From 25d2d742dda7a02329f811ce76d1b8ccd8b8ced4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 24 May 2025 17:51:02 +0200 Subject: [PATCH] 5.10-stable patches added patches: alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch --- ...-quirk-for-lenovo-yoga-pro-7-14asp10.patch | 32 ++++++++ ...ce-of-buffer-access-at-pcm-oss-layer.patch | 74 +++++++++++++++++++ ...ding-from-a-socket-in-llc_ui_recvmsg.patch | 49 ++++++++++++ queue-5.10/series | 3 + 4 files changed, 158 insertions(+) create mode 100644 queue-5.10/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch create mode 100644 queue-5.10/alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch create mode 100644 queue-5.10/llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch diff --git a/queue-5.10/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch b/queue-5.10/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch new file mode 100644 index 0000000000..5d04d4a9a8 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch @@ -0,0 +1,32 @@ +From 8d70503068510e6080c2c649cccb154f16de26c9 Mon Sep 17 00:00:00 2001 +From: Ed Burcher +Date: Mon, 19 May 2025 23:49:07 +0100 +Subject: ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 + +From: Ed Burcher + +commit 8d70503068510e6080c2c649cccb154f16de26c9 upstream. + +Lenovo Yoga Pro 7 (gen 10) with Realtek ALC3306 and combined CS35L56 +amplifiers need quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN to +enable bass + +Signed-off-by: Ed Burcher +Cc: +Link: https://patch.msgid.link/20250519224907.31265-2-git@edburcher.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9549,6 +9549,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS), + SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), ++ SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), + SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), diff --git a/queue-5.10/alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch b/queue-5.10/alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch new file mode 100644 index 0000000000..76f30907c7 --- /dev/null +++ b/queue-5.10/alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch @@ -0,0 +1,74 @@ +From 93a81ca0657758b607c3f4ba889ae806be9beb73 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 16 May 2025 10:08:16 +0200 +Subject: ALSA: pcm: Fix race of buffer access at PCM OSS layer + +From: Takashi Iwai + +commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. + +The PCM OSS layer tries to clear the buffer with the silence data at +initialization (or reconfiguration) of a stream with the explicit call +of snd_pcm_format_set_silence() with runtime->dma_area. But this may +lead to a UAF because the accessed runtime->dma_area might be freed +concurrently, as it's performed outside the PCM ops. + +For avoiding it, move the code into the PCM core and perform it inside +the buffer access lock, so that it won't be changed during the +operation. + +Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com +Cc: +Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + include/sound/pcm.h | 2 ++ + sound/core/oss/pcm_oss.c | 3 +-- + sound/core/pcm_native.c | 11 +++++++++++ + 3 files changed, 14 insertions(+), 2 deletions(-) + +--- a/include/sound/pcm.h ++++ b/include/sound/pcm.h +@@ -1334,6 +1334,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc + #define snd_pcm_lib_mmap_iomem NULL + #endif + ++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); ++ + /** + * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer + * @dma: DMA number +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1078,8 +1078,7 @@ static int snd_pcm_oss_change_params_loc + runtime->oss.params = 0; + runtime->oss.prepare = 1; + runtime->oss.buffer_used = 0; +- if (runtime->dma_area) +- snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); ++ snd_pcm_runtime_buffer_set_silence(runtime); + + runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -685,6 +685,17 @@ static void snd_pcm_buffer_access_unlock + atomic_inc(&runtime->buffer_accessing); + } + ++/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ ++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) ++{ ++ snd_pcm_buffer_access_lock(runtime); ++ if (runtime->dma_area) ++ snd_pcm_format_set_silence(runtime->format, runtime->dma_area, ++ bytes_to_samples(runtime, runtime->dma_bytes)); ++ snd_pcm_buffer_access_unlock(runtime); ++} ++EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); ++ + #if IS_ENABLED(CONFIG_SND_PCM_OSS) + #define is_oss_stream(substream) ((substream)->oss.oss) + #else diff --git a/queue-5.10/llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch b/queue-5.10/llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch new file mode 100644 index 0000000000..dc581d2030 --- /dev/null +++ b/queue-5.10/llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch @@ -0,0 +1,49 @@ +From 239af1970bcb039a1551d2c438d113df0010c149 Mon Sep 17 00:00:00 2001 +From: Ilia Gavrilov +Date: Thu, 15 May 2025 12:20:15 +0000 +Subject: llc: fix data loss when reading from a socket in llc_ui_recvmsg() + +From: Ilia Gavrilov + +commit 239af1970bcb039a1551d2c438d113df0010c149 upstream. + +For SOCK_STREAM sockets, if user buffer size (len) is less +than skb size (skb->len), the remaining data from skb +will be lost after calling kfree_skb(). + +To fix this, move the statement for partial reading +above skb deletion. + +Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) + +Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes") +Cc: stable@vger.kernel.org +Signed-off-by: Ilia Gavrilov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/af_llc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -887,15 +887,15 @@ static int llc_ui_recvmsg(struct socket + if (sk->sk_type != SOCK_STREAM) + goto copy_uaddr; + ++ /* Partial read */ ++ if (used + offset < skb_len) ++ continue; ++ + if (!(flags & MSG_PEEK)) { + skb_unlink(skb, &sk->sk_receive_queue); + kfree_skb(skb); + *seq = 0; + } +- +- /* Partial read */ +- if (used + offset < skb_len) +- continue; + } while (len > 0); + + out: diff --git a/queue-5.10/series b/queue-5.10/series index f6b7d93730..5b8cf5cf7f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -242,3 +242,6 @@ crypto-algif_hash-fix-double-free-in-hash_accept.patch padata-do-not-leak-refcount-in-reorder_work.patch can-bcm-add-locking-for-bcm_op-runtime-updates.patch can-bcm-add-missing-rcu-read-protection-for-procfs-content.patch +alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch +alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch +llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch -- 2.47.2