From: Greg Kroah-Hartman Date: Mon, 18 Apr 2022 09:24:52 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.9.311~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b85fc30b628547727422d1b42e3ff6983e1b88c9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-hda-realtek-add-quirk-for-clevo-pd50pnt.patch alsa-pcm-test-for-silence-field-in-struct-pcm_format_data.patch arm-davinci-da850-evm-avoid-null-pointer-dereference.patch ipv6-fix-panic-when-forwarding-a-pkt-with-no-in6-dev.patch --- diff --git a/queue-4.19/alsa-hda-realtek-add-quirk-for-clevo-pd50pnt.patch b/queue-4.19/alsa-hda-realtek-add-quirk-for-clevo-pd50pnt.patch new file mode 100644 index 00000000000..e55a5efad0a --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-add-quirk-for-clevo-pd50pnt.patch @@ -0,0 +1,30 @@ +From 9eb6f5c388060d8cef3c8b616cc31b765e022359 Mon Sep 17 00:00:00 2001 +From: Tim Crawford +Date: Tue, 5 Apr 2022 12:20:29 -0600 +Subject: ALSA: hda/realtek: Add quirk for Clevo PD50PNT + +From: Tim Crawford + +commit 9eb6f5c388060d8cef3c8b616cc31b765e022359 upstream. + +Fixes speaker output and headset detection on Clevo PD50PNT. + +Signed-off-by: Tim Crawford +Cc: +Link: https://lore.kernel.org/r/20220405182029.27431-1-tcrawford@system76.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2552,6 +2552,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), diff --git a/queue-4.19/alsa-pcm-test-for-silence-field-in-struct-pcm_format_data.patch b/queue-4.19/alsa-pcm-test-for-silence-field-in-struct-pcm_format_data.patch new file mode 100644 index 00000000000..f7b831847b4 --- /dev/null +++ b/queue-4.19/alsa-pcm-test-for-silence-field-in-struct-pcm_format_data.patch @@ -0,0 +1,40 @@ +From 2f7a26abb8241a0208c68d22815aa247c5ddacab Mon Sep 17 00:00:00 2001 +From: "Fabio M. De Francesco" +Date: Sat, 9 Apr 2022 03:26:55 +0200 +Subject: ALSA: pcm: Test for "silence" field in struct "pcm_format_data" + +From: Fabio M. De Francesco + +commit 2f7a26abb8241a0208c68d22815aa247c5ddacab upstream. + +Syzbot reports "KASAN: null-ptr-deref Write in +snd_pcm_format_set_silence".[1] + +It is due to missing validation of the "silence" field of struct +"pcm_format_data" in "pcm_formats" array. + +Add a test for valid "pat" and, if it is not so, return -EINVAL. + +[1] https://lore.kernel.org/lkml/000000000000d188ef05dc2c7279@google.com/ + +Reported-and-tested-by: syzbot+205eb15961852c2c5974@syzkaller.appspotmail.com +Signed-off-by: Fabio M. De Francesco +Cc: +Link: https://lore.kernel.org/r/20220409012655.9399-1-fmdefrancesco@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/pcm_misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/pcm_misc.c ++++ b/sound/core/pcm_misc.c +@@ -423,7 +423,7 @@ int snd_pcm_format_set_silence(snd_pcm_f + return 0; + width = pcm_formats[(INT)format].phys; /* physical width */ + pat = pcm_formats[(INT)format].silence; +- if (! width) ++ if (!width || !pat) + return -EINVAL; + /* signed or 1 byte data */ + if (pcm_formats[(INT)format].signd == 1 || width <= 8) { diff --git a/queue-4.19/arm-davinci-da850-evm-avoid-null-pointer-dereference.patch b/queue-4.19/arm-davinci-da850-evm-avoid-null-pointer-dereference.patch new file mode 100644 index 00000000000..6ce7a95f966 --- /dev/null +++ b/queue-4.19/arm-davinci-da850-evm-avoid-null-pointer-dereference.patch @@ -0,0 +1,58 @@ +From 83a1cde5c74bfb44b49cb2a940d044bb2380f4ea Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 23 Dec 2021 15:21:41 -0700 +Subject: ARM: davinci: da850-evm: Avoid NULL pointer dereference + +From: Nathan Chancellor + +commit 83a1cde5c74bfb44b49cb2a940d044bb2380f4ea upstream. + +With newer versions of GCC, there is a panic in da850_evm_config_emac() +when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine: + +Unable to handle kernel NULL pointer dereference at virtual address 00000020 +pgd = (ptrval) +[00000020] *pgd=00000000 +Internal error: Oops: 5 [#1] PREEMPT ARM +Modules linked in: +CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 +Hardware name: Generic DT based system +PC is at da850_evm_config_emac+0x1c/0x120 +LR is at do_one_initcall+0x50/0x1e0 + +The emac_pdata pointer in soc_info is NULL because davinci_soc_info only +gets populated on davinci machines but da850_evm_config_emac() is called +on all machines via device_initcall(). + +Move the rmii_en assignment below the machine check so that it is only +dereferenced when running on a supported SoC. + +Fixes: bae105879f2f ("davinci: DA850/OMAP-L138 EVM: implement autodetect of RMII PHY") +Signed-off-by: Nathan Chancellor +Reviewed-by: Arnd Bergmann +Reviewed-by: Bartosz Golaszewski +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/YcS4xVWs6bQlQSPC@archlinux-ax161/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-davinci/board-da850-evm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/arm/mach-davinci/board-da850-evm.c ++++ b/arch/arm/mach-davinci/board-da850-evm.c +@@ -1045,11 +1045,13 @@ static int __init da850_evm_config_emac( + int ret; + u32 val; + struct davinci_soc_info *soc_info = &davinci_soc_info; +- u8 rmii_en = soc_info->emac_pdata->rmii_en; ++ u8 rmii_en; + + if (!machine_is_davinci_da850_evm()) + return 0; + ++ rmii_en = soc_info->emac_pdata->rmii_en; ++ + cfg_chip3_base = DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP3_REG); + + val = __raw_readl(cfg_chip3_base); diff --git a/queue-4.19/ipv6-fix-panic-when-forwarding-a-pkt-with-no-in6-dev.patch b/queue-4.19/ipv6-fix-panic-when-forwarding-a-pkt-with-no-in6-dev.patch new file mode 100644 index 00000000000..2f50f3156ec --- /dev/null +++ b/queue-4.19/ipv6-fix-panic-when-forwarding-a-pkt-with-no-in6-dev.patch @@ -0,0 +1,38 @@ +From e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0 Mon Sep 17 00:00:00 2001 +From: Nicolas Dichtel +Date: Fri, 8 Apr 2022 16:03:42 +0200 +Subject: ipv6: fix panic when forwarding a pkt with no in6 dev + +From: Nicolas Dichtel + +commit e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0 upstream. + +kongweibin reported a kernel panic in ip6_forward() when input interface +has no in6 dev associated. + +The following tc commands were used to reproduce this panic: +tc qdisc del dev vxlan100 root +tc qdisc add dev vxlan100 root netem corrupt 5% + +CC: stable@vger.kernel.org +Fixes: ccd27f05ae7b ("ipv6: fix 'disable_policy' for fwd packets") +Reported-by: kongweibin +Signed-off-by: Nicolas Dichtel +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -460,7 +460,7 @@ int ip6_forward(struct sk_buff *skb) + goto drop; + + if (!net->ipv6.devconf_all->disable_policy && +- !idev->cnf.disable_policy && ++ (!idev || !idev->cnf.disable_policy) && + !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) { + __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS); + goto drop; diff --git a/queue-4.19/series b/queue-4.19/series index f7eb361ebac..1a89419f7e8 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -24,3 +24,7 @@ mm-page_alloc-fix-build_zonerefs_node.patch mm-kmemleak-take-a-full-lowmem-check-in-kmemleak_-_phys.patch kvm-don-t-create-vm-debugfs-files-outside-of-the-vm-directory.patch gcc-plugins-latent_entropy-use-dev-urandom.patch +alsa-hda-realtek-add-quirk-for-clevo-pd50pnt.patch +alsa-pcm-test-for-silence-field-in-struct-pcm_format_data.patch +ipv6-fix-panic-when-forwarding-a-pkt-with-no-in6-dev.patch +arm-davinci-da850-evm-avoid-null-pointer-dereference.patch