From: Greg Kroah-Hartman Date: Mon, 10 Mar 2025 14:56:35 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v5.4.291~43 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a470f80d483fcfee0120d12bb3f2ca92a5ab410f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: md-select-block_legacy_autoload.patch media-uvcvideo-avoid-invalid-memory-access.patch media-uvcvideo-avoid-returning-invalid-controls.patch mtd-rawnand-cadence-fix-unchecked-dereference.patch --- diff --git a/queue-5.15/md-select-block_legacy_autoload.patch b/queue-5.15/md-select-block_legacy_autoload.patch new file mode 100644 index 0000000000..26d8350f74 --- /dev/null +++ b/queue-5.15/md-select-block_legacy_autoload.patch @@ -0,0 +1,39 @@ +From 6c0f5898836c05c6d850a750ed7940ba29e4e6c5 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Mon, 13 Mar 2023 13:29:17 -0700 +Subject: md: select BLOCK_LEGACY_AUTOLOAD + +From: NeilBrown + +commit 6c0f5898836c05c6d850a750ed7940ba29e4e6c5 upstream. + +When BLOCK_LEGACY_AUTOLOAD is not enable, mdadm is not able to +activate new arrays unless "CREATE names=yes" appears in +mdadm.conf + +As this is a regression we need to always enable BLOCK_LEGACY_AUTOLOAD +for when MD is selected - at least until mdadm is updated and the +updates widely available. + +Cc: stable@vger.kernel.org # v5.18+ +Fixes: fbdee71bb5d8 ("block: deprecate autoloading based on dev_t") +Signed-off-by: NeilBrown +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/Kconfig | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/md/Kconfig ++++ b/drivers/md/Kconfig +@@ -16,6 +16,10 @@ if MD + config BLK_DEV_MD + tristate "RAID support" + select BLOCK_HOLDER_DEPRECATED if SYSFS ++ # BLOCK_LEGACY_AUTOLOAD requirement should be removed ++ # after relevant mdadm enhancements - to make "names=yes" ++ # the default - are widely available. ++ select BLOCK_LEGACY_AUTOLOAD + help + This driver lets you combine several hard disk partitions into one + logical block device. This can be used to simply append one diff --git a/queue-5.15/media-uvcvideo-avoid-invalid-memory-access.patch b/queue-5.15/media-uvcvideo-avoid-invalid-memory-access.patch new file mode 100644 index 0000000000..8af8137ff7 --- /dev/null +++ b/queue-5.15/media-uvcvideo-avoid-invalid-memory-access.patch @@ -0,0 +1,38 @@ +From f0577b1b6394f954903fcc67e12fe9e7001dafd6 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 1 Dec 2021 06:22:17 +0100 +Subject: media: uvcvideo: Avoid invalid memory access + +From: Ricardo Ribalda + +commit f0577b1b6394f954903fcc67e12fe9e7001dafd6 upstream. + +If mappings points to an invalid memory, we will be invalid accessing +it. Solve it by initializing the value of the variable mapping and by +changing the order in the conditional statement (to avoid accessing +mapping->id if not needed). + +Fix: +kasan: GPF could be caused by NULL-ptr deref or user memory access +general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI + +Fixes: 6350d6a4ed487 ("media: uvcvideo: Set error_idx during ctrl_commit errors") +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1708,7 +1708,7 @@ static int uvc_ctrl_find_ctrl_idx(struct + struct v4l2_ext_controls *ctrls, + struct uvc_control *uvc_control) + { +- struct uvc_control_mapping *mapping; ++ struct uvc_control_mapping *mapping = NULL; + struct uvc_control *ctrl_found; + unsigned int i; + diff --git a/queue-5.15/media-uvcvideo-avoid-returning-invalid-controls.patch b/queue-5.15/media-uvcvideo-avoid-returning-invalid-controls.patch new file mode 100644 index 0000000000..fab79edb7c --- /dev/null +++ b/queue-5.15/media-uvcvideo-avoid-returning-invalid-controls.patch @@ -0,0 +1,33 @@ +From 414d3b49d9fd4a0bb16a13d929027847fd094f3f Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 1 Dec 2021 06:22:18 +0100 +Subject: media: uvcvideo: Avoid returning invalid controls + +From: Ricardo Ribalda + +commit 414d3b49d9fd4a0bb16a13d929027847fd094f3f upstream. + +If the memory where ctrl_found is placed has the value of uvc_ctrl and +__uvc_find_control does not find the control we will return an invalid +index. + +Fixes: 6350d6a4ed487 ("media: uvcvideo: Set error_idx during ctrl_commit errors") +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1709,7 +1709,7 @@ static int uvc_ctrl_find_ctrl_idx(struct + struct uvc_control *uvc_control) + { + struct uvc_control_mapping *mapping = NULL; +- struct uvc_control *ctrl_found; ++ struct uvc_control *ctrl_found = NULL; + unsigned int i; + + if (!entity) diff --git a/queue-5.15/mtd-rawnand-cadence-fix-unchecked-dereference.patch b/queue-5.15/mtd-rawnand-cadence-fix-unchecked-dereference.patch new file mode 100644 index 0000000000..1460e16899 --- /dev/null +++ b/queue-5.15/mtd-rawnand-cadence-fix-unchecked-dereference.patch @@ -0,0 +1,36 @@ +From 60255f3704fde70ed3c4d62f919aa4b46f841f70 Mon Sep 17 00:00:00 2001 +From: Niravkumar L Rabara +Date: Sun, 16 Feb 2025 11:15:36 +0800 +Subject: mtd: rawnand: cadence: fix unchecked dereference + +From: Niravkumar L Rabara + +commit 60255f3704fde70ed3c4d62f919aa4b46f841f70 upstream. + +Add NULL check before variable dereference to fix static checker warning. + +Fixes: d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for sdma address") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/e448a22c-bada-448d-9167-7af71305130d@stanley.mountain/ +Signed-off-by: Niravkumar L Rabara +Signed-off-by: Miquel Raynal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/cadence-nand-controller.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/raw/cadence-nand-controller.c ++++ b/drivers/mtd/nand/raw/cadence-nand-controller.c +@@ -2934,8 +2934,10 @@ free_buf_desc: + static void cadence_nand_remove(struct cdns_nand_ctrl *cdns_ctrl) + { + cadence_nand_chips_cleanup(cdns_ctrl); +- dma_unmap_resource(cdns_ctrl->dmac->device->dev, cdns_ctrl->io.iova_dma, +- cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0); ++ if (cdns_ctrl->dmac) ++ dma_unmap_resource(cdns_ctrl->dmac->device->dev, ++ cdns_ctrl->io.iova_dma, cdns_ctrl->io.size, ++ DMA_BIDIRECTIONAL, 0); + cadence_nand_irq_cleanup(cdns_ctrl->irq, cdns_ctrl); + kfree(cdns_ctrl->buf); + dma_free_coherent(cdns_ctrl->dev, sizeof(struct cadence_nand_cdma_desc),