From: Greg Kroah-Hartman Date: Sun, 10 Nov 2024 05:21:42 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v5.15.172~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=46ad24ef4cd2d8f9fb5143cd38427c824660c728;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch revert-wifi-mac80211-fix-rcu-list-iterations.patch --- diff --git a/queue-6.6/media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch b/queue-6.6/media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch new file mode 100644 index 00000000000..559c34d2e99 --- /dev/null +++ b/queue-6.6/media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch @@ -0,0 +1,35 @@ +From ecf2b43018da9579842c774b7f35dbe11b5c38dd Mon Sep 17 00:00:00 2001 +From: Benoit Sevens +Date: Thu, 7 Nov 2024 14:22:02 +0000 +Subject: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format + +From: Benoit Sevens + +commit ecf2b43018da9579842c774b7f35dbe11b5c38dd upstream. + +This can lead to out of bounds writes since frames of this type were not +taken into account when calculating the size of the frames buffer in +uvc_parse_streaming. + +Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") +Signed-off-by: Benoit Sevens +Cc: stable@vger.kernel.org +Acked-by: Greg Kroah-Hartman +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -371,7 +371,7 @@ static int uvc_parse_format(struct uvc_d + * Parse the frame descriptors. Only uncompressed, MJPEG and frame + * based formats have frame descriptors. + */ +- while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE && ++ while (ftype && buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE && + buffer[2] == ftype) { + unsigned int maxIntervalIndex; + diff --git a/queue-6.6/revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch b/queue-6.6/revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch new file mode 100644 index 00000000000..2a383a542f5 --- /dev/null +++ b/queue-6.6/revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch @@ -0,0 +1,119 @@ +From pulehui@huaweicloud.com Sun Nov 10 06:09:10 2024 +From: Pu Lehui +Date: Thu, 31 Oct 2024 06:37:02 +0000 +Subject: Revert "selftests/bpf: Implement get_hw_ring_size function to retrieve current and max interface size" +To: stable@vger.kernel.org, bpf@vger.kernel.org +Cc: Greg Kroah-Hartman , Sasha Levin , Pu Lehui +Message-ID: <20241031063702.3256343-1-pulehui@huaweicloud.com> + +From: Pu Lehui + +This reverts commit c8c590f07ad7ffaa6ef11e90b81202212077497b which is +commit 90a695c3d31e1c9f0adb8c4c80028ed4ea7ed5ab upstream. + +Commit c8c590f07ad7 ("selftests/bpf: Implement get_hw_ring_size function +to retrieve current and max interface size") will cause the following +bpf selftests compilation error in the 6.6 stable branch, and it is not +the Stable-dep-of of commit 103c0431c7fb ("selftests/bpf: Drop unneeded +error.h includes"). So let's revert commit c8c590f07ad7 to fix this +compilation error. + + ./network_helpers.h:66:43: error: 'struct ethtool_ringparam' declared + inside parameter list will not be visible outside of this definition or + declaration [-Werror] + 66 | int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param); + +Signed-off-by: Pu Lehui +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/network_helpers.c | 24 ---------------- + tools/testing/selftests/bpf/network_helpers.h | 4 -- + tools/testing/selftests/bpf/prog_tests/flow_dissector.c | 1 + tools/testing/selftests/bpf/xdp_hw_metadata.c | 14 +++++++++ + 4 files changed, 15 insertions(+), 28 deletions(-) + +--- a/tools/testing/selftests/bpf/network_helpers.c ++++ b/tools/testing/selftests/bpf/network_helpers.c +@@ -465,27 +465,3 @@ int get_socket_local_port(int sock_fd) + + return -1; + } +- +-int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param) +-{ +- struct ifreq ifr = {0}; +- int sockfd, err; +- +- sockfd = socket(AF_INET, SOCK_DGRAM, 0); +- if (sockfd < 0) +- return -errno; +- +- memcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name)); +- +- ring_param->cmd = ETHTOOL_GRINGPARAM; +- ifr.ifr_data = (char *)ring_param; +- +- if (ioctl(sockfd, SIOCETHTOOL, &ifr) < 0) { +- err = errno; +- close(sockfd); +- return -err; +- } +- +- close(sockfd); +- return 0; +-} +--- a/tools/testing/selftests/bpf/network_helpers.h ++++ b/tools/testing/selftests/bpf/network_helpers.h +@@ -9,11 +9,8 @@ typedef __u16 __sum16; + #include + #include + #include +-#include +-#include + #include + #include +-#include + + #define MAGIC_VAL 0x1234 + #define NUM_ITER 100000 +@@ -63,7 +60,6 @@ int make_sockaddr(int family, const char + struct sockaddr_storage *addr, socklen_t *len); + char *ping_command(int family); + int get_socket_local_port(int sock_fd); +-int get_hw_ring_size(char *ifname, struct ethtool_ringparam *ring_param); + + struct nstoken; + /** +--- a/tools/testing/selftests/bpf/prog_tests/flow_dissector.c ++++ b/tools/testing/selftests/bpf/prog_tests/flow_dissector.c +@@ -2,6 +2,7 @@ + #define _GNU_SOURCE + #include + #include ++#include + #include + #include + +--- a/tools/testing/selftests/bpf/xdp_hw_metadata.c ++++ b/tools/testing/selftests/bpf/xdp_hw_metadata.c +@@ -288,6 +288,20 @@ static int verify_metadata(struct xsk *r + return 0; + } + ++struct ethtool_channels { ++ __u32 cmd; ++ __u32 max_rx; ++ __u32 max_tx; ++ __u32 max_other; ++ __u32 max_combined; ++ __u32 rx_count; ++ __u32 tx_count; ++ __u32 other_count; ++ __u32 combined_count; ++}; ++ ++#define ETHTOOL_GCHANNELS 0x0000003c /* Get no of channels */ ++ + static int rxq_num(const char *ifname) + { + struct ethtool_channels ch = { diff --git a/queue-6.6/revert-wifi-mac80211-fix-rcu-list-iterations.patch b/queue-6.6/revert-wifi-mac80211-fix-rcu-list-iterations.patch new file mode 100644 index 00000000000..59dca5d1c7a --- /dev/null +++ b/queue-6.6/revert-wifi-mac80211-fix-rcu-list-iterations.patch @@ -0,0 +1,71 @@ +From b16c79dcfd1f0c92b817e6f39e5880d34581dd63 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sun, 10 Nov 2024 06:02:40 +0100 +Subject: Revert "wifi: mac80211: fix RCU list iterations" + +From: Greg Kroah-Hartman + +This reverts commit f37319609335d3eb2f7edfec4bad7996668a4d29 which is +commit ac35180032fbc5d80b29af00ba4881815ceefcb6 upstream. + +It should not have been backported here due to lack of other rcu +changes in the stable branches. + +Cc: Johannes Berg +Cc: Miriam Rachel Korenblit +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/chan.c | 4 +--- + net/mac80211/mlme.c | 2 +- + net/mac80211/scan.c | 2 +- + net/mac80211/util.c | 4 +--- + 4 files changed, 4 insertions(+), 8 deletions(-) + +--- a/net/mac80211/chan.c ++++ b/net/mac80211/chan.c +@@ -245,9 +245,7 @@ ieee80211_get_max_required_bw(struct iee + enum nl80211_chan_width max_bw = NL80211_CHAN_WIDTH_20_NOHT; + struct sta_info *sta; + +- lockdep_assert_wiphy(sdata->local->hw.wiphy); +- +- list_for_each_entry(sta, &sdata->local->sta_list, list) { ++ list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) { + if (sdata != sta->sdata && + !(sta->sdata->bss && sta->sdata->bss == sdata->bss)) + continue; +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -732,7 +732,7 @@ static bool ieee80211_add_vht_ie(struct + bool disable_mu_mimo = false; + struct ieee80211_sub_if_data *other; + +- list_for_each_entry(other, &local->interfaces, list) { ++ list_for_each_entry_rcu(other, &local->interfaces, list) { + if (other->vif.bss_conf.mu_mimo_owner) { + disable_mu_mimo = true; + break; +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -490,7 +490,7 @@ static void __ieee80211_scan_completed(s + * the scan was in progress; if there was none this will + * just be a no-op for the particular interface. + */ +- list_for_each_entry(sdata, &local->interfaces, list) { ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) { + if (ieee80211_sdata_running(sdata)) + wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work); + } +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -745,9 +745,7 @@ static void __iterate_interfaces(struct + struct ieee80211_sub_if_data *sdata; + bool active_only = iter_flags & IEEE80211_IFACE_ITER_ACTIVE; + +- list_for_each_entry_rcu(sdata, &local->interfaces, list, +- lockdep_is_held(&local->iflist_mtx) || +- lockdep_is_held(&local->hw.wiphy->mtx)) { ++ list_for_each_entry_rcu(sdata, &local->interfaces, list) { + switch (sdata->vif.type) { + case NL80211_IFTYPE_MONITOR: + if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE)) diff --git a/queue-6.6/series b/queue-6.6/series index 34c0eba2006..86f5ea54337 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -96,3 +96,6 @@ arm64-kconfig-make-sme-depend-on-broken-for-now.patch arm64-smccc-remove-broken-support-for-smcccv1.3-sve-discard-hint.patch btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch riscv-purgatory-align-riscv_kernel_entry.patch +revert-wifi-mac80211-fix-rcu-list-iterations.patch +revert-selftests-bpf-implement-get_hw_ring_size-function-to-retrieve-current-and-max-interface-size.patch +media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch