From: Greg Kroah-Hartman Date: Mon, 13 Jan 2020 20:23:59 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.210~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=54995b73c72be0cd2a2a2f13504a01be9d9e069e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch hid-hid-input-clear-unmapped-usages.patch hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch input-add-safety-guards-to-input_set_keycode.patch kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch --- diff --git a/queue-4.4/drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch b/queue-4.4/drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch new file mode 100644 index 00000000000..555c6f7f2e8 --- /dev/null +++ b/queue-4.4/drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch @@ -0,0 +1,52 @@ +From c4e4fccc5d52d881afaac11d3353265ef4eccb8b Mon Sep 17 00:00:00 2001 +From: Wayne Lin +Date: Fri, 3 Jan 2020 13:50:01 +0800 +Subject: drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ + +From: Wayne Lin + +commit c4e4fccc5d52d881afaac11d3353265ef4eccb8b upstream. + +[Why] +According to DP spec, it should shift left 4 digits for NO_STOP_BIT +in REMOTE_I2C_READ message. Not 5 digits. + +In current code, NO_STOP_BIT is always set to zero which means I2C +master is always generating a I2C stop at the end of each I2C write +transaction while handling REMOTE_I2C_READ sideband message. This issue +might have the generated I2C signal not meeting the requirement. Take +random read in I2C for instance, I2C master should generate a repeat +start to start to read data after writing the read address. This issue +will cause the I2C master to generate a stop-start rather than a +re-start which is not expected in I2C random read. + +[How] +Correct the shifting value of NO_STOP_BIT for DP_REMOTE_I2C_READ case in +drm_dp_encode_sideband_req(). + +Changes since v1:(https://patchwork.kernel.org/patch/11312667/) +* Add more descriptions in commit and cc to stable + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Reviewed-by: Harry Wentland +Signed-off-by: Wayne Lin +Cc: stable@vger.kernel.org +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20200103055001.10287-1-Wayne.Lin@amd.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -272,7 +272,7 @@ static void drm_dp_encode_sideband_req(s + memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); + idx += req->u.i2c_read.transactions[i].num_bytes; + +- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; ++ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; + buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); + idx++; + } diff --git a/queue-4.4/hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch b/queue-4.4/hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch new file mode 100644 index 00000000000..fdb56830722 --- /dev/null +++ b/queue-4.4/hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch @@ -0,0 +1,52 @@ +From 8ec321e96e056de84022c032ffea253431a83c3c Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 10 Dec 2019 16:26:11 -0500 +Subject: HID: Fix slab-out-of-bounds read in hid_field_extract + +From: Alan Stern + +commit 8ec321e96e056de84022c032ffea253431a83c3c upstream. + +The syzbot fuzzer found a slab-out-of-bounds bug in the HID report +handler. The bug was caused by a report descriptor which included a +field with size 12 bits and count 4899, for a total size of 7349 +bytes. + +The usbhid driver uses at most a single-page 4-KB buffer for reports. +In the test there wasn't any problem about overflowing the buffer, +since only one byte was received from the device. Rather, the bug +occurred when the HID core tried to extract the data from the report +fields, which caused it to try reading data beyond the end of the +allocated buffer. + +This patch fixes the problem by rejecting any report whose total +length exceeds the HID_MAX_BUFFER_SIZE limit (minus one byte to allow +for a possible report index). In theory a device could have a report +longer than that, but if there was such a thing we wouldn't handle it +correctly anyway. + +Reported-and-tested-by: syzbot+09ef48aa58261464b621@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -269,6 +269,12 @@ static int hid_add_field(struct hid_pars + offset = report->size; + report->size += parser->global.report_size * parser->global.report_count; + ++ /* Total size check: Allow for possible report index byte */ ++ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { ++ hid_err(parser->device, "report is too long\n"); ++ return -1; ++ } ++ + if (!parser->local.usage_index) /* Ignore padding fields */ + return 0; + diff --git a/queue-4.4/hid-hid-input-clear-unmapped-usages.patch b/queue-4.4/hid-hid-input-clear-unmapped-usages.patch new file mode 100644 index 00000000000..c73b902e8d0 --- /dev/null +++ b/queue-4.4/hid-hid-input-clear-unmapped-usages.patch @@ -0,0 +1,73 @@ +From 4f3882177240a1f55e45a3d241d3121341bead78 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Sat, 7 Dec 2019 13:05:18 -0800 +Subject: HID: hid-input: clear unmapped usages + +From: Dmitry Torokhov + +commit 4f3882177240a1f55e45a3d241d3121341bead78 upstream. + +We should not be leaving half-mapped usages with potentially invalid +keycodes, as that may confuse hidinput_find_key() when the key is located +by index, which may end up feeding way too large keycode into the VT +keyboard handler and cause OOB write there: + +BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] +BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] +BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 +Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 +... + kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] + kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 + input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 + input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 + input_pass_values drivers/input/input.c:949 [inline] + input_set_keycode+0x290/0x320 drivers/input/input.c:954 + evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 + evdev_do_ioctl drivers/input/evdev.c:1150 [inline] + +Cc: stable@vger.kernel.org +Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com +Signed-off-by: Dmitry Torokhov +Tested-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-input.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -994,9 +994,15 @@ static void hidinput_configure_usage(str + } + + mapped: +- if (device->driver->input_mapped && device->driver->input_mapped(device, +- hidinput, field, usage, &bit, &max) < 0) +- goto ignore; ++ if (device->driver->input_mapped && ++ device->driver->input_mapped(device, hidinput, field, usage, ++ &bit, &max) < 0) { ++ /* ++ * The driver indicated that no further generic handling ++ * of the usage is desired. ++ */ ++ return; ++ } + + set_bit(usage->type, input->evbit); + +@@ -1055,9 +1061,11 @@ mapped: + set_bit(MSC_SCAN, input->mscbit); + } + +-ignore: + return; + ++ignore: ++ usage->type = 0; ++ usage->code = 0; + } + + void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) diff --git a/queue-4.4/hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch b/queue-4.4/hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch new file mode 100644 index 00000000000..584501ef606 --- /dev/null +++ b/queue-4.4/hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch @@ -0,0 +1,41 @@ +From be54e7461ffdc5809b67d2aeefc1ddc9a91470c7 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Wed, 4 Dec 2019 03:43:55 +0100 +Subject: HID: uhid: Fix returning EPOLLOUT from uhid_char_poll + +From: Marcel Holtmann + +commit be54e7461ffdc5809b67d2aeefc1ddc9a91470c7 upstream. + +Always return EPOLLOUT from uhid_char_poll to allow polling /dev/uhid +for writable state. + +Fixes: 1f9dec1e0164 ("HID: uhid: allow poll()'ing on uhid devices") +Signed-off-by: Marcel Holtmann +Cc: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/uhid.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #define UHID_NAME "uhid" + #define UHID_BUFSIZE 32 +@@ -774,7 +775,7 @@ static unsigned int uhid_char_poll(struc + if (uhid->head != uhid->tail) + return POLLIN | POLLRDNORM; + +- return 0; ++ return EPOLLOUT | EPOLLWRNORM; + } + + static const struct file_operations uhid_fops = { diff --git a/queue-4.4/input-add-safety-guards-to-input_set_keycode.patch b/queue-4.4/input-add-safety-guards-to-input_set_keycode.patch new file mode 100644 index 00000000000..0571e1ee4cd --- /dev/null +++ b/queue-4.4/input-add-safety-guards-to-input_set_keycode.patch @@ -0,0 +1,69 @@ +From cb222aed03d798fc074be55e59d9a112338ee784 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 13 Dec 2019 14:56:16 -0800 +Subject: Input: add safety guards to input_set_keycode() + +From: Dmitry Torokhov + +commit cb222aed03d798fc074be55e59d9a112338ee784 upstream. + +If we happen to have a garbage in input device's keycode table with values +too big we'll end up doing clear_bit() with offset way outside of our +bitmaps, damaging other objects within an input device or even outside of +it. Let's add sanity checks to the returned old keycodes. + +Reported-by: syzbot+c769968809f9359b07aa@syzkaller.appspotmail.com +Reported-by: syzbot+76f3a30e88d256644c78@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20191207212757.GA245964@dtor-ws +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/input.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -851,16 +851,18 @@ static int input_default_setkeycode(stru + } + } + +- __clear_bit(*old_keycode, dev->keybit); +- __set_bit(ke->keycode, dev->keybit); +- +- for (i = 0; i < dev->keycodemax; i++) { +- if (input_fetch_keycode(dev, i) == *old_keycode) { +- __set_bit(*old_keycode, dev->keybit); +- break; /* Setting the bit twice is useless, so break */ ++ if (*old_keycode <= KEY_MAX) { ++ __clear_bit(*old_keycode, dev->keybit); ++ for (i = 0; i < dev->keycodemax; i++) { ++ if (input_fetch_keycode(dev, i) == *old_keycode) { ++ __set_bit(*old_keycode, dev->keybit); ++ /* Setting the bit twice is useless, so break */ ++ break; ++ } + } + } + ++ __set_bit(ke->keycode, dev->keybit); + return 0; + } + +@@ -916,9 +918,13 @@ int input_set_keycode(struct input_dev * + * Simulate keyup event if keycode is not present + * in the keymap anymore + */ +- if (test_bit(EV_KEY, dev->evbit) && +- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && +- __test_and_clear_bit(old_keycode, dev->key)) { ++ if (old_keycode > KEY_MAX) { ++ dev_warn(dev->dev.parent ?: &dev->dev, ++ "%s: got too big old keycode %#x\n", ++ __func__, old_keycode); ++ } else if (test_bit(EV_KEY, dev->evbit) && ++ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && ++ __test_and_clear_bit(old_keycode, dev->key)) { + struct input_value vals[] = { + { EV_KEY, old_keycode, 0 }, + input_value_sync diff --git a/queue-4.4/kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch b/queue-4.4/kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch new file mode 100644 index 00000000000..d30a427062f --- /dev/null +++ b/queue-4.4/kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch @@ -0,0 +1,45 @@ +From 50f9ad607ea891a9308e67b81f774c71736d1098 Mon Sep 17 00:00:00 2001 +From: Kaitao Cheng +Date: Tue, 31 Dec 2019 05:35:30 -0800 +Subject: kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail + +From: Kaitao Cheng + +commit 50f9ad607ea891a9308e67b81f774c71736d1098 upstream. + +In the function, if register_trace_sched_migrate_task() returns error, +sched_switch/sched_wakeup_new/sched_wakeup won't unregister. That is +why fail_deprobe_sched_switch was added. + +Link: http://lkml.kernel.org/r/20191231133530.2794-1-pilgrimtao@gmail.com + +Cc: stable@vger.kernel.org +Fixes: 478142c39c8c2 ("tracing: do not grab lock in wakeup latency function tracing") +Signed-off-by: Kaitao Cheng +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_sched_wakeup.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_sched_wakeup.c ++++ b/kernel/trace/trace_sched_wakeup.c +@@ -625,7 +625,7 @@ static void start_wakeup_tracer(struct t + if (ret) { + pr_info("wakeup trace: Couldn't activate tracepoint" + " probe to kernel_sched_migrate_task\n"); +- return; ++ goto fail_deprobe_sched_switch; + } + + wakeup_reset(tr); +@@ -643,6 +643,8 @@ static void start_wakeup_tracer(struct t + printk(KERN_ERR "failed to start wakeup tracer\n"); + + return; ++fail_deprobe_sched_switch: ++ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); + fail_deprobe_wake_new: + unregister_trace_sched_wakeup_new(probe_wakeup, NULL); + fail_deprobe: diff --git a/queue-4.4/series b/queue-4.4/series index 7c1c63fb510..4aad3db1ffd 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -2,3 +2,10 @@ kobject-export-kobject_get_unless_zero.patch chardev-avoid-potential-use-after-free-in-chrdev_open.patch usb-chipidea-host-disable-port-power-only-if-previously-enabled.patch alsa-usb-audio-apply-the-sample-rate-quirk-for-bose-companion-5.patch +kernel-trace-fix-do-not-unregister-tracepoints-when-register-sched_migrate_task-fail.patch +tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch +hid-fix-slab-out-of-bounds-read-in-hid_field_extract.patch +hid-uhid-fix-returning-epollout-from-uhid_char_poll.patch +hid-hid-input-clear-unmapped-usages.patch +input-add-safety-guards-to-input_set_keycode.patch +drm-dp_mst-correct-the-shifting-in-dp_remote_i2c_read.patch diff --git a/queue-4.4/tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch b/queue-4.4/tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch new file mode 100644 index 00000000000..a994283237c --- /dev/null +++ b/queue-4.4/tracing-have-stack-tracer-compile-when-mcount_insn_size-is-not-defined.patch @@ -0,0 +1,39 @@ +From b8299d362d0837ae39e87e9019ebe6b736e0f035 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (VMware)" +Date: Thu, 2 Jan 2020 22:02:41 -0500 +Subject: tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined + +From: Steven Rostedt (VMware) + +commit b8299d362d0837ae39e87e9019ebe6b736e0f035 upstream. + +On some archs with some configurations, MCOUNT_INSN_SIZE is not defined, and +this makes the stack tracer fail to compile. Just define it to zero in this +case. + +Link: https://lore.kernel.org/r/202001020219.zvE3vsty%lkp@intel.com + +Cc: stable@vger.kernel.org +Fixes: 4df297129f622 ("tracing: Remove most or all of stack tracer stack size from stack_max_size") +Reported-by: kbuild test robot +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_stack.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -197,6 +197,11 @@ check_stack(unsigned long ip, unsigned l + local_irq_restore(flags); + } + ++/* Some archs may not define MCOUNT_INSN_SIZE */ ++#ifndef MCOUNT_INSN_SIZE ++# define MCOUNT_INSN_SIZE 0 ++#endif ++ + static void + stack_trace_call(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op, struct pt_regs *pt_regs)