From: Greg Kroah-Hartman Date: Tue, 7 Mar 2023 16:21:59 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v6.2.3~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=107678f39d74025322f4019b07f579cd1c9beee3;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: drm-radeon-fix-edp-for-single-display-imac11-2.patch pci-avoid-flr-for-amd-fch-ahci-adapters.patch scsi-ses-don-t-attach-if-enclosure-has-no-components.patch scsi-ses-fix-possible-addl_desc_ptr-out-of-bounds-accesses.patch scsi-ses-fix-possible-desc_ptr-out-of-bounds-accesses.patch scsi-ses-fix-slab-out-of-bounds-in-ses_enclosure_data_process.patch scsi-ses-fix-slab-out-of-bounds-in-ses_intf_remove.patch --- diff --git a/queue-4.19/drm-radeon-fix-edp-for-single-display-imac11-2.patch b/queue-4.19/drm-radeon-fix-edp-for-single-display-imac11-2.patch new file mode 100644 index 00000000000..22eddfe8c8c --- /dev/null +++ b/queue-4.19/drm-radeon-fix-edp-for-single-display-imac11-2.patch @@ -0,0 +1,46 @@ +From 05eacc198c68cbb35a7281ce4011f8899ee1cfb8 Mon Sep 17 00:00:00 2001 +From: Mark Hawrylak +Date: Sun, 19 Feb 2023 16:02:00 +1100 +Subject: drm/radeon: Fix eDP for single-display iMac11,2 + +From: Mark Hawrylak + +commit 05eacc198c68cbb35a7281ce4011f8899ee1cfb8 upstream. + +Apple iMac11,2 (mid 2010) also with Radeon HD-4670 that has the same +issue as iMac10,1 (late 2009) where the internal eDP panel stays dark on +driver load. This patch treats iMac11,2 the same as iMac10,1, +so the eDP panel stays active. + +Additional steps: +Kernel boot parameter radeon.nomodeset=0 required to keep the eDP +panel active. + +This patch is an extension of +commit 564d8a2cf3ab ("drm/radeon: Fix eDP for single-display iMac10,1 (v2)") +Link: https://lore.kernel.org/all/lsq.1507553064.833262317@decadent.org.uk/ +Signed-off-by: Mark Hawrylak +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/atombios_encoders.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -2188,11 +2188,12 @@ int radeon_atom_pick_dig_encoder(struct + + /* + * On DCE32 any encoder can drive any block so usually just use crtc id, +- * but Apple thinks different at least on iMac10,1, so there use linkb, ++ * but Apple thinks different at least on iMac10,1 and iMac11,2, so there use linkb, + * otherwise the internal eDP panel will stay dark. + */ + if (ASIC_IS_DCE32(rdev)) { +- if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1")) ++ if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1") || ++ dmi_match(DMI_PRODUCT_NAME, "iMac11,2")) + enc_idx = (dig->linkb) ? 1 : 0; + else + enc_idx = radeon_crtc->crtc_id; diff --git a/queue-4.19/pci-avoid-flr-for-amd-fch-ahci-adapters.patch b/queue-4.19/pci-avoid-flr-for-amd-fch-ahci-adapters.patch new file mode 100644 index 00000000000..0f098a9f14d --- /dev/null +++ b/queue-4.19/pci-avoid-flr-for-amd-fch-ahci-adapters.patch @@ -0,0 +1,48 @@ +From 63ba51db24ed1b8f8088a897290eb6c036c5435d Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Sat, 28 Jan 2023 10:39:51 +0900 +Subject: PCI: Avoid FLR for AMD FCH AHCI adapters + +From: Damien Le Moal + +commit 63ba51db24ed1b8f8088a897290eb6c036c5435d upstream. + +PCI passthrough to VMs does not work with AMD FCH AHCI adapters: the guest +OS fails to correctly probe devices attached to the controller due to FIS +communication failures: + + ata4: softreset failed (1st FIS failed) + ... + ata4.00: qc timeout after 5000 msecs (cmd 0xec) + ata4.00: failed to IDENTIFY (I/O error, err_mask=0x4) + +Forcing the "bus" reset method before unbinding & binding the adapter to +the vfio-pci driver solves this issue, e.g.: + + echo "bus" > /sys/bus/pci/devices//reset_method + +gives a working guest OS, indicating that the default FLR reset method +doesn't work correctly. + +Apply quirk_no_flr() to AMD FCH AHCI devices to work around this issue. + +Link: https://lore.kernel.org/r/20230128013951.523247-1-damien.lemoal@opensource.wdc.com +Reported-by: Niklas Cassel +Signed-off-by: Damien Le Moal +Signed-off-by: Bjorn Helgaas +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5153,6 +5153,7 @@ static void quirk_no_flr(struct pci_dev + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1487, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x148c, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x149c, quirk_no_flr); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr); + diff --git a/queue-4.19/scsi-ses-don-t-attach-if-enclosure-has-no-components.patch b/queue-4.19/scsi-ses-don-t-attach-if-enclosure-has-no-components.patch new file mode 100644 index 00000000000..d3a7e3cea7d --- /dev/null +++ b/queue-4.19/scsi-ses-don-t-attach-if-enclosure-has-no-components.patch @@ -0,0 +1,41 @@ +From 3fe97ff3d94934649abb0652028dd7296170c8d0 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Sat, 28 Nov 2020 15:27:21 -0800 +Subject: scsi: ses: Don't attach if enclosure has no components + +From: James Bottomley + +commit 3fe97ff3d94934649abb0652028dd7296170c8d0 upstream. + +An enclosure with no components can't usefully be operated by the driver +(since effectively it has nothing to manage), so report the problem and +don't attach. Not attaching also fixes an oops which could occur if the +driver tries to manage a zero component enclosure. + +[mkp: Switched to KERN_WARNING since this scenario is common] + +Link: https://lore.kernel.org/r/c5deac044ac409e32d9ad9968ce0dcbc996bfc7a.camel@linux.ibm.com +Cc: stable@vger.kernel.org +Reported-by: Ding Hui +Signed-off-by: James Bottomley +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ses.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -720,6 +720,12 @@ static int ses_intf_add(struct device *c + type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) + components += type_ptr[1]; + } ++ ++ if (components == 0) { ++ sdev_printk(KERN_WARNING, sdev, "enclosure has no enumerated components\n"); ++ goto err_free; ++ } ++ + ses_dev->page1 = buf; + ses_dev->page1_len = len; + buf = NULL; diff --git a/queue-4.19/scsi-ses-fix-possible-addl_desc_ptr-out-of-bounds-accesses.patch b/queue-4.19/scsi-ses-fix-possible-addl_desc_ptr-out-of-bounds-accesses.patch new file mode 100644 index 00000000000..87c659cd9f8 --- /dev/null +++ b/queue-4.19/scsi-ses-fix-possible-addl_desc_ptr-out-of-bounds-accesses.patch @@ -0,0 +1,114 @@ +From db95d4df71cb55506425b6e4a5f8d68e3a765b63 Mon Sep 17 00:00:00 2001 +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:49 +0100 +Subject: scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses + +From: Tomas Henzl + +commit db95d4df71cb55506425b6e4a5f8d68e3a765b63 upstream. + +Sanitize possible addl_desc_ptr out-of-bounds accesses in +ses_enclosure_data_process(). + +Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ses.c | 35 ++++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -449,8 +449,8 @@ int ses_match_host(struct enclosure_devi + } + #endif /* 0 */ + +-static void ses_process_descriptor(struct enclosure_component *ecomp, +- unsigned char *desc) ++static int ses_process_descriptor(struct enclosure_component *ecomp, ++ unsigned char *desc, int max_desc_len) + { + int eip = desc[0] & 0x10; + int invalid = desc[0] & 0x80; +@@ -461,22 +461,32 @@ static void ses_process_descriptor(struc + unsigned char *d; + + if (invalid) +- return; ++ return 0; + + switch (proto) { + case SCSI_PROTOCOL_FCP: + if (eip) { ++ if (max_desc_len <= 7) ++ return 1; + d = desc + 4; + slot = d[3]; + } + break; + case SCSI_PROTOCOL_SAS: ++ + if (eip) { ++ if (max_desc_len <= 27) ++ return 1; + d = desc + 4; + slot = d[3]; + d = desc + 8; +- } else ++ } else { ++ if (max_desc_len <= 23) ++ return 1; + d = desc + 4; ++ } ++ ++ + /* only take the phy0 addr */ + addr = (u64)d[12] << 56 | + (u64)d[13] << 48 | +@@ -493,6 +503,8 @@ static void ses_process_descriptor(struc + } + ecomp->slot = slot; + scomp->addr = addr; ++ ++ return 0; + } + + struct efd { +@@ -565,7 +577,7 @@ static void ses_enclosure_data_process(s + /* skip past overall descriptor */ + desc_ptr += len + 4; + } +- if (ses_dev->page10) ++ if (ses_dev->page10 && ses_dev->page10_len > 9) + addl_desc_ptr = ses_dev->page10 + 8; + type_ptr = ses_dev->page1_types; + components = 0; +@@ -573,6 +585,7 @@ static void ses_enclosure_data_process(s + for (j = 0; j < type_ptr[1]; j++) { + char *name = NULL; + struct enclosure_component *ecomp; ++ int max_desc_len; + + if (desc_ptr) { + if (desc_ptr >= buf + page7_len) { +@@ -599,10 +612,14 @@ static void ses_enclosure_data_process(s + ecomp = &edev->component[components++]; + + if (!IS_ERR(ecomp)) { +- if (addl_desc_ptr) +- ses_process_descriptor( +- ecomp, +- addl_desc_ptr); ++ if (addl_desc_ptr) { ++ max_desc_len = ses_dev->page10_len - ++ (addl_desc_ptr - ses_dev->page10); ++ if (ses_process_descriptor(ecomp, ++ addl_desc_ptr, ++ max_desc_len)) ++ addl_desc_ptr = NULL; ++ } + if (create) + enclosure_component_register( + ecomp); diff --git a/queue-4.19/scsi-ses-fix-possible-desc_ptr-out-of-bounds-accesses.patch b/queue-4.19/scsi-ses-fix-possible-desc_ptr-out-of-bounds-accesses.patch new file mode 100644 index 00000000000..79b649a08a0 --- /dev/null +++ b/queue-4.19/scsi-ses-fix-possible-desc_ptr-out-of-bounds-accesses.patch @@ -0,0 +1,48 @@ +From 801ab13d50cf3d26170ee073ea8bb4eececb76ab Mon Sep 17 00:00:00 2001 +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:50 +0100 +Subject: scsi: ses: Fix possible desc_ptr out-of-bounds accesses + +From: Tomas Henzl + +commit 801ab13d50cf3d26170ee073ea8bb4eececb76ab upstream. + +Sanitize possible desc_ptr out-of-bounds accesses in +ses_enclosure_data_process(). + +Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ses.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -588,15 +588,19 @@ static void ses_enclosure_data_process(s + int max_desc_len; + + if (desc_ptr) { +- if (desc_ptr >= buf + page7_len) { ++ if (desc_ptr + 3 >= buf + page7_len) { + desc_ptr = NULL; + } else { + len = (desc_ptr[2] << 8) + desc_ptr[3]; + desc_ptr += 4; +- /* Add trailing zero - pushes into +- * reserved space */ +- desc_ptr[len] = '\0'; +- name = desc_ptr; ++ if (desc_ptr + len > buf + page7_len) ++ desc_ptr = NULL; ++ else { ++ /* Add trailing zero - pushes into ++ * reserved space */ ++ desc_ptr[len] = '\0'; ++ name = desc_ptr; ++ } + } + } + if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE || diff --git a/queue-4.19/scsi-ses-fix-slab-out-of-bounds-in-ses_enclosure_data_process.patch b/queue-4.19/scsi-ses-fix-slab-out-of-bounds-in-ses_enclosure_data_process.patch new file mode 100644 index 00000000000..7bf824d4cad --- /dev/null +++ b/queue-4.19/scsi-ses-fix-slab-out-of-bounds-in-ses_enclosure_data_process.patch @@ -0,0 +1,43 @@ +From 9b4f5028e493cb353a5c8f5c45073eeea0303abd Mon Sep 17 00:00:00 2001 +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:48 +0100 +Subject: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() + +From: Tomas Henzl + +commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd upstream. + +A fix for: + +BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] +Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 + +Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we +expect the size to be sanitized before first access to addl_desc_ptr[1]. +Make sure we don't walk beyond end of page. + +Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ses.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -619,9 +619,11 @@ static void ses_enclosure_data_process(s + /* these elements are optional */ + type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || + type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || +- type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) ++ type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) { + addl_desc_ptr += addl_desc_ptr[1] + 2; +- ++ if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len) ++ addl_desc_ptr = NULL; ++ } + } + } + kfree(buf); diff --git a/queue-4.19/scsi-ses-fix-slab-out-of-bounds-in-ses_intf_remove.patch b/queue-4.19/scsi-ses-fix-slab-out-of-bounds-in-ses_intf_remove.patch new file mode 100644 index 00000000000..8bc3b902260 --- /dev/null +++ b/queue-4.19/scsi-ses-fix-slab-out-of-bounds-in-ses_intf_remove.patch @@ -0,0 +1,38 @@ +From 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 Mon Sep 17 00:00:00 2001 +From: Tomas Henzl +Date: Thu, 2 Feb 2023 17:24:51 +0100 +Subject: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() + +From: Tomas Henzl + +commit 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 upstream. + +A fix for: + +BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] +Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013 + +When edev->components is zero, accessing edev->component[0] members is +wrong. + +Link: https://lore.kernel.org/r/20230202162451.15346-5-thenzl@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ses.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -872,7 +872,8 @@ static void ses_intf_remove_enclosure(st + kfree(ses_dev->page2); + kfree(ses_dev); + +- kfree(edev->component[0].scratch); ++ if (edev->components) ++ kfree(edev->component[0].scratch); + + put_device(&edev->edev); + enclosure_unregister(edev); diff --git a/queue-4.19/series b/queue-4.19/series index ce1e885f762..e02dc138797 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -188,3 +188,10 @@ ktest.pl-add-run_timeout-option-with-default-unlimited.patch scsi-core-remove-the-proc-scsi-proc_name-directory-earlier.patch scsi-qla2xxx-fix-link-failure-in-npiv-environment.patch scsi-qla2xxx-fix-erroneous-link-down.patch +scsi-ses-don-t-attach-if-enclosure-has-no-components.patch +scsi-ses-fix-slab-out-of-bounds-in-ses_enclosure_data_process.patch +scsi-ses-fix-possible-addl_desc_ptr-out-of-bounds-accesses.patch +scsi-ses-fix-possible-desc_ptr-out-of-bounds-accesses.patch +scsi-ses-fix-slab-out-of-bounds-in-ses_intf_remove.patch +pci-avoid-flr-for-amd-fch-ahci-adapters.patch +drm-radeon-fix-edp-for-single-display-imac11-2.patch