out;
+ if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
+
+With syzbot reproducer, skb_inner_network_header() yields 0,
+skb_network_header() returns 108, so this will
+"pskb_may_pull(skb, -108)))" which triggers a newly added
+DEBUG_NET_WARN_ON_ONCE() check:
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull_reason include/linux/skbuff.h:2723 [inline]
+WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 pskb_may_pull include/linux/skbuff.h:2739 [inline]
+WARNING: CPU: 0 PID: 5068 at include/linux/skbuff.h:2723 mpls_gso_segment+0x773/0xaa0 net/mpls/mpls_gso.c:34
+[..]
+ skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53
+ nsh_gso_segment+0x40a/0xad0 net/nsh/nsh.c:108
+ skb_mac_gso_segment+0x383/0x740 net/core/gso.c:53
+ __skb_gso_segment+0x324/0x4c0 net/core/gso.c:124
+ skb_gso_segment include/net/gso.h:83 [inline]
+ [..]
+ sch_direct_xmit+0x11a/0x5f0 net/sched/sch_generic.c:327
+ [..]
+ packet_sendmsg+0x46a9/0x6130 net/packet/af_packet.c:3113
+ [..]
+
+First iteration of this patch made mpls_hlen signed and changed
+test to error out to "mpls_hlen <= 0 || ..".
+
+Eric Dumazet said:
+ > I was thinking about adding a debug check in skb_inner_network_header()
+ > if inner_network_header is zero (that would mean it is not 'set' yet),
+ > but this would trigger even after your patch.
+
+So add new skb_inner_network_header_was_set() helper and use that.
+
+The syzbot reproducer injects data via packet socket. The skb that gets
+allocated and passed down the stack has ->protocol set to NSH (0x894f)
+and gso_type set to SKB_GSO_UDP | SKB_GSO_DODGY.
+
+This gets passed to skb_mac_gso_segment(), which sees NSH as ptype to
+find a callback for. nsh_gso_segment() retrieves next type:
+
+ proto = tun_p_to_eth_p(nsh_hdr(skb)->np);
+
+... which is MPLS (TUN_P_MPLS_UC). It updates skb->protocol and then
+calls mpls_gso_segment(). Inner offsets are all 0, so mpls_gso_segment()
+ends up with a negative header size.
+
+In case more callers rely on silent handling of such large may_pull values
+we could also 'legalize' this behaviour, either replacing the debug check
+with (len > INT_MAX) test or removing it and instead adding a comment
+before existing
+
+ if (unlikely(len > skb->len))
+ return SKB_DROP_REASON_PKT_TOO_SMALL;
+
+test in pskb_may_pull_reason(), saying that this check also implicitly
+takes care of callers that miscompute header sizes.
+
+Cc: Simon Horman <horms@kernel.org>
+Fixes: 219eee9c0d16 ("net: skbuff: add overflow debug check to pull/push helpers")
+Reported-by: syzbot+99d15fcdb0132a1e1a82@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/00000000000043b1310611e388aa@google.com/raw
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Link: https://lore.kernel.org/r/20240222140321.14080-1-fw@strlen.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/skbuff.h | 5 +++++
+ net/mpls/mpls_gso.c | 3 +++
+ 2 files changed, 8 insertions(+)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2847,6 +2847,11 @@ static inline void skb_set_inner_network
+ skb->inner_network_header += offset;
+ }
+
++static inline bool skb_inner_network_header_was_set(const struct sk_buff *skb)
++{
++ return skb->inner_network_header > 0;
++}
++
+ static inline unsigned char *skb_inner_mac_header(const struct sk_buff *skb)
+ {
+ return skb->head + skb->inner_mac_header;
+--- a/net/mpls/mpls_gso.c
++++ b/net/mpls/mpls_gso.c
+@@ -27,6 +27,9 @@ static struct sk_buff *mpls_gso_segment(
+ __be16 mpls_protocol;
+ unsigned int mpls_hlen;
+
++ if (!skb_inner_network_header_was_set(skb))
++ goto out;
++
+ skb_reset_network_header(skb);
+ mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
+ if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
--- /dev/null
+From 03c6284df179de3a4a6e0684764b1c71d2a405e2 Mon Sep 17 00:00:00 2001
+From: Ma Jun <Jun.Ma2@amd.com>
+Date: Tue, 19 Mar 2024 15:24:03 +0800
+Subject: Revert "drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ma Jun <Jun.Ma2@amd.com>
+
+commit 03c6284df179de3a4a6e0684764b1c71d2a405e2 upstream.
+
+This patch causes the following iounmap erorr and calltrace
+iounmap: bad address 00000000d0b3631f
+
+The original patch was unjustified because amdgpu_device_fini_sw() will
+always cleanup the rmmio mapping.
+
+This reverts commit eb4f139888f636614dab3bcce97ff61cefc4b3a7.
+
+Signed-off-by: Ma Jun <Jun.Ma2@amd.com>
+Suggested-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 1e9454e6e4cb..5dc24c971b41 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4040,10 +4040,8 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ * early on during init and before calling to RREG32.
+ */
+ adev->reset_domain = amdgpu_reset_create_reset_domain(SINGLE_DEVICE, "amdgpu-reset-dev");
+- if (!adev->reset_domain) {
+- r = -ENOMEM;
+- goto unmap_memory;
+- }
++ if (!adev->reset_domain)
++ return -ENOMEM;
+
+ /* detect hw virtualization here */
+ amdgpu_detect_virtualization(adev);
+@@ -4053,7 +4051,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ r = amdgpu_device_get_job_timeout_settings(adev);
+ if (r) {
+ dev_err(adev->dev, "invalid lockup_timeout parameter syntax\n");
+- goto unmap_memory;
++ return r;
+ }
+
+ amdgpu_device_set_mcbp(adev);
+@@ -4061,12 +4059,12 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ /* early init functions */
+ r = amdgpu_device_ip_early_init(adev);
+ if (r)
+- goto unmap_memory;
++ return r;
+
+ /* Get rid of things like offb */
+ r = drm_aperture_remove_conflicting_pci_framebuffers(adev->pdev, &amdgpu_kms_driver);
+ if (r)
+- goto unmap_memory;
++ return r;
+
+ /* Enable TMZ based on IP_VERSION */
+ amdgpu_gmc_tmz_set(adev);
+@@ -4076,7 +4074,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ if (adev->gmc.xgmi.supported) {
+ r = adev->gfxhub.funcs->get_xgmi_info(adev);
+ if (r)
+- goto unmap_memory;
++ return r;
+ }
+
+ /* enable PCIE atomic ops */
+@@ -4345,8 +4343,6 @@ int amdgpu_device_init(struct amdgpu_device *adev,
+ failed:
+ amdgpu_vf_error_trans_all(adev);
+
+-unmap_memory:
+- iounmap(adev->rmmio);
+ return r;
+ }
+
+--
+2.44.0
+
platform-x86-intel-hid-don-t-wake-on-5-button-releas.patch
platform-x86-intel-vbtn-update-tablet-mode-switch-at.patch
nouveau-fix-devinit-paths-to-only-handle-display-on-.patch
+bluetooth-btintel-fixe-build-regression.patch
+net-mpls-error-out-if-inner-headers-are-not-set.patch
+vmci-fix-possible-memcpy-run-time-warning-in-vmci_datagram_invoke_guest_handler.patch
+x86-vdso-fix-rethunk-patching-for-vdso-image-x32.o-too.patch
+revert-drm-amd-amdgpu-fix-potential-ioremap-memory-leaks-in-amdgpu_device_init.patch
--- /dev/null
+From e606e4b71798cc1df20e987dde2468e9527bd376 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kovalev <kovalev@altlinux.org>
+Date: Mon, 19 Feb 2024 13:53:15 +0300
+Subject: VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
+
+From: Vasiliy Kovalev <kovalev@altlinux.org>
+
+commit e606e4b71798cc1df20e987dde2468e9527bd376 upstream.
+
+The changes are similar to those given in the commit 19b070fefd0d
+("VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()").
+
+Fix filling of the msg and msg_payload in dg_info struct, which prevents a
+possible "detected field-spanning write" of memcpy warning that is issued
+by the tracking mechanism __fortify_memcpy_chk.
+
+Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
+Link: https://lore.kernel.org/r/20240219105315.76955-1-kovalev@altlinux.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/vmw_vmci/vmci_datagram.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/vmw_vmci/vmci_datagram.c
++++ b/drivers/misc/vmw_vmci/vmci_datagram.c
+@@ -378,7 +378,8 @@ int vmci_datagram_invoke_guest_handler(s
+
+ dg_info->in_dg_host_queue = false;
+ dg_info->entry = dst_entry;
+- memcpy(&dg_info->msg, dg, VMCI_DG_SIZE(dg));
++ dg_info->msg = *dg;
++ memcpy(&dg_info->msg_payload, dg + 1, dg->payload_size);
+
+ INIT_WORK(&dg_info->work, dg_delayed_dispatch);
+ schedule_work(&dg_info->work);
--- /dev/null
+From 4969d75dd9077e19e175e60f3c5a6c7653252e63 Mon Sep 17 00:00:00 2001
+From: "Borislav Petkov (AMD)" <bp@alien8.de>
+Date: Tue, 26 Mar 2024 10:47:14 +0100
+Subject: x86/vdso: Fix rethunk patching for vdso-image-x32.o too
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+commit 4969d75dd9077e19e175e60f3c5a6c7653252e63 upstream.
+
+In a similar fashion to
+
+ b388e57d4628 ("x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o")
+
+annotate vdso-image-x32.o too for objtool so that it gets annotated
+properly and the unused return thunk warning doesn't fire.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202403251454.23df6278-lkp@intel.com
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/202403251454.23df6278-lkp@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/entry/vdso/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/entry/vdso/Makefile
++++ b/arch/x86/entry/vdso/Makefile
+@@ -37,6 +37,7 @@ KCSAN_SANITIZE_vma.o := y
+
+ OBJECT_FILES_NON_STANDARD_extable.o := n
+ OBJECT_FILES_NON_STANDARD_vdso-image-32.o := n
++OBJECT_FILES_NON_STANDARD_vdso-image-x32.o := n
+ OBJECT_FILES_NON_STANDARD_vdso-image-64.o := n
+ OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n
+ OBJECT_FILES_NON_STANDARD_vma.o := n
projects / thirdparty / kernel / stable-queue.git / commitdiff
