From: Greg Kroah-Hartman Date: Mon, 1 Jul 2024 14:28:28 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.19.317~81 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=47c2526bff90681eff26edc330d4cc05699ba28f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_hd_modes.patch drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_ld_modes.patch hexagon-fix-fadvise64_64-calling-conventions.patch tty-mcf-mcf54418-has-10-uarts.patch --- diff --git a/queue-4.19/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_hd_modes.patch b/queue-4.19/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_hd_modes.patch new file mode 100644 index 00000000000..4a9e1e965dc --- /dev/null +++ b/queue-4.19/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_hd_modes.patch @@ -0,0 +1,43 @@ +From 6d411c8ccc0137a612e0044489030a194ff5c843 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Tue, 25 Jun 2024 16:10:29 +0800 +Subject: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes + +From: Ma Ke + +commit 6d411c8ccc0137a612e0044489030a194ff5c843 upstream. + +In nv17_tv_get_hd_modes(), the return value of drm_mode_duplicate() is +assigned to mode, which will lead to a possible NULL pointer dereference +on failure of drm_mode_duplicate(). The same applies to drm_cvt_mode(). +Add a check to avoid null pointer dereference. + +Cc: stable@vger.kernel.org +Signed-off-by: Ma Ke +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20240625081029.2619437-1-make24@iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +@@ -259,6 +259,8 @@ static int nv17_tv_get_hd_modes(struct d + if (modes[i].hdisplay == output_mode->hdisplay && + modes[i].vdisplay == output_mode->vdisplay) { + mode = drm_mode_duplicate(encoder->dev, output_mode); ++ if (!mode) ++ continue; + mode->type |= DRM_MODE_TYPE_PREFERRED; + + } else { +@@ -266,6 +268,8 @@ static int nv17_tv_get_hd_modes(struct d + modes[i].vdisplay, 60, false, + (output_mode->flags & + DRM_MODE_FLAG_INTERLACE), false); ++ if (!mode) ++ continue; + } + + /* CVT modes are sometimes unsuitable... */ diff --git a/queue-4.19/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_ld_modes.patch b/queue-4.19/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_ld_modes.patch new file mode 100644 index 00000000000..fe6ba361dd9 --- /dev/null +++ b/queue-4.19/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_ld_modes.patch @@ -0,0 +1,33 @@ +From 66edf3fb331b6c55439b10f9862987b0916b3726 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Tue, 25 Jun 2024 16:18:28 +0800 +Subject: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes + +From: Ma Ke + +commit 66edf3fb331b6c55439b10f9862987b0916b3726 upstream. + +In nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is +assigned to mode, which will lead to a possible NULL pointer dereference +on failure of drm_mode_duplicate(). Add a check to avoid npd. + +Cc: stable@vger.kernel.org +Signed-off-by: Ma Ke +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20240625081828.2620794-1-make24@iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +@@ -208,6 +208,8 @@ static int nv17_tv_get_ld_modes(struct d + struct drm_display_mode *mode; + + mode = drm_mode_duplicate(encoder->dev, tv_mode); ++ if (!mode) ++ continue; + + mode->clock = tv_norm->tv_enc_mode.vrefresh * + mode->htotal / 1000 * diff --git a/queue-4.19/hexagon-fix-fadvise64_64-calling-conventions.patch b/queue-4.19/hexagon-fix-fadvise64_64-calling-conventions.patch new file mode 100644 index 00000000000..b9529620434 --- /dev/null +++ b/queue-4.19/hexagon-fix-fadvise64_64-calling-conventions.patch @@ -0,0 +1,52 @@ +From 896842284c6ccba25ec9d78b7b6e62cdd507c083 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 20 Jun 2024 15:24:11 +0200 +Subject: hexagon: fix fadvise64_64 calling conventions + +From: Arnd Bergmann + +commit 896842284c6ccba25ec9d78b7b6e62cdd507c083 upstream. + +fadvise64_64() has two 64-bit arguments at the wrong alignment +for hexagon, which turns them into a 7-argument syscall that is +not supported by Linux. + +The downstream musl port for hexagon actually asks for a 6-argument +version the same way we do it on arm, csky, powerpc, so make the +kernel do it the same way to avoid having to change both. + +Link: https://github.com/quic/musl/blob/hexagon/arch/hexagon/syscall_arch.h#L78 +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + arch/hexagon/include/asm/syscalls.h | 6 ++++++ + arch/hexagon/kernel/syscalltab.c | 7 +++++++ + 2 files changed, 13 insertions(+) + create mode 100644 arch/hexagon/include/asm/syscalls.h + +--- /dev/null ++++ b/arch/hexagon/include/asm/syscalls.h +@@ -0,0 +1,6 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++ ++#include ++ ++asmlinkage long sys_hexagon_fadvise64_64(int fd, int advice, ++ u32 a2, u32 a3, u32 a4, u32 a5); +--- a/arch/hexagon/kernel/syscalltab.c ++++ b/arch/hexagon/kernel/syscalltab.c +@@ -27,6 +27,13 @@ + #undef __SYSCALL + #define __SYSCALL(nr, call) [nr] = (call), + ++SYSCALL_DEFINE6(hexagon_fadvise64_64, int, fd, int, advice, ++ SC_ARG64(offset), SC_ARG64(len)) ++{ ++ return ksys_fadvise64_64(fd, SC_VAL64(loff_t, offset), SC_VAL64(loff_t, len), advice); ++} ++#define sys_fadvise64_64 sys_hexagon_fadvise64_64 ++ + void *sys_call_table[__NR_syscalls] = { + #include + }; diff --git a/queue-4.19/series b/queue-4.19/series index 0385f6d3514..762498f34d0 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -137,3 +137,7 @@ usb-gadget-printer-ss-support.patch usb-musb-da8xx-fix-a-resource-leak-in-probe.patch usb-atm-cxacru-fix-endpoint-checking-in-cxacru_bind.patch serial-imx-set-receiver-level-before-starting-uart.patch +tty-mcf-mcf54418-has-10-uarts.patch +hexagon-fix-fadvise64_64-calling-conventions.patch +drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_ld_modes.patch +drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_hd_modes.patch diff --git a/queue-4.19/tty-mcf-mcf54418-has-10-uarts.patch b/queue-4.19/tty-mcf-mcf54418-has-10-uarts.patch new file mode 100644 index 00000000000..03ad384fa79 --- /dev/null +++ b/queue-4.19/tty-mcf-mcf54418-has-10-uarts.patch @@ -0,0 +1,32 @@ +From 7c92a8bd53f24d50c8cf4aba53bb75505b382fed Mon Sep 17 00:00:00 2001 +From: Jean-Michel Hautbois +Date: Thu, 20 Jun 2024 18:29:59 +0200 +Subject: tty: mcf: MCF54418 has 10 UARTS + +From: Jean-Michel Hautbois + +commit 7c92a8bd53f24d50c8cf4aba53bb75505b382fed upstream. + +Most of the colfires have up to 5 UARTs but MCF54418 has up-to 10 ! +Change the maximum value authorized. + +Signed-off-by: Jean-Michel Hautbois +Cc: stable +Fixes: 2545cf6e94b4 ("m68knommu: allow 4 coldfire serial ports") +Link: https://lore.kernel.org/r/20240620-upstream-uart-v1-1-a9d0d95fb19e@yoseli.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/mcf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/mcf.c ++++ b/drivers/tty/serial/mcf.c +@@ -479,7 +479,7 @@ static const struct uart_ops mcf_uart_op + .verify_port = mcf_verify_port, + }; + +-static struct mcf_uart mcf_ports[4]; ++static struct mcf_uart mcf_ports[10]; + + #define MCF_MAXPORTS ARRAY_SIZE(mcf_ports) +