From: Greg Kroah-Hartman Date: Mon, 9 Dec 2019 12:34:22 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v5.4.3~57 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6eb9bfff845a6c2975bdeed52bc6227398cc8471;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-pcm-oss-avoid-potential-buffer-overflows.patch input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch --- diff --git a/queue-4.4/alsa-pcm-oss-avoid-potential-buffer-overflows.patch b/queue-4.4/alsa-pcm-oss-avoid-potential-buffer-overflows.patch new file mode 100644 index 00000000000..2156367ac72 --- /dev/null +++ b/queue-4.4/alsa-pcm-oss-avoid-potential-buffer-overflows.patch @@ -0,0 +1,64 @@ +From 4cc8d6505ab82db3357613d36e6c58a297f57f7c Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 4 Dec 2019 15:48:24 +0100 +Subject: ALSA: pcm: oss: Avoid potential buffer overflows + +From: Takashi Iwai + +commit 4cc8d6505ab82db3357613d36e6c58a297f57f7c upstream. + +syzkaller reported an invalid access in PCM OSS read, and this seems +to be an overflow of the internal buffer allocated for a plugin. +Since the rate plugin adjusts its transfer size dynamically, the +calculation for the chained plugin might be bigger than the given +buffer size in some extreme cases, which lead to such an buffer +overflow as caught by KASAN. + +Fix it by limiting the max transfer size properly by checking against +the destination size in each plugin transfer callback. + +Reported-by: syzbot+f153bde47a62e0b05f83@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20191204144824.17801-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/linear.c | 2 ++ + sound/core/oss/mulaw.c | 2 ++ + sound/core/oss/route.c | 2 ++ + 3 files changed, 6 insertions(+) + +--- a/sound/core/oss/linear.c ++++ b/sound/core/oss/linear.c +@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + convert(plugin, src_channels, dst_channels, frames); + return frames; + } +--- a/sound/core/oss/mulaw.c ++++ b/sound/core/oss/mulaw.c +@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer( + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + data = (struct mulaw_priv *)plugin->extra_data; + data->func(plugin, src_channels, dst_channels, frames); + return frames; +--- a/sound/core/oss/route.c ++++ b/sound/core/oss/route.c +@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer( + return -ENXIO; + if (frames == 0) + return 0; ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + + nsrcs = plugin->src_format.channels; + ndsts = plugin->dst_format.channels; diff --git a/queue-4.4/input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch b/queue-4.4/input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch new file mode 100644 index 00000000000..93ff4ca97b2 --- /dev/null +++ b/queue-4.4/input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch @@ -0,0 +1,43 @@ +From df5b5e555b356662a5e4a23c6774fdfce8547d54 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 2 Dec 2019 09:36:15 -0800 +Subject: Input: goodix - add upside-down quirk for Teclast X89 tablet + +From: Hans de Goede + +commit df5b5e555b356662a5e4a23c6774fdfce8547d54 upstream. + +The touchscreen on the Teclast X89 is mounted upside down in relation to +the display orientation (the touchscreen itself is mounted upright, but the +display is mounted upside-down). Add a quirk for this so that we send +coordinates which match the display orientation. + +Signed-off-by: Hans de Goede +Reviewed-by: Bastien Nocera +Link: https://lore.kernel.org/r/20191202085636.6650-1-hdegoede@redhat.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/goodix.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -69,6 +69,15 @@ static const unsigned long goodix_irq_fl + static const struct dmi_system_id rotated_screen[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) + { ++ .ident = "Teclast X89", ++ .matches = { ++ /* tPAD is too generic, also match on bios date */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BOARD_NAME, "tPAD"), ++ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), ++ }, ++ }, ++ { + .ident = "WinBook TW100", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "WinBook"), diff --git a/queue-4.4/series b/queue-4.4/series index 27f2f03c66c..0836baf36eb 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -53,3 +53,5 @@ arm-dts-sunxi-fix-pmu-compatible-strings.patch sched-fair-scale-bandwidth-quota-and-period-without-losing-quota-period-ratio-precision.patch fuse-verify-nlink.patch fuse-verify-attributes.patch +alsa-pcm-oss-avoid-potential-buffer-overflows.patch +input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch