--- /dev/null
+From 37fe5ea1fd3218badebe563398d01ca371b85231 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Dec 2020 09:52:52 +0100
+Subject: extcon: Add stubs for extcon_register_notifier_all() functions
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c9570d4a5efd04479b3cd09c39b571eb031d94f4 ]
+
+Add stubs for extcon_register_notifier_all() function for !CONFIG_EXTCON
+case. This is useful for compile testing and for drivers which use
+EXTCON but do not require it (therefore do not depend on CONFIG_EXTCON).
+
+Fixes: 815429b39d94 ("extcon: Add new extcon_register_notifier_all() to monitor all external connectors")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/extcon.h | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/include/linux/extcon.h b/include/linux/extcon.h
+index fd183fb9c20f..0c19010da77f 100644
+--- a/include/linux/extcon.h
++++ b/include/linux/extcon.h
+@@ -271,6 +271,29 @@ static inline void devm_extcon_unregister_notifier(struct device *dev,
+ struct extcon_dev *edev, unsigned int id,
+ struct notifier_block *nb) { }
+
++static inline int extcon_register_notifier_all(struct extcon_dev *edev,
++ struct notifier_block *nb)
++{
++ return 0;
++}
++
++static inline int extcon_unregister_notifier_all(struct extcon_dev *edev,
++ struct notifier_block *nb)
++{
++ return 0;
++}
++
++static inline int devm_extcon_register_notifier_all(struct device *dev,
++ struct extcon_dev *edev,
++ struct notifier_block *nb)
++{
++ return 0;
++}
++
++static inline void devm_extcon_unregister_notifier_all(struct device *dev,
++ struct extcon_dev *edev,
++ struct notifier_block *nb) { }
++
+ static inline struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name)
+ {
+ return ERR_PTR(-ENODEV);
+--
+2.30.2
+
--- /dev/null
+From 815582a4c6b4bf8dc46e2203bcd7cb0858a4f9b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 16:10:55 +0800
+Subject: extcon: Fix error handling in extcon_dev_register
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit d3bdd1c3140724967ca4136755538fa7c05c2b4e ]
+
+When devm_kcalloc() fails, we should execute device_unregister()
+to unregister edev->dev from system.
+
+Fixes: 046050f6e623e ("extcon: Update the prototype of extcon_register_notifier() with enum extcon")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
+index 0a6438cbb3f3..e7a9561a826d 100644
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -1241,6 +1241,7 @@ int extcon_dev_register(struct extcon_dev *edev)
+ sizeof(*edev->nh), GFP_KERNEL);
+ if (!edev->nh) {
+ ret = -ENOMEM;
++ device_unregister(&edev->dev);
+ goto err_dev;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From d99dbd55fe0127e00c8eca23c54f97343889e1e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Apr 2021 06:58:36 +0000
+Subject: firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 829933ef05a951c8ff140e814656d73e74915faf ]
+
+For each device, the nosy driver allocates a pcilynx structure.
+A use-after-free might happen in the following scenario:
+
+ 1. Open nosy device for the first time and call ioctl with command
+ NOSY_IOC_START, then a new client A will be malloced and added to
+ doubly linked list.
+ 2. Open nosy device for the second time and call ioctl with command
+ NOSY_IOC_START, then a new client B will be malloced and added to
+ doubly linked list.
+ 3. Call ioctl with command NOSY_IOC_START for client A, then client A
+ will be readded to the doubly linked list. Now the doubly linked
+ list is messed up.
+ 4. Close the first nosy device and nosy_release will be called. In
+ nosy_release, client A will be unlinked and freed.
+ 5. Close the second nosy device, and client A will be referenced,
+ resulting in UAF.
+
+The root cause of this bug is that the element in the doubly linked list
+is reentered into the list.
+
+Fix this bug by adding a check before inserting a client. If a client
+is already in the linked list, don't insert it.
+
+The following KASAN report reveals it:
+
+ BUG: KASAN: use-after-free in nosy_release+0x1ea/0x210
+ Write of size 8 at addr ffff888102ad7360 by task poc
+ CPU: 3 PID: 337 Comm: poc Not tainted 5.12.0-rc5+ #6
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ nosy_release+0x1ea/0x210
+ __fput+0x1e2/0x840
+ task_work_run+0xe8/0x180
+ exit_to_user_mode_prepare+0x114/0x120
+ syscall_exit_to_user_mode+0x1d/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ Allocated by task 337:
+ nosy_open+0x154/0x4d0
+ misc_open+0x2ec/0x410
+ chrdev_open+0x20d/0x5a0
+ do_dentry_open+0x40f/0xe80
+ path_openat+0x1cf9/0x37b0
+ do_filp_open+0x16d/0x390
+ do_sys_openat2+0x11d/0x360
+ __x64_sys_open+0xfd/0x1a0
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ Freed by task 337:
+ kfree+0x8f/0x210
+ nosy_release+0x158/0x210
+ __fput+0x1e2/0x840
+ task_work_run+0xe8/0x180
+ exit_to_user_mode_prepare+0x114/0x120
+ syscall_exit_to_user_mode+0x1d/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ The buggy address belongs to the object at ffff888102ad7300 which belongs to the cache kmalloc-128 of size 128
+ The buggy address is located 96 bytes inside of 128-byte region [ffff888102ad7300, ffff888102ad7380)
+
+[ Modified to use 'list_empty()' inside proper lock - Linus ]
+
+Link: https://lore.kernel.org/lkml/1617433116-5930-1-git-send-email-zheyuma97@gmail.com/
+Reported-and-tested-by: 马哲宇 (Zheyu Ma) <zheyuma97@gmail.com>
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Cc: Greg Kroah-Hartman <greg@kroah.com>
+Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firewire/nosy.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c
+index 5fd6a60b6741..88ed971e32c0 100644
+--- a/drivers/firewire/nosy.c
++++ b/drivers/firewire/nosy.c
+@@ -346,6 +346,7 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ struct client *client = file->private_data;
+ spinlock_t *client_list_lock = &client->lynx->client_list_lock;
+ struct nosy_stats stats;
++ int ret;
+
+ switch (cmd) {
+ case NOSY_IOC_GET_STATS:
+@@ -360,11 +361,15 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ return 0;
+
+ case NOSY_IOC_START:
++ ret = -EBUSY;
+ spin_lock_irq(client_list_lock);
+- list_add_tail(&client->link, &client->lynx->client_list);
++ if (list_empty(&client->link)) {
++ list_add_tail(&client->link, &client->lynx->client_list);
++ ret = 0;
++ }
+ spin_unlock_irq(client_list_lock);
+
+- return 0;
++ return ret;
+
+ case NOSY_IOC_STOP:
+ spin_lock_irq(client_list_lock);
+--
+2.30.2
+
--- /dev/null
+From 23196ce40a5a5ce98e7237d2703bd4f3a04784a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 16:20:27 -0600
+Subject: firmware: stratix10-svc: reset COMMAND_RECONFIG_FLAG_PARTIAL to 0
+
+From: Richard Gong <richard.gong@intel.com>
+
+[ Upstream commit 2e8496f31d0be8f43849b2980b069f3a9805d047 ]
+
+Clean up COMMAND_RECONFIG_FLAG_PARTIAL flag by resetting it to 0, which
+aligns with the firmware settings.
+
+Fixes: 36847f9e3e56 ("firmware: stratix10-svc: correct reconfig flag and timeout values")
+Signed-off-by: Richard Gong <richard.gong@intel.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/firmware/intel/stratix10-svc-client.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/firmware/intel/stratix10-svc-client.h b/include/linux/firmware/intel/stratix10-svc-client.h
+index a93d85932eb9..f843c6a10cf3 100644
+--- a/include/linux/firmware/intel/stratix10-svc-client.h
++++ b/include/linux/firmware/intel/stratix10-svc-client.h
+@@ -56,7 +56,7 @@
+ * COMMAND_RECONFIG_FLAG_PARTIAL:
+ * Set to FPGA configuration type (full or partial).
+ */
+-#define COMMAND_RECONFIG_FLAG_PARTIAL 1
++#define COMMAND_RECONFIG_FLAG_PARTIAL 0
+
+ /**
+ * Timeout settings for service clients:
+--
+2.30.2
+
kvm-x86-compile-out-tdp-mmu-on-32-bit-systems.patch
kvm-x86-mmu-ensure-tlbs-are-flushed-for-tdp-mmu-duri.patch
kbuild-add-resolve_btfids-clean-to-root-clean-target.patch
+extcon-add-stubs-for-extcon_register_notifier_all-fu.patch
+extcon-fix-error-handling-in-extcon_dev_register.patch
+firmware-stratix10-svc-reset-command_reconfig_flag_p.patch
+usb-dwc3-pci-enable-dis_ux_susphy_quirk-for-intel-me.patch
+video-hyperv_fb-fix-a-double-free-in-hvfb_probe.patch
+firewire-nosy-fix-a-use-after-free-bug-in-nosy_ioctl.patch
--- /dev/null
+From f1c479ae7cece0034b98a92a49812e7306968c96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Mar 2021 14:52:44 +0200
+Subject: usb: dwc3: pci: Enable dis_uX_susphy_quirk for Intel Merrifield
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit b522f830d35189e0283fa4d5b4b3ef8d7a78cfcb ]
+
+It seems that on Intel Merrifield platform the USB PHY shouldn't be suspended.
+Otherwise it can't be enabled by simply change the cable in the connector.
+
+Enable corresponding quirk for the platform in question.
+
+Fixes: e5f4ca3fce90 ("usb: dwc3: ulpi: Fix USB2.0 HS/FS/LS PHY suspend regression")
+Suggested-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210322125244.79407-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index bae6a70664c8..598daed8086f 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -118,6 +118,8 @@ static const struct property_entry dwc3_pci_intel_properties[] = {
+ static const struct property_entry dwc3_pci_mrfld_properties[] = {
+ PROPERTY_ENTRY_STRING("dr_mode", "otg"),
+ PROPERTY_ENTRY_STRING("linux,extcon-name", "mrfld_bcove_pwrsrc"),
++ PROPERTY_ENTRY_BOOL("snps,dis_u3_susphy_quirk"),
++ PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"),
+ PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"),
+ {}
+ };
+--
+2.30.2
+
--- /dev/null
+From a58c78691d4cf5881cabe813708b7bde99415da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Mar 2021 03:37:24 -0700
+Subject: video: hyperv_fb: Fix a double free in hvfb_probe
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 37df9f3fedb6aeaff5564145e8162aab912c9284 ]
+
+Function hvfb_probe() calls hvfb_getmem(), expecting upon return that
+info->apertures is either NULL or points to memory that should be freed
+by framebuffer_release(). But hvfb_getmem() is freeing the memory and
+leaving the pointer non-NULL, resulting in a double free if an error
+occurs or later if hvfb_remove() is called.
+
+Fix this by removing all kfree(info->apertures) calls in hvfb_getmem().
+This will allow framebuffer_release() to free the memory, which follows
+the pattern of other fbdev drivers.
+
+Fixes: 3a6fb6c4255c ("video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs.")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/20210324103724.4189-1-lyl2019@mail.ustc.edu.cn
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/hyperv_fb.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index c8b0ae676809..4dc9077dd2ac 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -1031,7 +1031,6 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ PCI_DEVICE_ID_HYPERV_VIDEO, NULL);
+ if (!pdev) {
+ pr_err("Unable to find PCI Hyper-V video\n");
+- kfree(info->apertures);
+ return -ENODEV;
+ }
+
+@@ -1129,7 +1128,6 @@ getmem_done:
+ } else {
+ pci_dev_put(pdev);
+ }
+- kfree(info->apertures);
+
+ return 0;
+
+@@ -1141,7 +1139,6 @@ err2:
+ err1:
+ if (!gen2vm)
+ pci_dev_put(pdev);
+- kfree(info->apertures);
+
+ return -ENOMEM;
+ }
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
