From: Sasha Levin Date: Mon, 5 Apr 2021 02:09:51 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.4.265~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1d9594a72a0fb3b976e1785f5934b8e57cccd641;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/extcon-add-stubs-for-extcon_register_notifier_all-fu.patch b/queue-5.10/extcon-add-stubs-for-extcon_register_notifier_all-fu.patch new file mode 100644 index 00000000000..9150f16efaa --- /dev/null +++ b/queue-5.10/extcon-add-stubs-for-extcon_register_notifier_all-fu.patch @@ -0,0 +1,59 @@ +From 37fe5ea1fd3218badebe563398d01ca371b85231 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Dec 2020 09:52:52 +0100 +Subject: extcon: Add stubs for extcon_register_notifier_all() functions + +From: Krzysztof Kozlowski + +[ Upstream commit c9570d4a5efd04479b3cd09c39b571eb031d94f4 ] + +Add stubs for extcon_register_notifier_all() function for !CONFIG_EXTCON +case. This is useful for compile testing and for drivers which use +EXTCON but do not require it (therefore do not depend on CONFIG_EXTCON). + +Fixes: 815429b39d94 ("extcon: Add new extcon_register_notifier_all() to monitor all external connectors") +Reported-by: kernel test robot +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + include/linux/extcon.h | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +diff --git a/include/linux/extcon.h b/include/linux/extcon.h +index fd183fb9c20f..0c19010da77f 100644 +--- a/include/linux/extcon.h ++++ b/include/linux/extcon.h +@@ -271,6 +271,29 @@ static inline void devm_extcon_unregister_notifier(struct device *dev, + struct extcon_dev *edev, unsigned int id, + struct notifier_block *nb) { } + ++static inline int extcon_register_notifier_all(struct extcon_dev *edev, ++ struct notifier_block *nb) ++{ ++ return 0; ++} ++ ++static inline int extcon_unregister_notifier_all(struct extcon_dev *edev, ++ struct notifier_block *nb) ++{ ++ return 0; ++} ++ ++static inline int devm_extcon_register_notifier_all(struct device *dev, ++ struct extcon_dev *edev, ++ struct notifier_block *nb) ++{ ++ return 0; ++} ++ ++static inline void devm_extcon_unregister_notifier_all(struct device *dev, ++ struct extcon_dev *edev, ++ struct notifier_block *nb) { } ++ + static inline struct extcon_dev *extcon_get_extcon_dev(const char *extcon_name) + { + return ERR_PTR(-ENODEV); +-- +2.30.2 + diff --git a/queue-5.10/extcon-fix-error-handling-in-extcon_dev_register.patch b/queue-5.10/extcon-fix-error-handling-in-extcon_dev_register.patch new file mode 100644 index 00000000000..8509755e0a5 --- /dev/null +++ b/queue-5.10/extcon-fix-error-handling-in-extcon_dev_register.patch @@ -0,0 +1,35 @@ +From 815582a4c6b4bf8dc46e2203bcd7cb0858a4f9b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 16:10:55 +0800 +Subject: extcon: Fix error handling in extcon_dev_register + +From: Dinghao Liu + +[ Upstream commit d3bdd1c3140724967ca4136755538fa7c05c2b4e ] + +When devm_kcalloc() fails, we should execute device_unregister() +to unregister edev->dev from system. + +Fixes: 046050f6e623e ("extcon: Update the prototype of extcon_register_notifier() with enum extcon") +Signed-off-by: Dinghao Liu +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index 0a6438cbb3f3..e7a9561a826d 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -1241,6 +1241,7 @@ int extcon_dev_register(struct extcon_dev *edev) + sizeof(*edev->nh), GFP_KERNEL); + if (!edev->nh) { + ret = -ENOMEM; ++ device_unregister(&edev->dev); + goto err_dev; + } + +-- +2.30.2 + diff --git a/queue-5.10/firewire-nosy-fix-a-use-after-free-bug-in-nosy_ioctl.patch b/queue-5.10/firewire-nosy-fix-a-use-after-free-bug-in-nosy_ioctl.patch new file mode 100644 index 00000000000..f0e5836e2f8 --- /dev/null +++ b/queue-5.10/firewire-nosy-fix-a-use-after-free-bug-in-nosy_ioctl.patch @@ -0,0 +1,119 @@ +From d99dbd55fe0127e00c8eca23c54f97343889e1e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Apr 2021 06:58:36 +0000 +Subject: firewire: nosy: Fix a use-after-free bug in nosy_ioctl() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zheyu Ma + +[ Upstream commit 829933ef05a951c8ff140e814656d73e74915faf ] + +For each device, the nosy driver allocates a pcilynx structure. +A use-after-free might happen in the following scenario: + + 1. Open nosy device for the first time and call ioctl with command + NOSY_IOC_START, then a new client A will be malloced and added to + doubly linked list. + 2. Open nosy device for the second time and call ioctl with command + NOSY_IOC_START, then a new client B will be malloced and added to + doubly linked list. + 3. Call ioctl with command NOSY_IOC_START for client A, then client A + will be readded to the doubly linked list. Now the doubly linked + list is messed up. + 4. Close the first nosy device and nosy_release will be called. In + nosy_release, client A will be unlinked and freed. + 5. Close the second nosy device, and client A will be referenced, + resulting in UAF. + +The root cause of this bug is that the element in the doubly linked list +is reentered into the list. + +Fix this bug by adding a check before inserting a client. If a client +is already in the linked list, don't insert it. + +The following KASAN report reveals it: + + BUG: KASAN: use-after-free in nosy_release+0x1ea/0x210 + Write of size 8 at addr ffff888102ad7360 by task poc + CPU: 3 PID: 337 Comm: poc Not tainted 5.12.0-rc5+ #6 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 + Call Trace: + nosy_release+0x1ea/0x210 + __fput+0x1e2/0x840 + task_work_run+0xe8/0x180 + exit_to_user_mode_prepare+0x114/0x120 + syscall_exit_to_user_mode+0x1d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + Allocated by task 337: + nosy_open+0x154/0x4d0 + misc_open+0x2ec/0x410 + chrdev_open+0x20d/0x5a0 + do_dentry_open+0x40f/0xe80 + path_openat+0x1cf9/0x37b0 + do_filp_open+0x16d/0x390 + do_sys_openat2+0x11d/0x360 + __x64_sys_open+0xfd/0x1a0 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + Freed by task 337: + kfree+0x8f/0x210 + nosy_release+0x158/0x210 + __fput+0x1e2/0x840 + task_work_run+0xe8/0x180 + exit_to_user_mode_prepare+0x114/0x120 + syscall_exit_to_user_mode+0x1d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + The buggy address belongs to the object at ffff888102ad7300 which belongs to the cache kmalloc-128 of size 128 + The buggy address is located 96 bytes inside of 128-byte region [ffff888102ad7300, ffff888102ad7380) + +[ Modified to use 'list_empty()' inside proper lock - Linus ] + +Link: https://lore.kernel.org/lkml/1617433116-5930-1-git-send-email-zheyuma97@gmail.com/ +Reported-and-tested-by: 马哲宇 (Zheyu Ma) +Signed-off-by: Zheyu Ma +Cc: Greg Kroah-Hartman +Cc: Stefan Richter +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/firewire/nosy.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c +index 5fd6a60b6741..88ed971e32c0 100644 +--- a/drivers/firewire/nosy.c ++++ b/drivers/firewire/nosy.c +@@ -346,6 +346,7 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + struct client *client = file->private_data; + spinlock_t *client_list_lock = &client->lynx->client_list_lock; + struct nosy_stats stats; ++ int ret; + + switch (cmd) { + case NOSY_IOC_GET_STATS: +@@ -360,11 +361,15 @@ nosy_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + return 0; + + case NOSY_IOC_START: ++ ret = -EBUSY; + spin_lock_irq(client_list_lock); +- list_add_tail(&client->link, &client->lynx->client_list); ++ if (list_empty(&client->link)) { ++ list_add_tail(&client->link, &client->lynx->client_list); ++ ret = 0; ++ } + spin_unlock_irq(client_list_lock); + +- return 0; ++ return ret; + + case NOSY_IOC_STOP: + spin_lock_irq(client_list_lock); +-- +2.30.2 + diff --git a/queue-5.10/firmware-stratix10-svc-reset-command_reconfig_flag_p.patch b/queue-5.10/firmware-stratix10-svc-reset-command_reconfig_flag_p.patch new file mode 100644 index 00000000000..3ac0a232ca0 --- /dev/null +++ b/queue-5.10/firmware-stratix10-svc-reset-command_reconfig_flag_p.patch @@ -0,0 +1,37 @@ +From 23196ce40a5a5ce98e7237d2703bd4f3a04784a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 16:20:27 -0600 +Subject: firmware: stratix10-svc: reset COMMAND_RECONFIG_FLAG_PARTIAL to 0 + +From: Richard Gong + +[ Upstream commit 2e8496f31d0be8f43849b2980b069f3a9805d047 ] + +Clean up COMMAND_RECONFIG_FLAG_PARTIAL flag by resetting it to 0, which +aligns with the firmware settings. + +Fixes: 36847f9e3e56 ("firmware: stratix10-svc: correct reconfig flag and timeout values") +Signed-off-by: Richard Gong +Reviewed-by: Tom Rix +Signed-off-by: Moritz Fischer +Signed-off-by: Sasha Levin +--- + include/linux/firmware/intel/stratix10-svc-client.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/firmware/intel/stratix10-svc-client.h b/include/linux/firmware/intel/stratix10-svc-client.h +index a93d85932eb9..f843c6a10cf3 100644 +--- a/include/linux/firmware/intel/stratix10-svc-client.h ++++ b/include/linux/firmware/intel/stratix10-svc-client.h +@@ -56,7 +56,7 @@ + * COMMAND_RECONFIG_FLAG_PARTIAL: + * Set to FPGA configuration type (full or partial). + */ +-#define COMMAND_RECONFIG_FLAG_PARTIAL 1 ++#define COMMAND_RECONFIG_FLAG_PARTIAL 0 + + /** + * Timeout settings for service clients: +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series index f8ecd4f8b80..974415213be 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -97,3 +97,9 @@ kvm-x86-mmu-use-atomic-ops-to-set-sptes-in-tdp-mmu-m.patch kvm-x86-compile-out-tdp-mmu-on-32-bit-systems.patch kvm-x86-mmu-ensure-tlbs-are-flushed-for-tdp-mmu-duri.patch kbuild-add-resolve_btfids-clean-to-root-clean-target.patch +extcon-add-stubs-for-extcon_register_notifier_all-fu.patch +extcon-fix-error-handling-in-extcon_dev_register.patch +firmware-stratix10-svc-reset-command_reconfig_flag_p.patch +usb-dwc3-pci-enable-dis_ux_susphy_quirk-for-intel-me.patch +video-hyperv_fb-fix-a-double-free-in-hvfb_probe.patch +firewire-nosy-fix-a-use-after-free-bug-in-nosy_ioctl.patch diff --git a/queue-5.10/usb-dwc3-pci-enable-dis_ux_susphy_quirk-for-intel-me.patch b/queue-5.10/usb-dwc3-pci-enable-dis_ux_susphy_quirk-for-intel-me.patch new file mode 100644 index 00000000000..5ef939c26e3 --- /dev/null +++ b/queue-5.10/usb-dwc3-pci-enable-dis_ux_susphy_quirk-for-intel-me.patch @@ -0,0 +1,40 @@ +From f1c479ae7cece0034b98a92a49812e7306968c96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 14:52:44 +0200 +Subject: usb: dwc3: pci: Enable dis_uX_susphy_quirk for Intel Merrifield + +From: Andy Shevchenko + +[ Upstream commit b522f830d35189e0283fa4d5b4b3ef8d7a78cfcb ] + +It seems that on Intel Merrifield platform the USB PHY shouldn't be suspended. +Otherwise it can't be enabled by simply change the cable in the connector. + +Enable corresponding quirk for the platform in question. + +Fixes: e5f4ca3fce90 ("usb: dwc3: ulpi: Fix USB2.0 HS/FS/LS PHY suspend regression") +Suggested-by: Serge Semin +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210322125244.79407-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index bae6a70664c8..598daed8086f 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -118,6 +118,8 @@ static const struct property_entry dwc3_pci_intel_properties[] = { + static const struct property_entry dwc3_pci_mrfld_properties[] = { + PROPERTY_ENTRY_STRING("dr_mode", "otg"), + PROPERTY_ENTRY_STRING("linux,extcon-name", "mrfld_bcove_pwrsrc"), ++ PROPERTY_ENTRY_BOOL("snps,dis_u3_susphy_quirk"), ++ PROPERTY_ENTRY_BOOL("snps,dis_u2_susphy_quirk"), + PROPERTY_ENTRY_BOOL("linux,sysdev_is_parent"), + {} + }; +-- +2.30.2 + diff --git a/queue-5.10/video-hyperv_fb-fix-a-double-free-in-hvfb_probe.patch b/queue-5.10/video-hyperv_fb-fix-a-double-free-in-hvfb_probe.patch new file mode 100644 index 00000000000..c0c3bd9e4e9 --- /dev/null +++ b/queue-5.10/video-hyperv_fb-fix-a-double-free-in-hvfb_probe.patch @@ -0,0 +1,60 @@ +From a58c78691d4cf5881cabe813708b7bde99415da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 03:37:24 -0700 +Subject: video: hyperv_fb: Fix a double free in hvfb_probe + +From: Lv Yunlong + +[ Upstream commit 37df9f3fedb6aeaff5564145e8162aab912c9284 ] + +Function hvfb_probe() calls hvfb_getmem(), expecting upon return that +info->apertures is either NULL or points to memory that should be freed +by framebuffer_release(). But hvfb_getmem() is freeing the memory and +leaving the pointer non-NULL, resulting in a double free if an error +occurs or later if hvfb_remove() is called. + +Fix this by removing all kfree(info->apertures) calls in hvfb_getmem(). +This will allow framebuffer_release() to free the memory, which follows +the pattern of other fbdev drivers. + +Fixes: 3a6fb6c4255c ("video: hyperv: hyperv_fb: Use physical memory for fb on HyperV Gen 1 VMs.") +Signed-off-by: Lv Yunlong +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20210324103724.4189-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/hyperv_fb.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index c8b0ae676809..4dc9077dd2ac 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -1031,7 +1031,6 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + PCI_DEVICE_ID_HYPERV_VIDEO, NULL); + if (!pdev) { + pr_err("Unable to find PCI Hyper-V video\n"); +- kfree(info->apertures); + return -ENODEV; + } + +@@ -1129,7 +1128,6 @@ getmem_done: + } else { + pci_dev_put(pdev); + } +- kfree(info->apertures); + + return 0; + +@@ -1141,7 +1139,6 @@ err2: + err1: + if (!gen2vm) + pci_dev_put(pdev); +- kfree(info->apertures); + + return -ENOMEM; + } +-- +2.30.2 +