4.19-stable patches

added patches:
	arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch
	media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch

diff --git a/queue-4.19/arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch b/queue-4.19/arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch
new file mode 100644 (file)
index 0000000..7cb6619
--- /dev/null
+++ b/queue-4.19/arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch
@@ -0,0 +1,39 @@
+From 2a355ec25729053bb9a1a89b6c1d1cdd6c3b3fb1 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Thu, 13 Dec 2018 13:47:38 +0000
+Subject: arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 2a355ec25729053bb9a1a89b6c1d1cdd6c3b3fb1 upstream.
+
+While the CSV3 field of the ID_AA64_PFR0 CPU ID register can be checked
+to see if a CPU is susceptible to Meltdown and therefore requires kpti
+to be enabled, existing CPUs do not implement this field.
+
+We therefore whitelist all unaffected Cortex-A CPUs that do not implement
+the CSV3 field.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Cc: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/cpufeature.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -895,6 +895,12 @@ static bool unmap_kernel_at_el0(const st
+       static const struct midr_range kpti_safe_list[] = {
+               MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
+               MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
++              MIDR_ALL_VERSIONS(MIDR_CORTEX_A35),
++              MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
++              MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
++              MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
++              MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
++              MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+               { /* sentinel */ }
+       };
+       char const *str = "command line option";

diff --git a/queue-4.19/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch b/queue-4.19/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch
new file mode 100644 (file)
index 0000000..f31cb03
--- /dev/null
+++ b/queue-4.19/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch
@@ -0,0 +1,72 @@
+From 0c4df39e504bf925ab666132ac3c98d6cbbe380b Mon Sep 17 00:00:00 2001
+From: Sean Young <sean@mess.org>
+Date: Wed, 3 Jul 2019 10:52:39 -0400
+Subject: media: technisat-usb2: break out of loop at end of buffer
+
+From: Sean Young <sean@mess.org>
+
+commit 0c4df39e504bf925ab666132ac3c98d6cbbe380b upstream.
+
+Ensure we do not access the buffer beyond the end if no 0xff byte
+is encountered.
+
+Reported-by: syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com
+Signed-off-by: Sean Young <sean@mess.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/technisat-usb2.c |   22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb/technisat-usb2.c
++++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
+@@ -607,10 +607,9 @@ static int technisat_usb2_frontend_attac
+ static int technisat_usb2_get_ir(struct dvb_usb_device *d)
+ {
+       struct technisat_usb2_state *state = d->priv;
+-      u8 *buf = state->buf;
+-      u8 *b;
+-      int ret;
+       struct ir_raw_event ev;
++      u8 *buf = state->buf;
++      int i, ret;
+ 
+       buf[0] = GET_IR_DATA_VENDOR_REQUEST;
+       buf[1] = 0x08;
+@@ -646,26 +645,25 @@ unlock:
+               return 0; /* no key pressed */
+ 
+       /* decoding */
+-      b = buf+1;
+ 
+ #if 0
+       deb_rc("RC: %d ", ret);
+-      debug_dump(b, ret, deb_rc);
++      debug_dump(buf + 1, ret, deb_rc);
+ #endif
+ 
+       ev.pulse = 0;
+-      while (1) {
+-              ev.pulse = !ev.pulse;
+-              ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000;
+-              ir_raw_event_store(d->rc_dev, &ev);
+-
+-              b++;
+-              if (*b == 0xff) {
++      for (i = 1; i < ARRAY_SIZE(state->buf); i++) {
++              if (buf[i] == 0xff) {
+                       ev.pulse = 0;
+                       ev.duration = 888888*2;
+                       ir_raw_event_store(d->rc_dev, &ev);
+                       break;
+               }
++
++              ev.pulse = !ev.pulse;
++              ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR *
++                             FIRMWARE_CLOCK_TICK) / 1000;
++              ir_raw_event_store(d->rc_dev, &ev);
+       }
+ 
+       ir_raw_event_handle(d->rc_dev);

diff --git a/queue-4.19/series b/queue-4.19/series
index 67e7563bc58f2558f85be1423a8d07efe7f3e40d..8df8635a8fd52cec284aea6c80794845210feaa2 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -75,3 +75,5 @@ pci-kirin-fix-section-mismatch-warning.patch
 ovl-fix-regression-caused-by-overlapping-layers-detection.patch
 floppy-fix-usercopy-direction.patch
 binfmt_elf-move-brk-out-of-mmap-when-doing-direct-loader-exec.patch
+arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch
+media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch