4.19-stable patches

added patches:
	alsa-timer-relax-start-tick-time-check-for-slave-timer-elements.patch
	bluetooth-hci_ldisc-check-hci_uart_proto_ready-flag-in-hciuartgetproto.patch

diff --git a/queue-4.19/alsa-timer-relax-start-tick-time-check-for-slave-timer-elements.patch b/queue-4.19/alsa-timer-relax-start-tick-time-check-for-slave-timer-elements.patch
new file mode 100644 (file)
index 0000000..eb332f1
--- /dev/null
+++ b/queue-4.19/alsa-timer-relax-start-tick-time-check-for-slave-timer-elements.patch
@@ -0,0 +1,38 @@
+From ccbfcac05866ebe6eb3bc6d07b51d4ed4fcde436 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 10 Aug 2024 10:48:32 +0200
+Subject: ALSA: timer: Relax start tick time check for slave timer elements
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ccbfcac05866ebe6eb3bc6d07b51d4ed4fcde436 upstream.
+
+The recent addition of a sanity check for a too low start tick time
+seems breaking some applications that uses aloop with a certain slave
+timer setup.  They may have the initial resolution 0, hence it's
+treated as if it were a too low value.
+
+Relax and skip the check for the slave timer instance for addressing
+the regression.
+
+Fixes: 4a63bd179fa8 ("ALSA: timer: Set lower bound of start tick time")
+Cc: <stable@vger.kernel.org>
+Link: https://github.com/raspberrypi/linux/issues/6294
+Link: https://patch.msgid.link/20240810084833.10939-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/timer.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -532,7 +532,7 @@ static int snd_timer_start1(struct snd_t
+       /* check the actual time for the start tick;
+        * bail out as error if it's way too low (< 100us)
+        */
+-      if (start) {
++      if (start && !(timer->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
+               if ((u64)snd_timer_hw_resolution(timer) * ticks < 100000) {
+                       result = -EINVAL;
+                       goto unlock;

diff --git a/queue-4.19/bluetooth-hci_ldisc-check-hci_uart_proto_ready-flag-in-hciuartgetproto.patch b/queue-4.19/bluetooth-hci_ldisc-check-hci_uart_proto_ready-flag-in-hciuartgetproto.patch
new file mode 100644 (file)
index 0000000..a9b5163
--- /dev/null
+++ b/queue-4.19/bluetooth-hci_ldisc-check-hci_uart_proto_ready-flag-in-hciuartgetproto.patch
@@ -0,0 +1,42 @@
+From 9c33663af9ad115f90c076a1828129a3fbadea98 Mon Sep 17 00:00:00 2001
+From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
+Date: Mon, 10 Jul 2023 23:17:23 +0800
+Subject: Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
+
+From: Lee, Chun-Yi <joeyli.kernel@gmail.com>
+
+commit 9c33663af9ad115f90c076a1828129a3fbadea98 upstream.
+
+This patch adds code to check HCI_UART_PROTO_READY flag before
+accessing hci_uart->proto. It fixes the race condition in
+hci_uart_tty_ioctl() between HCIUARTSETPROTO and HCIUARTGETPROTO.
+This issue bug found by Yu Hao and Weiteng Chen:
+
+BUG: general protection fault in hci_uart_tty_ioctl [1]
+
+The information of C reproducer can also reference the link [2]
+
+Reported-by: Yu Hao <yhao016@ucr.edu>
+Closes: https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDeCO2g@mail.gmail.com/ [1]
+Reported-by: Weiteng Chen <wchen130@ucr.edu>
+Closes: https://lore.kernel.org/lkml/CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4Keh2ow@mail.gmail.com/T/ [2]
+Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/hci_ldisc.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -773,7 +773,8 @@ static int hci_uart_tty_ioctl(struct tty
+               break;
+ 
+       case HCIUARTGETPROTO:
+-              if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
++              if (test_bit(HCI_UART_PROTO_SET, &hu->flags) &&
++                  test_bit(HCI_UART_PROTO_READY, &hu->flags))
+                       err = hu->proto->id;
+               else
+                       err = -EUNATCH;

diff --git a/queue-4.19/series b/queue-4.19/series
index 323ec6d662c6e0d81299a25d2ee7c12ed24e5095..fa8cfdac6ee9612099b0e7294d4b9836f54d810a 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -65,3 +65,5 @@ bluetooth-mgmt-add-error-handling-to-pair_device.patch
 hid-wacom-defer-calculation-of-resolution-until-resolution_code-is-known.patch
 cxgb4-add-forgotten-u64-ivlan-cast-before-shift.patch
 mmc-dw_mmc-allow-biu-and-ciu-clocks-to-defer.patch
+alsa-timer-relax-start-tick-time-check-for-slave-timer-elements.patch
+bluetooth-hci_ldisc-check-hci_uart_proto_ready-flag-in-hciuartgetproto.patch