5.10-stable patches

added patches:
	hpet-support-32-bit-userspace.patch

diff --git a/queue-5.10/hpet-support-32-bit-userspace.patch b/queue-5.10/hpet-support-32-bit-userspace.patch
new file mode 100644 (file)
index 0000000..2c16751
--- /dev/null
+++ b/queue-5.10/hpet-support-32-bit-userspace.patch
@@ -0,0 +1,113 @@
+From 4e60131d0d36af65ab9c9144f4f163fe97ae36e8 Mon Sep 17 00:00:00 2001
+From: He Zhe <zhe.he@windriver.com>
+Date: Thu, 6 Jun 2024 20:39:08 +0800
+Subject: hpet: Support 32-bit userspace
+
+From: He Zhe <zhe.he@windriver.com>
+
+commit 4e60131d0d36af65ab9c9144f4f163fe97ae36e8 upstream.
+
+hpet_compat_ioctl and read file operations failed to handle parameters from
+32-bit userspace and thus samples/timers/hpet_example.c fails as below.
+
+root@intel-x86-64:~# ./hpet_example-32.out poll /dev/hpet 1 2
+-hpet: executing poll
+hpet_poll: HPET_IRQFREQ failed
+
+This patch fixes cmd and arg handling in hpet_compat_ioctl and adds compat
+handling for 32-bit userspace in hpet_read.
+
+hpet_example now shows that it works for both 64-bit and 32-bit.
+
+root@intel-x86-64:~# ./hpet_example-32.out poll /dev/hpet 1 2
+-hpet: executing poll
+hpet_poll: info.hi_flags 0x0
+hpet_poll: expired time = 0xf4298
+hpet_poll: revents = 0x1
+hpet_poll: data 0x1
+hpet_poll: expired time = 0xf4235
+hpet_poll: revents = 0x1
+hpet_poll: data 0x1
+root@intel-x86-64:~# ./hpet_example-64.out poll /dev/hpet 1 2
+-hpet: executing poll
+hpet_poll: info.hi_flags 0x0
+hpet_poll: expired time = 0xf42a1
+hpet_poll: revents = 0x1
+hpet_poll: data 0x1
+hpet_poll: expired time = 0xf4232
+hpet_poll: revents = 0x1
+hpet_poll: data 0x1
+
+Cc: stable@vger.kernel.org
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Fixes: 54066a57c584 ("hpet: kill BKL, add compat_ioctl")
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240606123908.738733-1-zhe.he@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/hpet.c |   34 +++++++++++++++++++++++++++++-----
+ 1 file changed, 29 insertions(+), 5 deletions(-)
+
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -304,8 +304,13 @@ hpet_read(struct file *file, char __user
+       if (!devp->hd_ireqfreq)
+               return -EIO;
+ 
+-      if (count < sizeof(unsigned long))
+-              return -EINVAL;
++      if (in_compat_syscall()) {
++              if (count < sizeof(compat_ulong_t))
++                      return -EINVAL;
++      } else {
++              if (count < sizeof(unsigned long))
++                      return -EINVAL;
++      }
+ 
+       add_wait_queue(&devp->hd_waitqueue, &wait);
+ 
+@@ -329,9 +334,16 @@ hpet_read(struct file *file, char __user
+               schedule();
+       }
+ 
+-      retval = put_user(data, (unsigned long __user *)buf);
+-      if (!retval)
+-              retval = sizeof(unsigned long);
++      if (in_compat_syscall()) {
++              retval = put_user(data, (compat_ulong_t __user *)buf);
++              if (!retval)
++                      retval = sizeof(compat_ulong_t);
++      } else {
++              retval = put_user(data, (unsigned long __user *)buf);
++              if (!retval)
++                      retval = sizeof(unsigned long);
++      }
++
+ out:
+       __set_current_state(TASK_RUNNING);
+       remove_wait_queue(&devp->hd_waitqueue, &wait);
+@@ -686,12 +698,24 @@ struct compat_hpet_info {
+       unsigned short hi_timer;
+ };
+ 
++/* 32-bit types would lead to different command codes which should be
++ * translated into 64-bit ones before passed to hpet_ioctl_common
++ */
++#define COMPAT_HPET_INFO       _IOR('h', 0x03, struct compat_hpet_info)
++#define COMPAT_HPET_IRQFREQ    _IOW('h', 0x6, compat_ulong_t)
++
+ static long
+ hpet_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
+       struct hpet_info info;
+       int err;
+ 
++      if (cmd == COMPAT_HPET_INFO)
++              cmd = HPET_INFO;
++
++      if (cmd == COMPAT_HPET_IRQFREQ)
++              cmd = HPET_IRQFREQ;
++
+       mutex_lock(&hpet_mutex);
+       err = hpet_ioctl_common(file->private_data, cmd, arg, &info);
+       mutex_unlock(&hpet_mutex);

diff --git a/queue-5.10/series b/queue-5.10/series
index 7141bd7d43ca95c8ad02e5908861669ad0e80c0b..bc2c9702b83fa28c53ef4447e637e273619f1173 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -83,3 +83,4 @@ usb-serial-mos7840-fix-crash-on-resume.patch
 usb-add-usb_quirk_no_set_intf-quirk-for-start-bp-850k.patch
 usb-gadget-configfs-prevent-oob-read-write-in-usb_string_copy.patch
 usb-core-fix-duplicate-endpoint-bug-by-clearing-reserved-bits-in-the-descriptor.patch
+hpet-support-32-bit-userspace.patch