From: Greg Kroah-Hartman Date: Thu, 19 Sep 2019 21:09:29 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.4.194~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f0d0c0824f267ca9e389c6ab0937a02012afd12f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch --- diff --git a/queue-4.19/arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch b/queue-4.19/arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch new file mode 100644 index 00000000000..7cb661999e6 --- /dev/null +++ b/queue-4.19/arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch @@ -0,0 +1,39 @@ +From 2a355ec25729053bb9a1a89b6c1d1cdd6c3b3fb1 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 13 Dec 2018 13:47:38 +0000 +Subject: arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field + +From: Will Deacon + +commit 2a355ec25729053bb9a1a89b6c1d1cdd6c3b3fb1 upstream. + +While the CSV3 field of the ID_AA64_PFR0 CPU ID register can be checked +to see if a CPU is susceptible to Meltdown and therefore requires kpti +to be enabled, existing CPUs do not implement this field. + +We therefore whitelist all unaffected Cortex-A CPUs that do not implement +the CSV3 field. + +Signed-off-by: Will Deacon +Cc: Niklas Cassel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/cpufeature.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -895,6 +895,12 @@ static bool unmap_kernel_at_el0(const st + static const struct midr_range kpti_safe_list[] = { + MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2), + MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A35), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A53), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73), + { /* sentinel */ } + }; + char const *str = "command line option"; diff --git a/queue-4.19/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch b/queue-4.19/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch new file mode 100644 index 00000000000..f31cb033642 --- /dev/null +++ b/queue-4.19/media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch @@ -0,0 +1,72 @@ +From 0c4df39e504bf925ab666132ac3c98d6cbbe380b Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Wed, 3 Jul 2019 10:52:39 -0400 +Subject: media: technisat-usb2: break out of loop at end of buffer + +From: Sean Young + +commit 0c4df39e504bf925ab666132ac3c98d6cbbe380b upstream. + +Ensure we do not access the buffer beyond the end if no 0xff byte +is encountered. + +Reported-by: syzbot+eaaaf38a95427be88f4b@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Reviewed-by: Kees Cook +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/dvb-usb/technisat-usb2.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +--- a/drivers/media/usb/dvb-usb/technisat-usb2.c ++++ b/drivers/media/usb/dvb-usb/technisat-usb2.c +@@ -607,10 +607,9 @@ static int technisat_usb2_frontend_attac + static int technisat_usb2_get_ir(struct dvb_usb_device *d) + { + struct technisat_usb2_state *state = d->priv; +- u8 *buf = state->buf; +- u8 *b; +- int ret; + struct ir_raw_event ev; ++ u8 *buf = state->buf; ++ int i, ret; + + buf[0] = GET_IR_DATA_VENDOR_REQUEST; + buf[1] = 0x08; +@@ -646,26 +645,25 @@ unlock: + return 0; /* no key pressed */ + + /* decoding */ +- b = buf+1; + + #if 0 + deb_rc("RC: %d ", ret); +- debug_dump(b, ret, deb_rc); ++ debug_dump(buf + 1, ret, deb_rc); + #endif + + ev.pulse = 0; +- while (1) { +- ev.pulse = !ev.pulse; +- ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000; +- ir_raw_event_store(d->rc_dev, &ev); +- +- b++; +- if (*b == 0xff) { ++ for (i = 1; i < ARRAY_SIZE(state->buf); i++) { ++ if (buf[i] == 0xff) { + ev.pulse = 0; + ev.duration = 888888*2; + ir_raw_event_store(d->rc_dev, &ev); + break; + } ++ ++ ev.pulse = !ev.pulse; ++ ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR * ++ FIRMWARE_CLOCK_TICK) / 1000; ++ ir_raw_event_store(d->rc_dev, &ev); + } + + ir_raw_event_handle(d->rc_dev); diff --git a/queue-4.19/series b/queue-4.19/series index 67e7563bc58..8df8635a8fd 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -75,3 +75,5 @@ pci-kirin-fix-section-mismatch-warning.patch ovl-fix-regression-caused-by-overlapping-layers-detection.patch floppy-fix-usercopy-direction.patch binfmt_elf-move-brk-out-of-mmap-when-doing-direct-loader-exec.patch +arm64-kpti-whitelist-cortex-a-cpus-that-don-t-implement-the-csv3-field.patch +media-technisat-usb2-break-out-of-loop-at-end-of-buffer.patch