From 77528f9623ba7627ba5545b88ebb54109ed40ae4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 12 Nov 2024 09:38:41 +0100 Subject: [PATCH] 6.1-stable patches added patches: asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch --- ...ernal-mic-on-xiaomi-book-pro-14-2022.patch | 48 ++++++ ...side-critical-section-in-taprio_dump.patch | 152 ++++++++++++++++++ queue-6.1/series | 2 + 3 files changed, 202 insertions(+) create mode 100644 queue-6.1/asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch create mode 100644 queue-6.1/net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch diff --git a/queue-6.1/asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch b/queue-6.1/asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch new file mode 100644 index 00000000000..2fb0d52bc56 --- /dev/null +++ b/queue-6.1/asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch @@ -0,0 +1,48 @@ +From de156f3cf70e17dc6ff4c3c364bb97a6db961ffd Mon Sep 17 00:00:00 2001 +From: Mingcong Bai +Date: Wed, 6 Nov 2024 10:40:50 +0800 +Subject: ASoC: amd: yc: fix internal mic on Xiaomi Book Pro 14 2022 + +From: Mingcong Bai + +commit de156f3cf70e17dc6ff4c3c364bb97a6db961ffd upstream. + +Xiaomi Book Pro 14 2022 (MIA2210-AD) requires a quirk entry for its +internal microphone to be enabled. + +This is likely due to similar reasons as seen previously on Redmi Book +14/15 Pro 2022 models (since they likely came with similar firmware): + +- commit dcff8b7ca92d ("ASoC: amd: yc: Add Xiaomi Redmi Book Pro 15 2022 + into DMI table") +- commit c1dd6bf61997 ("ASoC: amd: yc: Add Xiaomi Redmi Book Pro 14 2022 + into DMI table") + +A quirk would likely be needed for Xiaomi Book Pro 15 2022 models, too. +However, I do not have such device on hand so I will leave it for now. + +Signed-off-by: Mingcong Bai +Link: https://patch.msgid.link/20241106024052.15748-1-jeffbai@aosc.io +Signed-off-by: Mark Brown +Signed-off-by: WangYuli +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -342,6 +342,13 @@ static const struct dmi_system_id yc_acp + { + .driver_data = &acp6x_card, + .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "TIMI"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Xiaomi Book Pro 14 2022"), ++ } ++ }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."), + DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 15 C7VF"), + } diff --git a/queue-6.1/net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch b/queue-6.1/net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch new file mode 100644 index 00000000000..f1e1f73ab81 --- /dev/null +++ b/queue-6.1/net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch @@ -0,0 +1,152 @@ +From b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 Mon Sep 17 00:00:00 2001 +From: Dmitry Antipov +Date: Fri, 18 Oct 2024 08:13:39 +0300 +Subject: net: sched: use RCU read-side critical section in taprio_dump() + +From: Dmitry Antipov + +commit b22db8b8befe90b61c98626ca1a2fbb0505e9fe3 upstream. + +Fix possible use-after-free in 'taprio_dump()' by adding RCU +read-side critical section there. Never seen on x86 but +found on a KASAN-enabled arm64 system when investigating +https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa: + +[T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0 +[T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862 +[T15862] +[T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2 +[T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024 +[T15862] Call trace: +[T15862] dump_backtrace+0x20c/0x220 +[T15862] show_stack+0x2c/0x40 +[T15862] dump_stack_lvl+0xf8/0x174 +[T15862] print_report+0x170/0x4d8 +[T15862] kasan_report+0xb8/0x1d4 +[T15862] __asan_report_load4_noabort+0x20/0x2c +[T15862] taprio_dump+0xa0c/0xbb0 +[T15862] tc_fill_qdisc+0x540/0x1020 +[T15862] qdisc_notify.isra.0+0x330/0x3a0 +[T15862] tc_modify_qdisc+0x7b8/0x1838 +[T15862] rtnetlink_rcv_msg+0x3c8/0xc20 +[T15862] netlink_rcv_skb+0x1f8/0x3d4 +[T15862] rtnetlink_rcv+0x28/0x40 +[T15862] netlink_unicast+0x51c/0x790 +[T15862] netlink_sendmsg+0x79c/0xc20 +[T15862] __sock_sendmsg+0xe0/0x1a0 +[T15862] ____sys_sendmsg+0x6c0/0x840 +[T15862] ___sys_sendmsg+0x1ac/0x1f0 +[T15862] __sys_sendmsg+0x110/0x1d0 +[T15862] __arm64_sys_sendmsg+0x74/0xb0 +[T15862] invoke_syscall+0x88/0x2e0 +[T15862] el0_svc_common.constprop.0+0xe4/0x2a0 +[T15862] do_el0_svc+0x44/0x60 +[T15862] el0_svc+0x50/0x184 +[T15862] el0t_64_sync_handler+0x120/0x12c +[T15862] el0t_64_sync+0x190/0x194 +[T15862] +[T15862] Allocated by task 15857: +[T15862] kasan_save_stack+0x3c/0x70 +[T15862] kasan_save_track+0x20/0x3c +[T15862] kasan_save_alloc_info+0x40/0x60 +[T15862] __kasan_kmalloc+0xd4/0xe0 +[T15862] __kmalloc_cache_noprof+0x194/0x334 +[T15862] taprio_change+0x45c/0x2fe0 +[T15862] tc_modify_qdisc+0x6a8/0x1838 +[T15862] rtnetlink_rcv_msg+0x3c8/0xc20 +[T15862] netlink_rcv_skb+0x1f8/0x3d4 +[T15862] rtnetlink_rcv+0x28/0x40 +[T15862] netlink_unicast+0x51c/0x790 +[T15862] netlink_sendmsg+0x79c/0xc20 +[T15862] __sock_sendmsg+0xe0/0x1a0 +[T15862] ____sys_sendmsg+0x6c0/0x840 +[T15862] ___sys_sendmsg+0x1ac/0x1f0 +[T15862] __sys_sendmsg+0x110/0x1d0 +[T15862] __arm64_sys_sendmsg+0x74/0xb0 +[T15862] invoke_syscall+0x88/0x2e0 +[T15862] el0_svc_common.constprop.0+0xe4/0x2a0 +[T15862] do_el0_svc+0x44/0x60 +[T15862] el0_svc+0x50/0x184 +[T15862] el0t_64_sync_handler+0x120/0x12c +[T15862] el0t_64_sync+0x190/0x194 +[T15862] +[T15862] Freed by task 6192: +[T15862] kasan_save_stack+0x3c/0x70 +[T15862] kasan_save_track+0x20/0x3c +[T15862] kasan_save_free_info+0x4c/0x80 +[T15862] poison_slab_object+0x110/0x160 +[T15862] __kasan_slab_free+0x3c/0x74 +[T15862] kfree+0x134/0x3c0 +[T15862] taprio_free_sched_cb+0x18c/0x220 +[T15862] rcu_core+0x920/0x1b7c +[T15862] rcu_core_si+0x10/0x1c +[T15862] handle_softirqs+0x2e8/0xd64 +[T15862] __do_softirq+0x14/0x20 + +Fixes: 18cdd2f0998a ("net/sched: taprio: taprio_dump and taprio_change are protected by rtnl_mutex") +Acked-by: Vinicius Costa Gomes +Signed-off-by: Dmitry Antipov +Link: https://patch.msgid.link/20241018051339.418890-2-dmantipov@yandex.ru +Signed-off-by: Paolo Abeni +[Lee: Backported from linux-6.6.y to linux-6.1.y and fixed conflicts] +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_taprio.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1995,9 +1995,6 @@ static int taprio_dump(struct Qdisc *sch + struct nlattr *nest, *sched_nest; + unsigned int i; + +- oper = rtnl_dereference(q->oper_sched); +- admin = rtnl_dereference(q->admin_sched); +- + opt.num_tc = netdev_get_num_tc(dev); + memcpy(opt.prio_tc_map, dev->prio_tc_map, sizeof(opt.prio_tc_map)); + +@@ -2024,18 +2021,23 @@ static int taprio_dump(struct Qdisc *sch + nla_put_u32(skb, TCA_TAPRIO_ATTR_TXTIME_DELAY, q->txtime_delay)) + goto options_error; + ++ rcu_read_lock(); ++ ++ oper = rtnl_dereference(q->oper_sched); ++ admin = rtnl_dereference(q->admin_sched); ++ + if (taprio_dump_tc_entries(q, skb)) +- goto options_error; ++ goto options_error_rcu; + + if (oper && dump_schedule(skb, oper)) +- goto options_error; ++ goto options_error_rcu; + + if (!admin) + goto done; + + sched_nest = nla_nest_start_noflag(skb, TCA_TAPRIO_ATTR_ADMIN_SCHED); + if (!sched_nest) +- goto options_error; ++ goto options_error_rcu; + + if (dump_schedule(skb, admin)) + goto admin_error; +@@ -2043,11 +2045,15 @@ static int taprio_dump(struct Qdisc *sch + nla_nest_end(skb, sched_nest); + + done: ++ rcu_read_unlock(); + return nla_nest_end(skb, nest); + + admin_error: + nla_nest_cancel(skb, sched_nest); + ++options_error_rcu: ++ rcu_read_unlock(); ++ + options_error: + nla_nest_cancel(skb, nest); + diff --git a/queue-6.1/series b/queue-6.1/series index a7e76762929..ab4d33c9603 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -91,3 +91,5 @@ usb-serial-option-add-quectel-rg650v.patch irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch +asoc-amd-yc-fix-internal-mic-on-xiaomi-book-pro-14-2022.patch +net-sched-use-rcu-read-side-critical-section-in-taprio_dump.patch -- 2.47.2