From: Greg Kroah-Hartman Date: Sun, 10 Sep 2023 10:38:01 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v6.1.53~53 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9dbfbfb8a6eac8be1a5f52ef94975dc229a7971a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch --- diff --git a/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch new file mode 100644 index 00000000000..9f0889d729a --- /dev/null +++ b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch @@ -0,0 +1,64 @@ +From e520d0b6be950ce3738cf4b9bd3b392be818f1dc Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Mon, 31 Jul 2023 21:15:48 -0600 +Subject: cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug + +From: Gustavo A. R. Silva + +commit e520d0b6be950ce3738cf4b9bd3b392be818f1dc upstream. + +Allocate extra space for terminating element at: + +drivers/cpufreq/brcmstb-avs-cpufreq.c: +449 table[i].frequency = CPUFREQ_TABLE_END; + +and add code comment to make this clear. + +This fixes the following -Warray-bounds warning seen after building +ARM with multi_v7_defconfig (GCC 13): +In function 'brcm_avs_get_freq_table', + inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15: +drivers/cpufreq/brcmstb-avs-cpufreq.c:449:28: warning: array subscript 5 is outside array bounds of 'void[60]' [-Warray-bounds=] + 449 | table[i].frequency = CPUFREQ_TABLE_END; +In file included from include/linux/node.h:18, + from include/linux/cpu.h:17, + from include/linux/cpufreq.h:12, + from drivers/cpufreq/brcmstb-avs-cpufreq.c:44: +In function 'devm_kmalloc_array', + inlined from 'devm_kcalloc' at include/linux/device.h:328:9, + inlined from 'brcm_avs_get_freq_table' at drivers/cpufreq/brcmstb-avs-cpufreq.c:437:10, + inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15: +include/linux/device.h:323:16: note: at offset 60 into object of size 60 allocated by 'devm_kmalloc' + 323 | return devm_kmalloc(dev, bytes, flags); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This helps with the ongoing efforts to tighten the FORTIFY_SOURCE +routines on memcpy() and help us make progress towards globally +enabling -Warray-bounds. + +Link: https://github.com/KSPP/linux/issues/324 +Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs") +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Florian Fainelli +Signed-off-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -410,7 +410,11 @@ brcm_avs_get_freq_table(struct device *d + if (ret) + return ERR_PTR(ret); + +- table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1, sizeof(*table), ++ /* ++ * We allocate space for the 5 different P-STATES AVS, ++ * plus extra space for a terminating element. ++ */ ++ table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1 + 1, sizeof(*table), + GFP_KERNEL); + if (!table) + return ERR_PTR(-ENOMEM); diff --git a/queue-4.19/crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch b/queue-4.19/crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch new file mode 100644 index 00000000000..83367cf753d --- /dev/null +++ b/queue-4.19/crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch @@ -0,0 +1,37 @@ +From d9c83f71eeceed2cb54bb78be84f2d4055fd9a1f Mon Sep 17 00:00:00 2001 +From: Thomas Bourgoin +Date: Thu, 13 Jul 2023 17:15:15 +0200 +Subject: crypto: stm32 - fix loop iterating through scatterlist for DMA + +From: Thomas Bourgoin + +commit d9c83f71eeceed2cb54bb78be84f2d4055fd9a1f upstream. + +We were reading the length of the scatterlist sg after copying value of +tsg inside. +So we are using the size of the previous scatterlist and for the first +one we are using an unitialised value. +Fix this by copying tsg in sg[0] before reading the size. + +Fixes : 8a1012d3f2ab ("crypto: stm32 - Support for STM32 HASH module") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Bourgoin +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/stm32/stm32-hash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/stm32/stm32-hash.c ++++ b/drivers/crypto/stm32/stm32-hash.c +@@ -578,9 +578,9 @@ static int stm32_hash_dma_send(struct st + } + + for_each_sg(rctx->sg, tsg, rctx->nents, i) { ++ sg[0] = *tsg; + len = sg->length; + +- sg[0] = *tsg; + if (sg_is_last(sg)) { + if (hdev->dma_mode == 1) { + len = (ALIGN(sg->length, 16) - 16); diff --git a/queue-4.19/series b/queue-4.19/series index aeb58f26cf9..4308ec7e4b4 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -184,6 +184,8 @@ procfs-block-chmod-on-proc-thread-self-comm.patch parisc-fix-proc-cpuinfo-output-for-lscpu.patch dlm-fix-plock-lookup-when-using-multiple-lockspaces.patch dccp-fix-out-of-bounds-access-in-dccp-error-handler.patch +crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch +cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch x.509-if-signature-is-unsupported-skip-validation.patch net-handle-arphrd_ppp-in-dev_is_mac_header_xmit.patch pstore-ram-check-start-of-empty-przs-during-init.patch