From: Sasha Levin Date: Fri, 23 Sep 2022 16:54:12 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.9.330~96 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5804ee82eaacb4dcc5e06812dc433a320ea0996f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/series b/queue-4.19/series index be14c303e64..93b725913df 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -16,3 +16,9 @@ mips-octeon-irq-fix-octeon_irq_force_ciu_mapping.patch mksysmap-fix-the-mismatch-of-l0-symbols-in-system.ma.patch video-fbdev-pxa3xx-gcu-fix-integer-overflow-in-pxa3x.patch alsa-hda-sigmatel-fix-unused-variable-warning-for-beep-power-change.patch +usb-dwc3-pci-add-support-for-intel-elkhart-lake-devi.patch +usb-dwc3-pci-add-support-for-tigerlake-devices.patch +usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch +usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch +usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch +wifi-mac80211-fix-uaf-in-ieee80211_scan_rx.patch diff --git a/queue-4.19/usb-dwc3-pci-add-support-for-intel-elkhart-lake-devi.patch b/queue-4.19/usb-dwc3-pci-add-support-for-intel-elkhart-lake-devi.patch new file mode 100644 index 00000000000..26c942a007a --- /dev/null +++ b/queue-4.19/usb-dwc3-pci-add-support-for-intel-elkhart-lake-devi.patch @@ -0,0 +1,43 @@ +From 70c102a649ea3cf873765fd674af25a5ed42b736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jun 2018 11:21:12 +0300 +Subject: usb: dwc3: pci: Add Support for Intel Elkhart Lake Devices + +From: Felipe Balbi + +[ Upstream commit dbb0569de852fb4576d6f62078d515f989a181ca ] + +This patch simply adds a new PCI Device ID + +Signed-off-by: Felipe Balbi +Stable-dep-of: bad0d1d726ac ("usb: dwc3: pci: Add support for Intel Raptor Lake") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 527938eee846..5d5166373aa1 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -36,6 +36,7 @@ + #define PCI_DEVICE_ID_INTEL_CNPH 0xa36e + #define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0 + #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee ++#define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -351,6 +352,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ICLLP), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_EHLLP), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.35.1 + diff --git a/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch b/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch new file mode 100644 index 00000000000..d9e43186bf4 --- /dev/null +++ b/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch @@ -0,0 +1,45 @@ +From 57ed46b4442e3b764a80af5ffb97f9c0bbabbf53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Oct 2020 16:02:50 +0300 +Subject: usb: dwc3: pci: add support for the Intel Alder Lake-S + +From: Heikki Krogerus + +[ Upstream commit 1384ab4fee12c4c4f8bd37bc9f8686881587b286 ] + +This patch adds the necessary PCI ID for Intel Alder Lake-S +devices. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Stable-dep-of: bad0d1d726ac ("usb: dwc3: pci: Add support for Intel Raptor Lake") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 125cecb1bc99..ec7063e63436 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -40,6 +40,7 @@ + #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee + #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee + #define PCI_DEVICE_ID_INTEL_JSP 0x4dee ++#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -367,6 +368,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.35.1 + diff --git a/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch b/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch new file mode 100644 index 00000000000..ba48f29202a --- /dev/null +++ b/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch @@ -0,0 +1,45 @@ +From 4e866b29a6ac8e6cd9804ec5e2f5c256dd5f25d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jun 2020 15:24:59 +0300 +Subject: usb: dwc3: pci: add support for the Intel Jasper Lake + +From: Heikki Krogerus + +[ Upstream commit e25d1e8532c3d84f075deca1580a7d61e0f43ce6 ] + +This patch adds the necessary PCI ID for Intel Jasper Lake +devices. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Stable-dep-of: bad0d1d726ac ("usb: dwc3: pci: Add support for Intel Raptor Lake") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index cddf02add6f1..125cecb1bc99 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -39,6 +39,7 @@ + #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e + #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee + #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee ++#define PCI_DEVICE_ID_INTEL_JSP 0x4dee + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -363,6 +364,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.35.1 + diff --git a/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch b/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch new file mode 100644 index 00000000000..8ae519426c7 --- /dev/null +++ b/queue-4.19/usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch @@ -0,0 +1,44 @@ +From 37a5628283d47f59b67c1f0df3111c9702b52e56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 10:34:32 +0300 +Subject: usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant + +From: Heikki Krogerus + +[ Upstream commit c3f595a8119207cc0f82b3dc6ec5bbf6f3e6b135 ] + +This patch adds the necessary PCI ID for TGP-H devices. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Stable-dep-of: bad0d1d726ac ("usb: dwc3: pci: Add support for Intel Raptor Lake") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 3ca582127f94..cddf02add6f1 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -38,6 +38,7 @@ + #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee + #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e + #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee ++#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -359,6 +360,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.35.1 + diff --git a/queue-4.19/usb-dwc3-pci-add-support-for-tigerlake-devices.patch b/queue-4.19/usb-dwc3-pci-add-support-for-tigerlake-devices.patch new file mode 100644 index 00000000000..eea283dac5f --- /dev/null +++ b/queue-4.19/usb-dwc3-pci-add-support-for-tigerlake-devices.patch @@ -0,0 +1,43 @@ +From f94551ced9a6a98e979aeff568a1bc419d2ab201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2017 16:03:22 +0200 +Subject: usb: dwc3: pci: add support for TigerLake Devices + +From: Felipe Balbi + +[ Upstream commit b3649dee5fbb0f6585010e6e9313dfcbb075b22b ] + +This patch adds the necessary PCI ID for TGP-LP devices. + +Signed-off-by: Felipe Balbi +Stable-dep-of: bad0d1d726ac ("usb: dwc3: pci: Add support for Intel Raptor Lake") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 5d5166373aa1..3ca582127f94 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -37,6 +37,7 @@ + #define PCI_DEVICE_ID_INTEL_CNPV 0xa3b0 + #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee + #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e ++#define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -355,6 +356,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_EHLLP), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.35.1 + diff --git a/queue-4.19/wifi-mac80211-fix-uaf-in-ieee80211_scan_rx.patch b/queue-4.19/wifi-mac80211-fix-uaf-in-ieee80211_scan_rx.patch new file mode 100644 index 00000000000..f1923b9de4e --- /dev/null +++ b/queue-4.19/wifi-mac80211-fix-uaf-in-ieee80211_scan_rx.patch @@ -0,0 +1,63 @@ +From b7170b3d857fff07aef30d5243a0fbd699c92c64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Aug 2022 01:33:40 +0530 +Subject: wifi: mac80211: Fix UAF in ieee80211_scan_rx() + +From: Siddh Raman Pant + +[ Upstream commit 60deb9f10eec5c6a20252ed36238b55d8b614a2c ] + +ieee80211_scan_rx() tries to access scan_req->flags after a +null check, but a UAF is observed when the scan is completed +and __ieee80211_scan_completed() executes, which then calls +cfg80211_scan_done() leading to the freeing of scan_req. + +Since scan_req is rcu_dereference()'d, prevent the racing in +__ieee80211_scan_completed() by ensuring that from mac80211's +POV it is no longer accessed from an RCU read critical section +before we call cfg80211_scan_done(). + +Cc: stable@vger.kernel.org +Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d +Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com +Suggested-by: Johannes Berg +Signed-off-by: Siddh Raman Pant +Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/scan.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index de42bcfeda9c..e3d8be4feea5 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -412,10 +412,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) + scan_req = rcu_dereference_protected(local->scan_req, + lockdep_is_held(&local->mtx)); + +- if (scan_req != local->int_scan_req) { +- local->scan_info.aborted = aborted; +- cfg80211_scan_done(scan_req, &local->scan_info); +- } + RCU_INIT_POINTER(local->scan_req, NULL); + + scan_sdata = rcu_dereference_protected(local->scan_sdata, +@@ -425,6 +421,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) + local->scanning = 0; + local->scan_chandef.chan = NULL; + ++ synchronize_rcu(); ++ ++ if (scan_req != local->int_scan_req) { ++ local->scan_info.aborted = aborted; ++ cfg80211_scan_done(scan_req, &local->scan_info); ++ } ++ + /* Set power back to normal operating levels. */ + ieee80211_hw_config(local, 0); + +-- +2.35.1 +