From 213f81654546f21c6f8f5f87f41ee63f756ba4c7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 24 Apr 2023 13:35:19 +0200 Subject: [PATCH] 5.10-stable patches added patches: asn.1-fix-check-for-strdup-success.patch asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch iio-adc-at91-sama5d2_adc-fix-an-error-code-in-at91_adc_allocate_trigger.patch --- .../asn.1-fix-check-for-strdup-success.patch | 40 ++++++++++++++ ...src_dma-fix-potential-null-ptr-deref.patch | 54 +++++++++++++++++++ ...or-code-in-at91_adc_allocate_trigger.patch | 32 +++++++++++ queue-5.10/series | 3 ++ 4 files changed, 129 insertions(+) create mode 100644 queue-5.10/asn.1-fix-check-for-strdup-success.patch create mode 100644 queue-5.10/asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch create mode 100644 queue-5.10/iio-adc-at91-sama5d2_adc-fix-an-error-code-in-at91_adc_allocate_trigger.patch diff --git a/queue-5.10/asn.1-fix-check-for-strdup-success.patch b/queue-5.10/asn.1-fix-check-for-strdup-success.patch new file mode 100644 index 00000000000..5ac31d69e92 --- /dev/null +++ b/queue-5.10/asn.1-fix-check-for-strdup-success.patch @@ -0,0 +1,40 @@ +From 5a43001c01691dcbd396541e6faa2c0077378f48 Mon Sep 17 00:00:00 2001 +From: Ekaterina Orlova +Date: Fri, 21 Apr 2023 15:35:39 +0100 +Subject: ASN.1: Fix check for strdup() success + +From: Ekaterina Orlova + +commit 5a43001c01691dcbd396541e6faa2c0077378f48 upstream. + +It seems there is a misprint in the check of strdup() return code that +can lead to NULL pointer dereference. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4520c6a49af8 ("X.509: Add simple ASN.1 grammar compiler") +Signed-off-by: Ekaterina Orlova +Cc: David Woodhouse +Cc: James Bottomley +Cc: Jarkko Sakkinen +Cc: keyrings@vger.kernel.org +Cc: linux-kbuild@vger.kernel.org +Link: https://lore.kernel.org/r/20230315172130.140-1-vorobushek.ok@gmail.com/ +Signed-off-by: David Howells +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + scripts/asn1_compiler.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/asn1_compiler.c ++++ b/scripts/asn1_compiler.c +@@ -625,7 +625,7 @@ int main(int argc, char **argv) + p = strrchr(argv[1], '/'); + p = p ? p + 1 : argv[1]; + grammar_name = strdup(p); +- if (!p) { ++ if (!grammar_name) { + perror(NULL); + exit(1); + } diff --git a/queue-5.10/asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch b/queue-5.10/asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch new file mode 100644 index 00000000000..ac0d52767c3 --- /dev/null +++ b/queue-5.10/asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch @@ -0,0 +1,54 @@ +From 86a24e99c97234f87d9f70b528a691150e145197 Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Mon, 17 Apr 2023 06:32:42 -0700 +Subject: ASoC: fsl_asrc_dma: fix potential null-ptr-deref + +From: Nikita Zhandarovich + +commit 86a24e99c97234f87d9f70b528a691150e145197 upstream. + +dma_request_slave_channel() may return NULL which will lead to +NULL pointer dereference error in 'tmp_chan->private'. + +Correct this behaviour by, first, switching from deprecated function +dma_request_slave_channel() to dma_request_chan(). Secondly, enable +sanity check for the resuling value of dma_request_chan(). +Also, fix description that follows the enacted changes and that +concerns the use of dma_request_slave_channel(). + +Fixes: 706e2c881158 ("ASoC: fsl_asrc_dma: Reuse the dma channel if available in Back-End") +Co-developed-by: Natalia Petrova +Signed-off-by: Nikita Zhandarovich +Acked-by: Shengjiu Wang +Link: https://lore.kernel.org/r/20230417133242.53339-1-n.zhandarovich@fintech.ru +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/fsl_asrc_dma.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/sound/soc/fsl/fsl_asrc_dma.c ++++ b/sound/soc/fsl/fsl_asrc_dma.c +@@ -207,14 +207,19 @@ static int fsl_asrc_dma_hw_params(struct + be_chan = soc_component_to_pcm(component_be)->chan[substream->stream]; + tmp_chan = be_chan; + } +- if (!tmp_chan) +- tmp_chan = dma_request_slave_channel(dev_be, tx ? "tx" : "rx"); ++ if (!tmp_chan) { ++ tmp_chan = dma_request_chan(dev_be, tx ? "tx" : "rx"); ++ if (IS_ERR(tmp_chan)) { ++ dev_err(dev, "failed to request DMA channel for Back-End\n"); ++ return -EINVAL; ++ } ++ } + + /* + * An EDMA DEV_TO_DEV channel is fixed and bound with DMA event of each + * peripheral, unlike SDMA channel that is allocated dynamically. So no + * need to configure dma_request and dma_request2, but get dma_chan of +- * Back-End device directly via dma_request_slave_channel. ++ * Back-End device directly via dma_request_chan. + */ + if (!asrc->use_edma) { + /* Get DMA request of Back-End */ diff --git a/queue-5.10/iio-adc-at91-sama5d2_adc-fix-an-error-code-in-at91_adc_allocate_trigger.patch b/queue-5.10/iio-adc-at91-sama5d2_adc-fix-an-error-code-in-at91_adc_allocate_trigger.patch new file mode 100644 index 00000000000..76d08877ca6 --- /dev/null +++ b/queue-5.10/iio-adc-at91-sama5d2_adc-fix-an-error-code-in-at91_adc_allocate_trigger.patch @@ -0,0 +1,32 @@ +From 73a428b37b9b538f8f8fe61caa45e7f243bab87c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 29 Mar 2023 07:35:32 +0300 +Subject: iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() + +From: Dan Carpenter + +commit 73a428b37b9b538f8f8fe61caa45e7f243bab87c upstream. + +The at91_adc_allocate_trigger() function is supposed to return error +pointers. Returning a NULL will cause an Oops. + +Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/5d728f9d-31d1-410d-a0b3-df6a63a2c8ba@kili.mountain +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/at91-sama5d2_adc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/at91-sama5d2_adc.c ++++ b/drivers/iio/adc/at91-sama5d2_adc.c +@@ -1002,7 +1002,7 @@ static struct iio_trigger *at91_adc_allo + trig = devm_iio_trigger_alloc(&indio->dev, "%s-dev%d-%s", indio->name, + indio->id, trigger_name); + if (!trig) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + trig->dev.parent = indio->dev.parent; + iio_trigger_set_drvdata(trig, indio); diff --git a/queue-5.10/series b/queue-5.10/series index 66625dd082e..7a4b81ce323 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -63,3 +63,6 @@ sctp-call-inet6_destroy_sock-via-sk-sk_destruct.patch pwm-meson-explicitly-set-.polarity-in-.get_state.patch pwm-iqs620a-explicitly-set-.polarity-in-.get_state.patch pwm-hibvt-explicitly-set-.polarity-in-.get_state.patch +iio-adc-at91-sama5d2_adc-fix-an-error-code-in-at91_adc_allocate_trigger.patch +asoc-fsl_asrc_dma-fix-potential-null-ptr-deref.patch +asn.1-fix-check-for-strdup-success.patch -- 2.47.3