From: Sasha Levin Date: Sun, 4 Dec 2022 02:26:52 +0000 (-0500) Subject: Fixes for 4.9 X-Git-Tag: v4.9.335~52 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ebfbe12094c731e5920fee2f475c79cc7f409668;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/asoc-ops-fix-bounds-check-for-_sx-controls.patch b/queue-4.9/asoc-ops-fix-bounds-check-for-_sx-controls.patch new file mode 100644 index 00000000000..2194bbf244c --- /dev/null +++ b/queue-4.9/asoc-ops-fix-bounds-check-for-_sx-controls.patch @@ -0,0 +1,39 @@ +From 77e780cb8461bd7c08da42e8fd28efc9b526fd48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 14:41:36 +0100 +Subject: ASoC: ops: Fix bounds check for _sx controls + +From: Mark Brown + +[ Upstream commit 698813ba8c580efb356ace8dbf55f61dac6063a8 ] + +For _sx controls the semantics of the max field is not the usual one, max +is the number of steps rather than the maximum value. This means that our +check in snd_soc_put_volsw_sx() needs to just check against the maximum +value. + +Fixes: 4f1e50d6a9cf9c1b ("ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()") +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220511134137.169575-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c +index 4fda8c24be29..5479927391d4 100644 +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -450,7 +450,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, + val = ucontrol->value.integer.value[0]; + if (mc->platform_max && val > mc->platform_max) + return -EINVAL; +- if (val > max - min) ++ if (val > max) + return -EINVAL; + if (val < 0) + return -EINVAL; +-- +2.35.1 + diff --git a/queue-4.9/iommu-vt-d-fix-pci-device-refcount-leak-in-dmar_dev_.patch b/queue-4.9/iommu-vt-d-fix-pci-device-refcount-leak-in-dmar_dev_.patch new file mode 100644 index 00000000000..432080f61b0 --- /dev/null +++ b/queue-4.9/iommu-vt-d-fix-pci-device-refcount-leak-in-dmar_dev_.patch @@ -0,0 +1,43 @@ +From f8af98acaa095eea4228c5f9d71394367f26c35b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 12:01:27 +0800 +Subject: iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() + +From: Xiongfeng Wang + +[ Upstream commit 4bedbbd782ebbe7287231fea862c158d4f08a9e3 ] + +for_each_pci_dev() is implemented by pci_get_device(). The comment of +pci_get_device() says that it will increase the reference count for the +returned pci_dev and also decrease the reference count for the input +pci_dev @from if it is not NULL. + +If we break for_each_pci_dev() loop with pdev not NULL, we need to call +pci_dev_put() to decrease the reference count. Add the missing +pci_dev_put() for the error path to avoid reference count leak. + +Fixes: 2e4552893038 ("iommu/vt-d: Unify the way to process DMAR device scope array") +Signed-off-by: Xiongfeng Wang +Link: https://lore.kernel.org/r/20221121113649.190393-3-wangxiongfeng2@huawei.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/dmar.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index d8b8cf36de31..fb03616f9ade 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -803,6 +803,7 @@ int __init dmar_dev_scope_init(void) + info = dmar_alloc_pci_notify_info(dev, + BUS_NOTIFY_ADD_DEVICE); + if (!info) { ++ pci_dev_put(dev); + return dmar_dev_scope_status; + } else { + dmar_pci_bus_add_dev(info); +-- +2.35.1 + diff --git a/queue-4.9/pinctrl-single-fix-potential-division-by-zero.patch b/queue-4.9/pinctrl-single-fix-potential-division-by-zero.patch new file mode 100644 index 00000000000..abd14201f5d --- /dev/null +++ b/queue-4.9/pinctrl-single-fix-potential-division-by-zero.patch @@ -0,0 +1,43 @@ +From a90c986ffd5831e5f23ddb49adbacb17905500f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 15:30:34 +0300 +Subject: pinctrl: single: Fix potential division by zero + +From: Maxim Korotkov + +[ Upstream commit 64c150339e7f6c5cbbe8c17a56ef2b3902612798 ] + +There is a possibility of dividing by zero due to the pcs->bits_per_pin +if pcs->fmask() also has a value of zero and called fls +from asm-generic/bitops/builtin-fls.h or arch/x86/include/asm/bitops.h. +The function pcs_probe() has the branch that assigned to fmask 0 before +pcs_allocate_pin_table() was called + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 4e7e8017a80e ("pinctrl: pinctrl-single: enhance to configure multiple pins of different modules") +Signed-off-by: Maxim Korotkov +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20221117123034.27383-1-korotkov.maxim.s@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-single.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index 01f42090cd03..d2180bf2da95 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -812,7 +812,7 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs) + + mux_bytes = pcs->width / BITS_PER_BYTE; + +- if (pcs->bits_per_mux) { ++ if (pcs->bits_per_mux && pcs->fmask) { + pcs->bits_per_pin = fls(pcs->fmask); + nr_pins = (pcs->size * BITS_PER_BYTE) / pcs->bits_per_pin; + num_pins_in_register = pcs->width / pcs->bits_per_pin; +-- +2.35.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 154ac11d064..d0d5c061b45 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -50,3 +50,6 @@ nilfs2-fix-null-pointer-dereference-in-nilfs_palloc_commit_free_entry.patch arm64-fix-panic-when-spectre-v2-causes-spectre-bhb-to-re-allocate-kvm-vectors.patch arm64-errata-fix-kvm-spectre-v2-mitigation-selection-for-cortex-a57-a72.patch mm-fix-.data.once-orphan-section-warning.patch +asoc-ops-fix-bounds-check-for-_sx-controls.patch +pinctrl-single-fix-potential-division-by-zero.patch +iommu-vt-d-fix-pci-device-refcount-leak-in-dmar_dev_.patch