From 522d5f0eae48fc94c5a89a9d543533ef2090ab93 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 10 Jan 2023 17:01:44 +0100 Subject: [PATCH] 6.1-stable patches added patches: drm-i915-dsi-add-support-for-icl-native-mipi-gpio-sequence.patch drm-i915-dsi-fix-mipi_bklt_en_1-native-gpio-index.patch ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch ksmbd-send-proper-error-response-in-smb2_tree_connect.patch --- ...rt-for-icl-native-mipi-gpio-sequence.patch | 206 ++++++++++++++++++ ...fix-mipi_bklt_en_1-native-gpio-index.patch | 39 ++++ ...ze-in-ksmbd_decode_ntlmssp_auth_blob.patch | 41 ++++ ...nite-loop-in-ksmbd_conn_handler_loop.patch | 69 ++++++ ...-error-response-in-smb2_tree_connect.patch | 53 +++++ queue-6.1/series | 5 + 6 files changed, 413 insertions(+) create mode 100644 queue-6.1/drm-i915-dsi-add-support-for-icl-native-mipi-gpio-sequence.patch create mode 100644 queue-6.1/drm-i915-dsi-fix-mipi_bklt_en_1-native-gpio-index.patch create mode 100644 queue-6.1/ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch create mode 100644 queue-6.1/ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch create mode 100644 queue-6.1/ksmbd-send-proper-error-response-in-smb2_tree_connect.patch diff --git a/queue-6.1/drm-i915-dsi-add-support-for-icl-native-mipi-gpio-sequence.patch b/queue-6.1/drm-i915-dsi-add-support-for-icl-native-mipi-gpio-sequence.patch new file mode 100644 index 00000000000..a33c338dd59 --- /dev/null +++ b/queue-6.1/drm-i915-dsi-add-support-for-icl-native-mipi-gpio-sequence.patch @@ -0,0 +1,206 @@ +From 963bbdb32b47cfa67a449e715e1dcc525fbd01fc Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Mon, 19 Dec 2022 12:59:55 +0200 +Subject: drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 963bbdb32b47cfa67a449e715e1dcc525fbd01fc upstream. + +Starting from ICL, the default for MIPI GPIO sequences seems to be using +native GPIOs i.e. GPIOs available in the GPU. These native GPIOs reuse +many pins that quite frankly seem scary to poke based on the VBT +sequences. We pretty much have to trust that the board is configured +such that the relevant HPD, PP_CONTROL and GPIO bits aren't used for +anything else. + +MIPI sequence v4 also adds a flag to fall back to non-native sequences. + +v5: +- Wrap SHOTPLUG_CTL_DDI modification in spin_lock() in icp_irq_handler() + too (Ville) +- References instead of Closes issue 6131 because this does not fix everything + +v4: +- Wrap SHOTPLUG_CTL_DDI modification in spin_lock_irq() (Ville) + +v3: +- Fix -Wbitwise-conditional-parentheses (kernel test robot ) + +v2: +- Fix HPD pin output set (impacts GPIOs 0 and 5) +- Fix GPIO data output direction set (impacts GPIOs 4 and 9) +- Reduce register accesses to single intel_de_rwm() + +References: https://gitlab.freedesktop.org/drm/intel/-/issues/6131 +Cc: Ville Syrjälä +Signed-off-by: Jani Nikula +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221219105955.4014451-1-jani.nikula@intel.com +(cherry picked from commit f087cfe6fcff58044f7aa3b284965af47f472fb0) +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 94 ++++++++++++++++++++++++++- + drivers/gpu/drm/i915/i915_irq.c | 3 + drivers/gpu/drm/i915/i915_reg.h | 1 + 3 files changed, 95 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c ++++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c +@@ -41,9 +41,11 @@ + + #include "i915_drv.h" + #include "i915_reg.h" ++#include "intel_de.h" + #include "intel_display_types.h" + #include "intel_dsi.h" + #include "intel_dsi_vbt.h" ++#include "intel_gmbus_regs.h" + #include "vlv_dsi.h" + #include "vlv_dsi_regs.h" + #include "vlv_sideband.h" +@@ -377,6 +379,85 @@ static void icl_exec_gpio(struct intel_c + drm_dbg_kms(&dev_priv->drm, "Skipping ICL GPIO element execution\n"); + } + ++enum { ++ MIPI_RESET_1 = 0, ++ MIPI_AVDD_EN_1, ++ MIPI_BKLT_EN_1, ++ MIPI_AVEE_EN_1, ++ MIPI_VIO_EN_1, ++ MIPI_RESET_2, ++ MIPI_AVDD_EN_2, ++ MIPI_BKLT_EN_2, ++ MIPI_AVEE_EN_2, ++ MIPI_VIO_EN_2, ++}; ++ ++static void icl_native_gpio_set_value(struct drm_i915_private *dev_priv, ++ int gpio, bool value) ++{ ++ int index; ++ ++ if (drm_WARN_ON(&dev_priv->drm, DISPLAY_VER(dev_priv) == 11 && gpio >= MIPI_RESET_2)) ++ return; ++ ++ switch (gpio) { ++ case MIPI_RESET_1: ++ case MIPI_RESET_2: ++ index = gpio == MIPI_RESET_1 ? HPD_PORT_A : HPD_PORT_B; ++ ++ /* ++ * Disable HPD to set the pin to output, and set output ++ * value. The HPD pin should not be enabled for DSI anyway, ++ * assuming the board design and VBT are sane, and the pin isn't ++ * used by a non-DSI encoder. ++ * ++ * The locking protects against concurrent SHOTPLUG_CTL_DDI ++ * modifications in irq setup and handling. ++ */ ++ spin_lock_irq(&dev_priv->irq_lock); ++ intel_de_rmw(dev_priv, SHOTPLUG_CTL_DDI, ++ SHOTPLUG_CTL_DDI_HPD_ENABLE(index) | ++ SHOTPLUG_CTL_DDI_HPD_OUTPUT_DATA(index), ++ value ? SHOTPLUG_CTL_DDI_HPD_OUTPUT_DATA(index) : 0); ++ spin_unlock_irq(&dev_priv->irq_lock); ++ break; ++ case MIPI_AVDD_EN_1: ++ case MIPI_AVDD_EN_2: ++ index = gpio == MIPI_AVDD_EN_1 ? 0 : 1; ++ ++ intel_de_rmw(dev_priv, PP_CONTROL(index), PANEL_POWER_ON, ++ value ? PANEL_POWER_ON : 0); ++ break; ++ case MIPI_BKLT_EN_1: ++ case MIPI_BKLT_EN_2: ++ index = gpio == MIPI_AVDD_EN_1 ? 0 : 1; ++ ++ intel_de_rmw(dev_priv, PP_CONTROL(index), EDP_BLC_ENABLE, ++ value ? EDP_BLC_ENABLE : 0); ++ break; ++ case MIPI_AVEE_EN_1: ++ case MIPI_AVEE_EN_2: ++ index = gpio == MIPI_AVEE_EN_1 ? 1 : 2; ++ ++ intel_de_rmw(dev_priv, GPIO(dev_priv, index), ++ GPIO_CLOCK_VAL_OUT, ++ GPIO_CLOCK_DIR_MASK | GPIO_CLOCK_DIR_OUT | ++ GPIO_CLOCK_VAL_MASK | (value ? GPIO_CLOCK_VAL_OUT : 0)); ++ break; ++ case MIPI_VIO_EN_1: ++ case MIPI_VIO_EN_2: ++ index = gpio == MIPI_VIO_EN_1 ? 1 : 2; ++ ++ intel_de_rmw(dev_priv, GPIO(dev_priv, index), ++ GPIO_DATA_VAL_OUT, ++ GPIO_DATA_DIR_MASK | GPIO_DATA_DIR_OUT | ++ GPIO_DATA_VAL_MASK | (value ? GPIO_DATA_VAL_OUT : 0)); ++ break; ++ default: ++ MISSING_CASE(gpio); ++ } ++} ++ + static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data) + { + struct drm_device *dev = intel_dsi->base.base.dev; +@@ -384,8 +465,7 @@ static const u8 *mipi_exec_gpio(struct i + struct intel_connector *connector = intel_dsi->attached_connector; + u8 gpio_source, gpio_index = 0, gpio_number; + bool value; +- +- drm_dbg_kms(&dev_priv->drm, "\n"); ++ bool native = DISPLAY_VER(dev_priv) >= 11; + + if (connector->panel.vbt.dsi.seq_version >= 3) + gpio_index = *data++; +@@ -398,10 +478,18 @@ static const u8 *mipi_exec_gpio(struct i + else + gpio_source = 0; + ++ if (connector->panel.vbt.dsi.seq_version >= 4 && *data & BIT(1)) ++ native = false; ++ + /* pull up/down */ + value = *data++ & 1; + +- if (DISPLAY_VER(dev_priv) >= 11) ++ drm_dbg_kms(&dev_priv->drm, "GPIO index %u, number %u, source %u, native %s, set to %s\n", ++ gpio_index, gpio_number, gpio_source, str_yes_no(native), str_on_off(value)); ++ ++ if (native) ++ icl_native_gpio_set_value(dev_priv, gpio_number, value); ++ else if (DISPLAY_VER(dev_priv) >= 11) + icl_exec_gpio(connector, gpio_source, gpio_index, value); + else if (IS_VALLEYVIEW(dev_priv)) + vlv_exec_gpio(connector, gpio_source, gpio_number, value); +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -1981,8 +1981,11 @@ static void icp_irq_handler(struct drm_i + if (ddi_hotplug_trigger) { + u32 dig_hotplug_reg; + ++ /* Locking due to DSI native GPIO sequences */ ++ spin_lock(&dev_priv->irq_lock); + dig_hotplug_reg = intel_uncore_read(&dev_priv->uncore, SHOTPLUG_CTL_DDI); + intel_uncore_write(&dev_priv->uncore, SHOTPLUG_CTL_DDI, dig_hotplug_reg); ++ spin_unlock(&dev_priv->irq_lock); + + intel_get_hpd_pins(dev_priv, &pin_mask, &long_mask, + ddi_hotplug_trigger, dig_hotplug_reg, +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -6035,6 +6035,7 @@ + + #define SHOTPLUG_CTL_DDI _MMIO(0xc4030) + #define SHOTPLUG_CTL_DDI_HPD_ENABLE(hpd_pin) (0x8 << (_HPD_PIN_DDI(hpd_pin) * 4)) ++#define SHOTPLUG_CTL_DDI_HPD_OUTPUT_DATA(hpd_pin) (0x4 << (_HPD_PIN_DDI(hpd_pin) * 4)) + #define SHOTPLUG_CTL_DDI_HPD_STATUS_MASK(hpd_pin) (0x3 << (_HPD_PIN_DDI(hpd_pin) * 4)) + #define SHOTPLUG_CTL_DDI_HPD_NO_DETECT(hpd_pin) (0x0 << (_HPD_PIN_DDI(hpd_pin) * 4)) + #define SHOTPLUG_CTL_DDI_HPD_SHORT_DETECT(hpd_pin) (0x1 << (_HPD_PIN_DDI(hpd_pin) * 4)) diff --git a/queue-6.1/drm-i915-dsi-fix-mipi_bklt_en_1-native-gpio-index.patch b/queue-6.1/drm-i915-dsi-fix-mipi_bklt_en_1-native-gpio-index.patch new file mode 100644 index 00000000000..820f90bc235 --- /dev/null +++ b/queue-6.1/drm-i915-dsi-fix-mipi_bklt_en_1-native-gpio-index.patch @@ -0,0 +1,39 @@ +From 6217e9f05a74df48c77ee68993d587cdfdb1feb7 Mon Sep 17 00:00:00 2001 +From: Jani Nikula +Date: Tue, 20 Dec 2022 16:01:05 +0200 +Subject: drm/i915/dsi: fix MIPI_BKLT_EN_1 native GPIO index +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jani Nikula + +commit 6217e9f05a74df48c77ee68993d587cdfdb1feb7 upstream. + +Due to copy-paste fail, MIPI_BKLT_EN_1 would always use PPS index 1, +never 0. Fix the sloppiest commit in recent memory. + +Fixes: 963bbdb32b47 ("drm/i915/dsi: add support for ICL+ native MIPI GPIO sequence") +Reported-by: Ville Syrjälä +Signed-off-by: Jani Nikula +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221220140105.313333-1-jani.nikula@intel.com +(cherry picked from commit a561933c571798868b5fa42198427a7e6df56c09) +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_dsi_vbt.c ++++ b/drivers/gpu/drm/i915/display/intel_dsi_vbt.c +@@ -430,7 +430,7 @@ static void icl_native_gpio_set_value(st + break; + case MIPI_BKLT_EN_1: + case MIPI_BKLT_EN_2: +- index = gpio == MIPI_AVDD_EN_1 ? 0 : 1; ++ index = gpio == MIPI_BKLT_EN_1 ? 0 : 1; + + intel_de_rmw(dev_priv, PP_CONTROL(index), EDP_BLC_ENABLE, + value ? EDP_BLC_ENABLE : 0); diff --git a/queue-6.1/ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch b/queue-6.1/ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch new file mode 100644 index 00000000000..2ee6ef94cf9 --- /dev/null +++ b/queue-6.1/ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch @@ -0,0 +1,41 @@ +From 797805d81baa814f76cf7bdab35f86408a79d707 Mon Sep 17 00:00:00 2001 +From: William Liu +Date: Fri, 30 Dec 2022 13:03:15 +0900 +Subject: ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: William Liu + +commit 797805d81baa814f76cf7bdab35f86408a79d707 upstream. + +"nt_len - CIFS_ENCPWD_SIZE" is passed directly from +ksmbd_decode_ntlmssp_auth_blob to ksmbd_auth_ntlmv2. Malicious requests +can set nt_len to less than CIFS_ENCPWD_SIZE, which results in a negative +number (or large unsigned value) used for a subsequent memcpy in +ksmbd_auth_ntlvm2 and can cause a panic. + +Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") +Cc: stable@vger.kernel.org +Signed-off-by: William Liu +Signed-off-by: Hrvoje Mišetić +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/auth.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/ksmbd/auth.c ++++ b/fs/ksmbd/auth.c +@@ -322,7 +322,8 @@ int ksmbd_decode_ntlmssp_auth_blob(struc + dn_off = le32_to_cpu(authblob->DomainName.BufferOffset); + dn_len = le16_to_cpu(authblob->DomainName.Length); + +- if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len) ++ if (blob_len < (u64)dn_off + dn_len || blob_len < (u64)nt_off + nt_len || ++ nt_len < CIFS_ENCPWD_SIZE) + return -EINVAL; + + /* TODO : use domain name that imported from configuration file */ diff --git a/queue-6.1/ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch b/queue-6.1/ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch new file mode 100644 index 00000000000..fd8a3ad750f --- /dev/null +++ b/queue-6.1/ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch @@ -0,0 +1,69 @@ +From 83dcedd5540d4ac61376ddff5362f7d9f866a6ec Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Sat, 31 Dec 2022 17:32:31 +0900 +Subject: ksmbd: fix infinite loop in ksmbd_conn_handler_loop() + +From: Namjae Jeon + +commit 83dcedd5540d4ac61376ddff5362f7d9f866a6ec upstream. + +If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round +again, It will cause infinite loop issue. And all threads from next +connections would be doing that. This patch add max retry count(2) to +avoid it. kernel_recvmsg() will wait during 7sec timeout and try to +retry two time if -EAGAIN is returned. And add flags of kvmalloc to +__GFP_NOWARN and __GFP_NORETRY to disconnect immediately without +retrying on memory alloation failure. + +Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") +Cc: stable@vger.kernel.org +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259 +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/connection.c | 7 +++++-- + fs/ksmbd/transport_tcp.c | 5 ++++- + 2 files changed, 9 insertions(+), 3 deletions(-) + +--- a/fs/ksmbd/connection.c ++++ b/fs/ksmbd/connection.c +@@ -316,9 +316,12 @@ int ksmbd_conn_handler_loop(void *p) + + /* 4 for rfc1002 length field */ + size = pdu_size + 4; +- conn->request_buf = kvmalloc(size, GFP_KERNEL); ++ conn->request_buf = kvmalloc(size, ++ GFP_KERNEL | ++ __GFP_NOWARN | ++ __GFP_NORETRY); + if (!conn->request_buf) +- continue; ++ break; + + memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf)); + if (!ksmbd_smb_request(conn)) +--- a/fs/ksmbd/transport_tcp.c ++++ b/fs/ksmbd/transport_tcp.c +@@ -295,6 +295,7 @@ static int ksmbd_tcp_readv(struct tcp_tr + struct msghdr ksmbd_msg; + struct kvec *iov; + struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn; ++ int max_retry = 2; + + iov = get_conn_iovec(t, nr_segs); + if (!iov) +@@ -321,9 +322,11 @@ static int ksmbd_tcp_readv(struct tcp_tr + } else if (conn->status == KSMBD_SESS_NEED_RECONNECT) { + total_read = -EAGAIN; + break; +- } else if (length == -ERESTARTSYS || length == -EAGAIN) { ++ } else if ((length == -ERESTARTSYS || length == -EAGAIN) && ++ max_retry) { + usleep_range(1000, 2000); + length = 0; ++ max_retry--; + continue; + } else if (length <= 0) { + total_read = -EAGAIN; diff --git a/queue-6.1/ksmbd-send-proper-error-response-in-smb2_tree_connect.patch b/queue-6.1/ksmbd-send-proper-error-response-in-smb2_tree_connect.patch new file mode 100644 index 00000000000..1826e216ef4 --- /dev/null +++ b/queue-6.1/ksmbd-send-proper-error-response-in-smb2_tree_connect.patch @@ -0,0 +1,53 @@ +From cdfb2fef522d0c3f9cf293db51de88e9b3d46846 Mon Sep 17 00:00:00 2001 +From: Marios Makassikis +Date: Fri, 23 Dec 2022 11:59:31 +0100 +Subject: ksmbd: send proper error response in smb2_tree_connect() + +From: Marios Makassikis + +commit cdfb2fef522d0c3f9cf293db51de88e9b3d46846 upstream. + +Currently, smb2_tree_connect doesn't send an error response packet on +error. + +This causes libsmb2 to skip the specific error code and fail with the +following: + smb2_service failed with : Failed to parse fixed part of command + payload. Unexpected size of Error reply. Expected 9, got 8 + +Signed-off-by: Marios Makassikis +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/smb2pdu.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -1926,13 +1926,13 @@ int smb2_tree_connect(struct ksmbd_work + if (conn->posix_ext_supported) + status.tree_conn->posix_extensions = true; + +-out_err1: + rsp->StructureSize = cpu_to_le16(16); ++ inc_rfc1001_len(work->response_buf, 16); ++out_err1: + rsp->Capabilities = 0; + rsp->Reserved = 0; + /* default manual caching */ + rsp->ShareFlags = SMB2_SHAREFLAG_MANUAL_CACHING; +- inc_rfc1001_len(work->response_buf, 16); + + if (!IS_ERR(treename)) + kfree(treename); +@@ -1965,6 +1965,9 @@ out_err1: + rsp->hdr.Status = STATUS_ACCESS_DENIED; + } + ++ if (status.ret != KSMBD_TREE_CONN_STATUS_OK) ++ smb2_set_err_rsp(work); ++ + return rc; + } + diff --git a/queue-6.1/series b/queue-6.1/series index 1204be4a8e3..cd7f14233b5 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -150,3 +150,8 @@ virtio_blk-fix-signedness-bug-in-virtblk_prep_rq.patch drm-amd-display-add-check-for-det-fetch-latency-hidi.patch drm-amd-display-uninitialized-variables-causing-4k60.patch btrfs-handle-case-when-repair-happens-with-dev-repla.patch +ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch +ksmbd-send-proper-error-response-in-smb2_tree_connect.patch +ksmbd-check-nt_len-to-be-at-least-cifs_encpwd_size-in-ksmbd_decode_ntlmssp_auth_blob.patch +drm-i915-dsi-add-support-for-icl-native-mipi-gpio-sequence.patch +drm-i915-dsi-fix-mipi_bklt_en_1-native-gpio-index.patch -- 2.47.3