From 1738259738282f4d36ed13cb764a12b25985455c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 13 Nov 2021 12:45:38 +0100 Subject: [PATCH] 4.14-stable patches added patches: media-ite-cir-ir-receiver-stop-working-after-receive-overflow.patch mmc-dw_mmc-dont-wait-for-drto-on-write-rsp-error.patch parisc-fix-ptrace-check-on-syscall-return.patch tpm-check-for-integer-overflow-in-tpm2_map_response_body.patch --- ...-stop-working-after-receive-overflow.patch | 36 +++++++++++++++ ...ont-wait-for-drto-on-write-rsp-error.patch | 45 +++++++++++++++++++ ...c-fix-ptrace-check-on-syscall-return.patch | 36 +++++++++++++++ queue-4.14/series | 4 ++ ...r-overflow-in-tpm2_map_response_body.patch | 34 ++++++++++++++ 5 files changed, 155 insertions(+) create mode 100644 queue-4.14/media-ite-cir-ir-receiver-stop-working-after-receive-overflow.patch create mode 100644 queue-4.14/mmc-dw_mmc-dont-wait-for-drto-on-write-rsp-error.patch create mode 100644 queue-4.14/parisc-fix-ptrace-check-on-syscall-return.patch create mode 100644 queue-4.14/tpm-check-for-integer-overflow-in-tpm2_map_response_body.patch diff --git a/queue-4.14/media-ite-cir-ir-receiver-stop-working-after-receive-overflow.patch b/queue-4.14/media-ite-cir-ir-receiver-stop-working-after-receive-overflow.patch new file mode 100644 index 00000000000..1a57be740d3 --- /dev/null +++ b/queue-4.14/media-ite-cir-ir-receiver-stop-working-after-receive-overflow.patch @@ -0,0 +1,36 @@ +From fdc881783099c6343921ff017450831c8766d12a Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Sun, 17 Oct 2021 13:01:15 +0100 +Subject: media: ite-cir: IR receiver stop working after receive overflow + +From: Sean Young + +commit fdc881783099c6343921ff017450831c8766d12a upstream. + +On an Intel NUC6iSYK, no IR is reported after a receive overflow. + +When a receiver overflow occurs, this condition is only cleared by +reading the fifo. Make sure we read anything in the fifo. + +Fixes: 28c7afb07ccf ("media: ite-cir: check for receive overflow") +Suggested-by: Bryan Pass +Tested-by: Bryan Pass +Cc: stable@vger.kernel.org> +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/ite-cir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -292,7 +292,7 @@ static irqreturn_t ite_cir_isr(int irq, + } + + /* check for the receive interrupt */ +- if (iflags & ITE_IRQ_RX_FIFO) { ++ if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { + /* read the FIFO bytes */ + rx_bytes = + dev->params.get_rx_bytes(dev, rx_buf, diff --git a/queue-4.14/mmc-dw_mmc-dont-wait-for-drto-on-write-rsp-error.patch b/queue-4.14/mmc-dw_mmc-dont-wait-for-drto-on-write-rsp-error.patch new file mode 100644 index 00000000000..d83eff53edd --- /dev/null +++ b/queue-4.14/mmc-dw_mmc-dont-wait-for-drto-on-write-rsp-error.patch @@ -0,0 +1,45 @@ +From 43592c8736e84025d7a45e61a46c3fa40536a364 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20L=C3=B6hle?= +Date: Thu, 16 Sep 2021 05:59:19 +0000 +Subject: mmc: dw_mmc: Dont wait for DRTO on Write RSP error + +From: Christian Löhle + +commit 43592c8736e84025d7a45e61a46c3fa40536a364 upstream. + +Only wait for DRTO on reads, otherwise the driver hangs. + +The driver prevents sending CMD12 on response errors like CRCs. According +to the comment this is because some cards have problems with this during +the UHS tuning sequence. Unfortunately this workaround currently also +applies for any command with data. On reads this will set the drto timer, +which then triggers after a while. On writes this will not set any timer +and the tasklet will not be scheduled again. + +I cannot test for the UHS workarounds need, but even if so, it should at +most apply to reads. I have observed many hangs when CMD25 response +contained a CRC error. This patch fixes this without touching the actual +UHS tuning workaround. + +Signed-off-by: Christian Loehle +Reviewed-by: Jaehoon Chung +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/af8f8b8674ba4fcc9a781019e4aeb72c@hyperstone.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/dw_mmc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -2047,7 +2047,8 @@ static void dw_mci_tasklet_func(unsigned + * delayed. Allowing the transfer to take place + * avoids races and keeps things simple. + */ +- if (err != -ETIMEDOUT) { ++ if (err != -ETIMEDOUT && ++ host->dir_status == DW_MCI_RECV_STATUS) { + state = STATE_SENDING_DATA; + continue; + } diff --git a/queue-4.14/parisc-fix-ptrace-check-on-syscall-return.patch b/queue-4.14/parisc-fix-ptrace-check-on-syscall-return.patch new file mode 100644 index 00000000000..5869e33b5fb --- /dev/null +++ b/queue-4.14/parisc-fix-ptrace-check-on-syscall-return.patch @@ -0,0 +1,36 @@ +From 8779e05ba8aaffec1829872ef9774a71f44f6580 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Tue, 5 Oct 2021 00:27:49 +0200 +Subject: parisc: Fix ptrace check on syscall return + +From: Helge Deller + +commit 8779e05ba8aaffec1829872ef9774a71f44f6580 upstream. + +The TIF_XXX flags are stored in the flags field in the thread_info +struct (TI_FLAGS), not in the flags field of the task_struct structure +(TASK_FLAGS). + +It seems this bug didn't generate any important side-effects, otherwise it +wouldn't have went unnoticed for 12 years (since v2.6.32). + +Signed-off-by: Helge Deller +Fixes: ecd3d4bc06e48 ("parisc: stop using task->ptrace for {single,block}step flags") +Cc: Kyle McMartin +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/kernel/entry.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -1849,7 +1849,7 @@ syscall_restore: + LDREG TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 + + /* Are we being ptraced? */ +- ldw TASK_FLAGS(%r1),%r19 ++ LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19 + ldi _TIF_SYSCALL_TRACE_MASK,%r2 + and,COND(=) %r19,%r2,%r0 + b,n syscall_restore_rfi diff --git a/queue-4.14/series b/queue-4.14/series index bb5f9366dec..9952a213968 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -5,3 +5,7 @@ input-elantench-fix-misreporting-trackpoint-coordinates.patch input-i8042-add-quirk-for-fujitsu-lifebook-t725.patch libata-fix-read-log-timeout-value.patch ocfs2-fix-data-corruption-on-truncate.patch +mmc-dw_mmc-dont-wait-for-drto-on-write-rsp-error.patch +parisc-fix-ptrace-check-on-syscall-return.patch +tpm-check-for-integer-overflow-in-tpm2_map_response_body.patch +media-ite-cir-ir-receiver-stop-working-after-receive-overflow.patch diff --git a/queue-4.14/tpm-check-for-integer-overflow-in-tpm2_map_response_body.patch b/queue-4.14/tpm-check-for-integer-overflow-in-tpm2_map_response_body.patch new file mode 100644 index 00000000000..d6f563a2fa5 --- /dev/null +++ b/queue-4.14/tpm-check-for-integer-overflow-in-tpm2_map_response_body.patch @@ -0,0 +1,34 @@ +From a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 8 Sep 2021 08:33:57 +0300 +Subject: tpm: Check for integer overflow in tpm2_map_response_body() + +From: Dan Carpenter + +commit a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 upstream. + +The "4 * be32_to_cpu(data->count)" multiplication can potentially +overflow which would lead to memory corruption. Add a check for that. + +Cc: stable@vger.kernel.org +Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces") +Signed-off-by: Dan Carpenter +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm2-space.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -422,6 +422,9 @@ static int tpm2_map_response_body(struct + if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES) + return 0; + ++ if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4) ++ return -EFAULT; ++ + if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count)) + return -EFAULT; + -- 2.47.2