From cab8f655a29593f6f7ff6e2aaa9e46f9be8e9bb6 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 29 Apr 2018 15:07:59 +0200 Subject: [PATCH] 4.4-stable patches added patches: arm-amba-don-t-read-past-the-end-of-sysfs-driver_override-buffer.patch arm-amba-fix-race-condition-with-driver_override.patch arm-amba-make-driver_override-output-consistent-with-other-buses.patch asoc-fsl_esai-fix-divisor-calculation-failure-at-lower-ratio.patch libceph-validate-con-state-at-the-top-of-try_write.patch --- ...realtek-update-alc255-depop-optimize.patch | 32 --------- ...-end-of-sysfs-driver_override-buffer.patch | 39 +++++++++++ ...-race-condition-with-driver_override.patch | 69 +++++++++++++++++++ ...e-output-consistent-with-other-buses.patch | 40 +++++++++++ ...r-calculation-failure-at-lower-ratio.patch | 47 +++++++++++++ ...te-con-state-at-the-top-of-try_write.patch | 56 +++++++++++++++ queue-4.4/series | 6 +- 7 files changed, 256 insertions(+), 33 deletions(-) delete mode 100644 queue-4.4/alsa-hda-realtek-update-alc255-depop-optimize.patch create mode 100644 queue-4.4/arm-amba-don-t-read-past-the-end-of-sysfs-driver_override-buffer.patch create mode 100644 queue-4.4/arm-amba-fix-race-condition-with-driver_override.patch create mode 100644 queue-4.4/arm-amba-make-driver_override-output-consistent-with-other-buses.patch create mode 100644 queue-4.4/asoc-fsl_esai-fix-divisor-calculation-failure-at-lower-ratio.patch create mode 100644 queue-4.4/libceph-validate-con-state-at-the-top-of-try_write.patch diff --git a/queue-4.4/alsa-hda-realtek-update-alc255-depop-optimize.patch b/queue-4.4/alsa-hda-realtek-update-alc255-depop-optimize.patch deleted file mode 100644 index 055121c1556..00000000000 --- a/queue-4.4/alsa-hda-realtek-update-alc255-depop-optimize.patch +++ /dev/null @@ -1,32 +0,0 @@ -From ab3b8e5159b5335c81ba2d09ee5054d4a1b5a7a6 Mon Sep 17 00:00:00 2001 -From: Kailang Yang -Date: Wed, 25 Apr 2018 16:05:27 +0800 -Subject: ALSA: hda/realtek - Update ALC255 depop optimize - -From: Kailang Yang - -commit ab3b8e5159b5335c81ba2d09ee5054d4a1b5a7a6 upstream. - -Add ALC255 its own depop functions for alc_init and alc_shutup. -Assign it to ALC256 usage. - -Signed-off-by: Kailang Yang -Cc: -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - sound/pci/hda/patch_realtek.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -6300,6 +6300,8 @@ static int patch_alc269(struct hda_codec - case 0x10ec0235: - case 0x10ec0255: - spec->codec_variant = ALC269_TYPE_ALC255; -+ spec->shutup = alc256_shutup; -+ spec->init_hook = alc256_init; - break; - case 0x10ec0236: - case 0x10ec0256: diff --git a/queue-4.4/arm-amba-don-t-read-past-the-end-of-sysfs-driver_override-buffer.patch b/queue-4.4/arm-amba-don-t-read-past-the-end-of-sysfs-driver_override-buffer.patch new file mode 100644 index 00000000000..ef7257d1b3a --- /dev/null +++ b/queue-4.4/arm-amba-don-t-read-past-the-end-of-sysfs-driver_override-buffer.patch @@ -0,0 +1,39 @@ +From d2ffed5185df9d8d9ccd150e4340e3b6f96a8381 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 10 Apr 2018 15:21:45 +0200 +Subject: ARM: amba: Don't read past the end of sysfs "driver_override" buffer + +From: Geert Uytterhoeven + +commit d2ffed5185df9d8d9ccd150e4340e3b6f96a8381 upstream. + +When printing the driver_override parameter when it is 4095 and 4094 +bytes long, the printing code would access invalid memory because we +need count + 1 bytes for printing. + +Cfr. commits 4efe874aace57dba ("PCI: Don't read past the end of sysfs +"driver_override" buffer") and bf563b01c2895a4b ("driver core: platform: +Don't read past the end of "driver_override" buffer"). + +Fixes: 3cf385713460eb2b ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Todd Kjos +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/amba/bus.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -83,7 +83,8 @@ static ssize_t driver_override_store(str + struct amba_device *dev = to_amba_device(_dev); + char *driver_override, *old, *cp; + +- if (count > PATH_MAX) ++ /* We need to keep extra room for a newline */ ++ if (count >= (PAGE_SIZE - 1)) + return -EINVAL; + + driver_override = kstrndup(buf, count, GFP_KERNEL); diff --git a/queue-4.4/arm-amba-fix-race-condition-with-driver_override.patch b/queue-4.4/arm-amba-fix-race-condition-with-driver_override.patch new file mode 100644 index 00000000000..8228dd126ad --- /dev/null +++ b/queue-4.4/arm-amba-fix-race-condition-with-driver_override.patch @@ -0,0 +1,69 @@ +From 6a7228d90d42bcacfe38786756ba62762b91c20a Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 10 Apr 2018 15:21:44 +0200 +Subject: ARM: amba: Fix race condition with driver_override + +From: Geert Uytterhoeven + +commit 6a7228d90d42bcacfe38786756ba62762b91c20a upstream. + +The driver_override implementation is susceptible to a race condition +when different threads are reading vs storing a different driver +override. Add locking to avoid this race condition. + +Cfr. commits 6265539776a0810b ("driver core: platform: fix race +condition with driver_override") and 9561475db680f714 ("PCI: Fix race +condition with driver_override"). + +Fixes: 3cf385713460eb2b ("ARM: 8256/1: driver coamba: add device binding path 'driver_override'") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Todd Kjos +Cc: stable +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/amba/bus.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -68,8 +68,12 @@ static ssize_t driver_override_show(stru + struct device_attribute *attr, char *buf) + { + struct amba_device *dev = to_amba_device(_dev); ++ ssize_t len; + +- return sprintf(buf, "%s\n", dev->driver_override); ++ device_lock(_dev); ++ len = sprintf(buf, "%s\n", dev->driver_override); ++ device_unlock(_dev); ++ return len; + } + + static ssize_t driver_override_store(struct device *_dev, +@@ -77,7 +81,7 @@ static ssize_t driver_override_store(str + const char *buf, size_t count) + { + struct amba_device *dev = to_amba_device(_dev); +- char *driver_override, *old = dev->driver_override, *cp; ++ char *driver_override, *old, *cp; + + if (count > PATH_MAX) + return -EINVAL; +@@ -90,12 +94,15 @@ static ssize_t driver_override_store(str + if (cp) + *cp = '\0'; + ++ device_lock(_dev); ++ old = dev->driver_override; + if (strlen(driver_override)) { + dev->driver_override = driver_override; + } else { + kfree(driver_override); + dev->driver_override = NULL; + } ++ device_unlock(_dev); + + kfree(old); + diff --git a/queue-4.4/arm-amba-make-driver_override-output-consistent-with-other-buses.patch b/queue-4.4/arm-amba-make-driver_override-output-consistent-with-other-buses.patch new file mode 100644 index 00000000000..2dc285c85b4 --- /dev/null +++ b/queue-4.4/arm-amba-make-driver_override-output-consistent-with-other-buses.patch @@ -0,0 +1,40 @@ +From 5f53624662eaac89598641cee6cd54fc192572d9 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 10 Apr 2018 15:21:43 +0200 +Subject: ARM: amba: Make driver_override output consistent with other buses + +From: Geert Uytterhoeven + +commit 5f53624662eaac89598641cee6cd54fc192572d9 upstream. + +For AMBA devices with unconfigured driver override, the +"driver_override" sysfs virtual file is empty, while it contains +"(null)" for platform and PCI devices. + +Make AMBA consistent with other buses by dropping the test for a NULL +pointer. + +Note that contrary to popular belief, sprintf() handles NULL pointers +fine; they are printed as "(null)". + +Signed-off-by: Geert Uytterhoeven +Cc: stable +Reviewed-by: Todd Kjos +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/amba/bus.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -69,9 +69,6 @@ static ssize_t driver_override_show(stru + { + struct amba_device *dev = to_amba_device(_dev); + +- if (!dev->driver_override) +- return 0; +- + return sprintf(buf, "%s\n", dev->driver_override); + } + diff --git a/queue-4.4/asoc-fsl_esai-fix-divisor-calculation-failure-at-lower-ratio.patch b/queue-4.4/asoc-fsl_esai-fix-divisor-calculation-failure-at-lower-ratio.patch new file mode 100644 index 00000000000..7653bb1487e --- /dev/null +++ b/queue-4.4/asoc-fsl_esai-fix-divisor-calculation-failure-at-lower-ratio.patch @@ -0,0 +1,47 @@ +From c656941df9bc80f7ec65b92ca73c42f8b0b62628 Mon Sep 17 00:00:00 2001 +From: Nicolin Chen +Date: Sun, 8 Apr 2018 16:57:35 -0700 +Subject: ASoC: fsl_esai: Fix divisor calculation failure at lower ratio + +From: Nicolin Chen + +commit c656941df9bc80f7ec65b92ca73c42f8b0b62628 upstream. + +When the desired ratio is less than 256, the savesub (tolerance) +in the calculation would become 0. This will then fail the loop- +search immediately without reporting any errors. + +But if the ratio is smaller enough, there is no need to calculate +the tolerance because PM divisor alone is enough to get the ratio. + +So a simple fix could be just to set PM directly instead of going +into the loop-search. + +Reported-by: Marek Vasut +Signed-off-by: Nicolin Chen +Tested-by: Marek Vasut +Reviewed-by: Fabio Estevam +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/fsl/fsl_esai.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/soc/fsl/fsl_esai.c ++++ b/sound/soc/fsl/fsl_esai.c +@@ -143,6 +143,13 @@ static int fsl_esai_divisor_cal(struct s + + psr = ratio <= 256 * maxfp ? ESAI_xCCR_xPSR_BYPASS : ESAI_xCCR_xPSR_DIV8; + ++ /* Do not loop-search if PM (1 ~ 256) alone can serve the ratio */ ++ if (ratio <= 256) { ++ pm = ratio; ++ fp = 1; ++ goto out; ++ } ++ + /* Set the max fluctuation -- 0.1% of the max devisor */ + savesub = (psr ? 1 : 8) * 256 * maxfp / 1000; + diff --git a/queue-4.4/libceph-validate-con-state-at-the-top-of-try_write.patch b/queue-4.4/libceph-validate-con-state-at-the-top-of-try_write.patch new file mode 100644 index 00000000000..ee6de6ae299 --- /dev/null +++ b/queue-4.4/libceph-validate-con-state-at-the-top-of-try_write.patch @@ -0,0 +1,56 @@ +From 9c55ad1c214d9f8c4594ac2c3fa392c1c32431a7 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Tue, 24 Apr 2018 19:10:55 +0200 +Subject: libceph: validate con->state at the top of try_write() + +From: Ilya Dryomov + +commit 9c55ad1c214d9f8c4594ac2c3fa392c1c32431a7 upstream. + +ceph_con_workfn() validates con->state before calling try_read() and +then try_write(). However, try_read() temporarily releases con->mutex, +notably in process_message() and ceph_con_in_msg_alloc(), opening the +window for ceph_con_close() to sneak in, close the connection and +release con->sock. When try_write() is called on the assumption that +con->state is still valid (i.e. not STANDBY or CLOSED), a NULL sock +gets passed to the networking stack: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 + IP: selinux_socket_sendmsg+0x5/0x20 + +Make sure con->state is valid at the top of try_write() and add an +explicit BUG_ON for this, similar to try_read(). + +Cc: stable@vger.kernel.org +Link: https://tracker.ceph.com/issues/23706 +Signed-off-by: Ilya Dryomov +Reviewed-by: Jason Dillaman +Signed-off-by: Greg Kroah-Hartman + +--- + net/ceph/messenger.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -2531,6 +2531,11 @@ static int try_write(struct ceph_connect + int ret = 1; + + dout("try_write start %p state %lu\n", con, con->state); ++ if (con->state != CON_STATE_PREOPEN && ++ con->state != CON_STATE_CONNECTING && ++ con->state != CON_STATE_NEGOTIATING && ++ con->state != CON_STATE_OPEN) ++ return 0; + + more: + dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes); +@@ -2556,6 +2561,8 @@ more: + } + + more_kvec: ++ BUG_ON(!con->sock); ++ + /* kvec data queued? */ + if (con->out_kvec_left) { + ret = write_partial_kvec(con); diff --git a/queue-4.4/series b/queue-4.4/series index c56bbd1908d..75acebb1728 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -27,9 +27,13 @@ alsa-seq-oss-fix-unbalanced-use-lock-for-synth-midi-device.patch alsa-seq-oss-hardening-for-potential-spectre-v1.patch alsa-hda-hardening-for-potential-spectre-v1.patch alsa-hda-realtek-add-some-fixes-for-alc233.patch -alsa-hda-realtek-update-alc255-depop-optimize.patch mtd-cfi-cmdset_0001-do-not-allow-read-write-to-suspend-erase-block.patch mtd-cfi-cmdset_0001-workaround-micron-erase-suspend-bug.patch mtd-cfi-cmdset_0002-do-not-allow-read-write-to-suspend-erase-block.patch kobject-don-t-use-warn-for-registration-failures.patch scsi-sd-defer-spinning-up-drive-while-sanitize-is-in-progress.patch +arm-amba-make-driver_override-output-consistent-with-other-buses.patch +arm-amba-fix-race-condition-with-driver_override.patch +arm-amba-don-t-read-past-the-end-of-sysfs-driver_override-buffer.patch +asoc-fsl_esai-fix-divisor-calculation-failure-at-lower-ratio.patch +libceph-validate-con-state-at-the-top-of-try_write.patch -- 2.47.3