From: Greg Kroah-Hartman Date: Sat, 2 Sep 2023 13:29:24 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.5.2~32 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0859009a0c99e53db6fa14d94332a7fd132e0362;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_remove-due-to-race-condition.patch wifi-mt76-mt7921-do-not-support-one-stream-on-secondary-antenna-only.patch --- diff --git a/queue-5.15/bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_remove-due-to-race-condition.patch b/queue-5.15/bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_remove-due-to-race-condition.patch new file mode 100644 index 00000000000..310c8dbcb5b --- /dev/null +++ b/queue-5.15/bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_remove-due-to-race-condition.patch @@ -0,0 +1,38 @@ +From 73f7b171b7c09139eb3c6a5677c200dc1be5f318 Mon Sep 17 00:00:00 2001 +From: Zheng Wang +Date: Thu, 9 Mar 2023 00:45:01 +0800 +Subject: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition + +From: Zheng Wang + +commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 upstream. + +In btsdio_probe, the data->work is bound with btsdio_work. It will be +started in btsdio_send_frame. + +If the btsdio_remove runs with a unfinished work, there may be a race +condition that hdev is freed but used in btsdio_work. Fix it by +canceling the work before do cleanup in btsdio_remove. + +Fixes: CVE-2023-1989 +Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices") +Cc: stable@vger.kernel.org +Signed-off-by: Zheng Wang +Signed-off-by: Luiz Augusto von Dentz +[ Denis: Added CVE-2023-1989 and fixes tags. ] +Signed-off-by: Denis Efremov (Oracle) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btsdio.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -355,6 +355,7 @@ static void btsdio_remove(struct sdio_fu + if (!data) + return; + ++ cancel_work_sync(&data->work); + hdev = data->hdev; + + sdio_set_drvdata(func, NULL); diff --git a/queue-5.15/series b/queue-5.15/series index 91fbbc9ef1b..ff91b700dd4 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -13,3 +13,5 @@ usb-dwc3-meson-g12a-do-post-init-to-fix-broken-usb-after-resumption.patch usb-chipidea-imx-improve-logic-if-samsung-picophy-parameter-is-0.patch hid-wacom-remove-the-battery-when-the-ekr-is-off.patch staging-rtl8712-fix-race-condition.patch +bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_remove-due-to-race-condition.patch +wifi-mt76-mt7921-do-not-support-one-stream-on-secondary-antenna-only.patch diff --git a/queue-5.15/wifi-mt76-mt7921-do-not-support-one-stream-on-secondary-antenna-only.patch b/queue-5.15/wifi-mt76-mt7921-do-not-support-one-stream-on-secondary-antenna-only.patch new file mode 100644 index 00000000000..097d528ecd2 --- /dev/null +++ b/queue-5.15/wifi-mt76-mt7921-do-not-support-one-stream-on-secondary-antenna-only.patch @@ -0,0 +1,42 @@ +From d616d3680264beb9a9d2c4fc681064b06f447eeb Mon Sep 17 00:00:00 2001 +From: Deren Wu +Date: Wed, 10 May 2023 14:51:13 +0800 +Subject: wifi: mt76: mt7921: do not support one stream on secondary antenna only + +From: Deren Wu + +commit d616d3680264beb9a9d2c4fc681064b06f447eeb upstream. + +mt7921 support following antenna combiantions only. +* primary + secondary (2x2) +* primary only (1x1) + +Since we cannot work on secondary antenna only, return error if the +antenna bitmap is 0x2 in .set_antenna(). + +For example: +iw phy0 set antenna 3 3 /* valid */ +iw phy0 set antenna 1 1 /* valid */ +iw phy0 set antenna 2 2 /* invalid */ + +Cc: stable@vger.kernel.org +Fixes: e0f9fdda81bd ("mt76: mt7921: add ieee80211_ops") +Suggested-by: Knox Chiou +Signed-off-by: Deren Wu +Signed-off-by: Felix Fietkau +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -994,7 +994,7 @@ mt7921_set_antenna(struct ieee80211_hw * + return -EINVAL; + + if ((BIT(hweight8(tx_ant)) - 1) != tx_ant) +- tx_ant = BIT(ffs(tx_ant) - 1) - 1; ++ return -EINVAL; + + mt7921_mutex_acquire(dev); +