Currently, while parsing scan RNR Ie data is moved to
next neighbor_ap_info_field after parsing the current
neighbor_ap_info_field. But in last iteration pointer may
try to access invalid data if (uint8_t *)ie + rnr_ie_len + 2)
bytes are less than sizeof neighbor_ap_info_field and same
is the case with tbtt_length access.
Fix is to add a length check of data + next data size to be parsed
< (uint8_t *)ie + rnr_ie_len + 2) instead of adding a validation
of data length only.
CRs-Fixed: 3710080
Change-Id: I05e5a9a02f0f4f9bc468db894588e676f0a248c0
The passed in pointer in kgsl_count_hw_fences() can be a
kgsl_mem_entry pointer. This gets cross dereferenced to
a kgsl_drawobj_sync_event pointer and causes a NULL pointer
dereference. To avoid this cross dereference, decouple the two
paths and call kgsl_count_hw_fences() only in the appropriate
path.
Change-Id: I1088a0b67f1f82a20ddc94c94cbdd31a44b18da6
Signed-off-by: Harshdeep Dhatt <quic_hdhatt@quicinc.com>
Since the split elf blobs will always contain the hash segment, we rely on
the blob file to get the hash rather than assume that it will be present in
the mdt file. This change uses the hash index to read the appropriate elf
blob to get the hash segment.
Change-Id: Iaf37a15f7794d417d01d9eda4a9df772623ae19c
Signed-off-by: Siddharth Gupta <sidgup@codeaurora.org>
It may be that the offset of the first program header lies inside the mdt's
filesize, in this case the loader would incorrectly assume that the bins
were not split. The loading would then continue on to fail for split bins.
This change updates the logic used by the mdt loader to understand whether
the firmware images are split or not. It figures this out by checking if
each programs header's segment lies within the file or not.
Change-Id: I18ce4922eadceb96193584d829829878048ea045
Signed-off-by: Siddharth Gupta <sidgup@codeaurora.org>
The assumption that the elf program header will always have the hash
segment program header at index 1 may not hold true in all cases. This
change updates the read metadata function to find the hash program header
dynamically.
Change-Id: Ic5aa0d290b24ec3273003d980fec070b9e058c4f
Signed-off-by: Siddharth Gupta <sidgup@codeaurora.org>
"LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
qcedev: fix UAF in qcedev_smmu
msm: cvp: OOB write fix due to integer underflow
msm: eva: Adding kref count for cvp_get_inst_from_id
msm: kgsl: Fix error handling during drawctxt switch
msm_ipa: EoGRE Multi tunnel support
usb: dwc3: Fix dwc3 version and revisions in remote wakeup path
usb: gadget: f_cdev: Add remote wakeup capability from notify_serial_state
power: reset: qcom-dload-mode: nodump mode error handling
firmware: qcom_scm: Add a call for getting dload mode
msm: kgsl: Fix error handling during drawctxt switch
power: reset: qcom-dload-mode: support for nodump mode
defconfig: sdxlemur: Enable nodump support for sdxlemur
PCI: Disable L0s support for SDX65 with QPS615 on CPE platform
msm: adsprpc: use-after-free (UAF) in global maps
UPSTREAM: xhci: prepare for operation without shared HCD
rpmsg: glink: Get reference of channel objects in rx path
msm_ipa: Tunnel Config structure changes
soc: qcom: mdt_loader: add bound checks for headers
BACKPORT: media: venus: hfi: add checks in capabilities from firmware
Change-Id: Idae516c9223cb306b362ad22f031735cd856d59f
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common: (482 commits)
ANDROID: GKI: refresh ABI to include kimage_vaddr
ANDROID: preserve CRC for struct tcp_sock
ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
Linux 5.4.280
i2c: rcar: bring hardware to known state when probing
nilfs2: fix kernel bug on rename operation of broken directory
tcp: avoid too many retransmit packets
tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
net: tcp: fix unexcepted socket die when snd_wnd is 0
tcp: refactor tcp_retransmit_timer()
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
libceph: fix race between delayed_work() and ceph_monc_stop()
ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
nvmem: meson-efuse: Fix return value of nvmem callbacks
hpet: Support 32-bit userspace
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
USB: serial: option: add Rolling RW350-GL variants
USB: serial: option: add Netprisma LCUK54 series modules
...
Conflicts:
kernel/gen_kheaders.sh
Change-Id: Ib57235b05d1bd369b3852565eabea8e658b59aed
https://source.android.com/docs/security/bulletin/2024-07-01
CVE-2024-26923
* tag 'ASB-2024-07-05_11-5.4' of https://android.googlesource.com/kernel/common: (193 commits)
ANDROID: fix kernelci build breaks due to hid/uhid cyclic dependency
UPSTREAM: af_unix: Fix garbage collector racing against connect()
ANDROID: 16K: Only check basename of linker context
UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
Linux 5.4.276
pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
pinctrl: mediatek: remove set but not used variable 'e'
pinctrl: mediatek: Fix some off by one bugs
pinctrl: mediatek: Fix fallback behavior for bias_set_combo
regulator: core: fix debugfs creation regression
net: fix out-of-bounds access in ops_init
drm/vmwgfx: Fix invalid reads in fence signaled events
dyndbg: fix old BUG_ON in >control parser
tipc: fix UAF in error path
usb: gadget: f_fs: Fix a race condition when processing setup packets.
usb: gadget: composite: fix OS descriptors w_value logic
firewire: nosy: ensure user_length is taken into account when fetching packet contents
net: qede: use return from qede_parse_flow_attr() for flower
net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
...
Conflicts:
net/unix/garbage.c
Change-Id: I9d928b110c82362cd82e7e9cc3bb19c664cdd53d
External researcher found UAF in qcedev_smmu.c on an error condition in
qcedev_check_and_map_buffer. When an error occurs, we free binfo, but it
is still kept in the registeredbufs list. The fix removes it from the
list before freeing binfo.
Change-Id: I0327e456bd46106b12c36a5a21305407aae428dd
Signed-off-by: Daniel Perez-Zoghbi <quic_dperezzo@quicinc.com>
(cherry picked from commit ed97e9cf1d)
If FW send a pkt->size which is less than the sizeof packet structure
then pkt->size - sizeof() would result into an integer underflow.
Due to this the subsequent check would be bypassed and we will
start write to an OOB memory.
Change-Id: Icb3e4e6d64275592ceb6f747de653dcc1c65fec7
Signed-off-by: ptak <quic_ptak@quicinc.com>
(cherry picked from commit 143f500168)
commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 upstream.
Userspace provided string 's' could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
`if (str[0 - 1] == '\n') followed closely by an OOB write in the form
`str[0 - 1] = '\0'`.
There is already a validating check to catch strings that are too long.
Let's supply an additional check for invalid strings that are too short.
Bug: 346754046
Signed-off-by: Lee Jones <lee@kernel.org>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit d1205033e912f9332c1dbefa812e6ceb0575ce0a)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Id9a34f3e5495aef0d2a800a1386210f4d9fa8116
This symbol is now recognised by ABI tooling.
Bug: 352610488
Change-Id: I8bc6702c41239cd0a190b2128865faf673d97930
Signed-off-by: Giuliano Procida <gprocida@google.com>
Do a backmerge to catch up with the recent changes in the android11-5.4
branch. Included in here are the following commits:
56e07d95b5 Merge tag 'android11-5.4.278_r00' into android11-5.4
adc9210e7e ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
dc1385281a ANDROID: GKI: refresh ABI to include kimage_vaddr
9ace17ce18 BACKPORT: arm64: move kimage_vaddr to .rodata
db0d3aeed9 BACKPORT: arm64: kernel: Convert to modern annotations for assembly data
7f5fa80716 ANDROID: fix kernelci build breaks due to hid/uhid cyclic dependency
6aff87f48c Merge tag 'android11-5.4.276_r00' into android11-5.4
5727972f15 UPSTREAM: af_unix: Fix garbage collector racing against connect()
Change-Id: I14b743bf150b90425e7c5a96d8aa8e26408ef2a2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
In commit fe7a7b8942 ("tcp: add TCP_INFO status for failed client
TFO"), 2 unused bits in struct tcp_sock were renamed and used. This
does not change the binary abi, but the checking tools do notice this,
so mark it as such so that the CRC generation remains the same.
Fixes: fe7a7b8942 ("tcp: add TCP_INFO status for failed client TFO")
Change-Id: I160605fb220d393c77ed4972957cbf823980694c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmaY400ACgkQONu9yGCS
aT4SOxAAsnnWA4GPcspY03fxcSwl+CdgDj22VVgxDW/va/rk7fcxo000snNgo2M+
K1x9qL3SPAXVEZNIUdSU001+/pnaaVdskXRNanwIvIuZMeh2cn8qmP+MFUPHLKWH
aki1FPsh3lvI3x7JVioSWNvSuiaHgeXFBPKUB4wP5J51QYiuSWGb1gIrGCsCNiHI
kboMmDEo1cxSLE+0wWzhBXn921FA1Vot10SqtYwQJnAICq2TsE2YPgshiMkrYZ4e
0KbTLizk390pDT+n+Nrnoi7wNoRX/KoHz7A/94l3zwp3/xv9glqeudt+Cy9esQjo
yZQDkq6LtSW8ABWjcCXPMEg2r7p8HPmiOuCP8oHBo9kHNgyePbArEPWQP+xC3vzq
zeMH09m+arw8njBYdKv3c+5VVY7ABHQK3Vfo2Z3MMf5ZZgTg7f+e7uBT4RcFBriq
Eyne4CLPzuuzn/BEgcoPWxwaDs8mDThbxRlfSmnDbfE7IcuDGRH7EsvFuViSKE13
ncpLJu03bs/AhZe3eiLk+AWwb4gHJD1oBNWu1CkQ5XY2S0MxYxyYdlhNpGA5yvyO
RqIhrTm+ye/NlD8X1jj2WAPTR3l94TTQoBsJAhsfceusC3OeS5537hKJNL4c8O1f
GZM+vbAudy529iFVru84ZZLM31RwwOqRP3LRt1sOiSZs50FZ9HE=
=Q9dw
-----END PGP SIGNATURE-----
Merge 5.4.280 into android11-5.4-lts
Changes in 5.4.280
Compiler Attributes: Add __uninitialized macro
drm/lima: fix shared irq handling on driver remove
media: dvb: as102-fe: Fix as10x_register_addr packing
media: dvb-usb: dib0700_devices: Add missing release_firmware()
IB/core: Implement a limit on UMAD receive List
scsi: qedf: Make qedf_execute_tmf() non-preemptible
drm/amdgpu: Initialize timestamp for some legacy SOCs
drm/amd/display: Skip finding free audio for unknown engine_id
media: dw2102: Don't translate i2c read into write
sctp: prefer struct_size over open coded arithmetic
firmware: dmi: Stop decoding on broken entry
Input: ff-core - prefer struct_size over open coded arithmetic
net: dsa: mv88e6xxx: Correct check for empty list
media: dvb-frontends: tda18271c2dd: Remove casting during div
media: s2255: Use refcount_t instead of atomic_t for num_channels
media: dvb-frontends: tda10048: Fix integer overflow
i2c: i801: Annotate apanel_addr as __ro_after_init
powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
orangefs: fix out-of-bounds fsid access
powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
jffs2: Fix potential illegal address access in jffs2_free_inode
s390/pkey: Wipe sensitive data on failure
tcp: tcp_mark_head_lost is only valid for sack-tcp
tcp: add ece_ack flag to reno sack functions
net: tcp better handling of reordering then loss cases
UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
tcp_metrics: validate source addr length
wifi: wilc1000: fix ies_len type in connect path
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
selftests: fix OOM in msg_zerocopy selftest
selftests: make order checking verbose in msg_zerocopy selftest
inet_diag: Initialize pad field in struct inet_diag_req_v2
nilfs2: fix inode number range checks
nilfs2: add missing check for inode numbers on directory entries
mm: optimize the redundant loop of mm_update_owner_next()
can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
fsnotify: Do not generate events for O_PATH file descriptors
Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
drm/amdgpu/atomfirmware: silence UBSAN warning
bnx2x: Fix multiple UBSAN array-index-out-of-bounds
media: dw2102: fix a potential buffer overflow
i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
nvme-multipath: find NUMA path only for online numa-node
nilfs2: fix incorrect inode allocation from reserved inodes
filelock: fix potential use-after-free in posix_lock_inode
fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
vfs: don't mod negative dentry count when on shrinker list
tcp: add TCP_INFO status for failed client TFO
tcp: fix incorrect undo caused by DSACK of TLP retransmit
octeontx2-af: Fix incorrect value output on error path in rvu_check_rsrc_availability()
net: lantiq_etop: add blank line after declaration
net: ethernet: lantiq_etop: fix double free in detach
ppp: reject claimed-as-LCP but actually malformed packets
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
s390: Mark psw in __load_psw_mask() as __unitialized
ARM: davinci: Convert comma to semicolon
octeontx2-af: fix detection of IP layer
USB: serial: option: add Telit generic core-dump composition
USB: serial: option: add Telit FN912 rmnet compositions
USB: serial: option: add Fibocom FM350-GL
USB: serial: option: add support for Foxconn T99W651
USB: serial: option: add Netprisma LCUK54 series modules
USB: serial: option: add Rolling RW350-GL variants
USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
hpet: Support 32-bit userspace
nvmem: meson-efuse: Fix return value of nvmem callbacks
ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
libceph: fix race between delayed_work() and ceph_monc_stop()
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
tcp: refactor tcp_retransmit_timer()
net: tcp: fix unexcepted socket die when snd_wnd is 0
tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
tcp: avoid too many retransmit packets
nilfs2: fix kernel bug on rename operation of broken directory
i2c: rcar: bring hardware to known state when probing
Linux 5.4.280
Change-Id: Ic487769acece8eedb10cc2a310d97f453abba2f0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
vma_pad_fixup_flags() and is_mergable_pad_vma() were inadvertently
affecting the vm_flags on 32-bit arch, making some VMAs not mergable.
This causes zygote to crash as the Art GC's heap compaction fails.
The compaction depends on mremap() which will fail when operating on
a range that spans multiple VMAs [1]. This can happen now due to the
incorrect is_mergable_pad_vma() check.
Make all the pgsize_migration APIs no-ops in 32-bit architectures,
since Android only performs ELF segment extension in 64-bit archs.
[1] https://github.com/torvalds/linux/blob/v6.9/mm/mremap.c#L841-L843
Bug: 353667356
Change-Id: Id9b0076ef173d75a4afc85577355d340fce03e65
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
(cherry picked from commit f3437db87063f624f189e1cd38347a971fdd3fa0)
[ Upstream commit 4e36c0f20cb1c74c7bd7ea31ba432c1c4a989031 ]
When probing, the hardware is not brought into a known state. This may
be a problem when a hypervisor restarts Linux without resetting the
hardware, leaving an old state running. Make sure the hardware gets
initialized, especially interrupts should be cleared and disabled.
Reported-by: Dirk Behme <dirk.behme@de.bosch.com>
Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Closes: https://lore.kernel.org/r/20240702045535.2000393-1-dirk.behme@de.bosch.com
Fixes: 6ccbe60713 ("i2c: add Renesas R-Car I2C driver")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit a9e1ddc09ca55746079cc479aa3eb6411f0d99d4 upstream.
Syzbot reported that in rename directory operation on broken directory on
nilfs2, __block_write_begin_int() called to prepare block write may fail
BUG_ON check for access exceeding the folio/page size.
This is because nilfs_dotdot(), which gets parent directory reference
entry ("..") of the directory to be moved or renamed, does not check
consistency enough, and may return location exceeding folio/page size for
broken directories.
Fix this issue by checking required directory entries ("." and "..") in
the first chunk of the directory in nilfs_dotdot().
Link: https://lkml.kernel.org/r/20240628165107.9006-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+d3abed1ad3d367fa2627@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d3abed1ad3d367fa2627
Fixes: 2ba466d74e ("nilfs2: directory entry operations")
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 97a9063518f198ec0adb2ecb89789de342bb8283 upstream.
If a TCP socket is using TCP_USER_TIMEOUT, and the other peer
retracted its window to zero, tcp_retransmit_timer() can
retransmit a packet every two jiffies (2 ms for HZ=1000),
for about 4 minutes after TCP_USER_TIMEOUT has 'expired'.
The fix is to make sure tcp_rtx_probe0_timed_out() takes
icsk->icsk_user_timeout into account.
Before blamed commit, the socket would not timeout after
icsk->icsk_user_timeout, but would use standard exponential
backoff for the retransmits.
Also worth noting that before commit e89688e3e978 ("net: tcp:
fix unexcepted socket die when snd_wnd is 0"), the issue
would last 2 minutes instead of 4.
Fixes: b701a99e43 ("tcp: Add tcp_clamp_rto_to_user_timeout() helper to improve accuracy")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Jon Maxwell <jmaxwell37@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20240710001402.2758273-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 36534d3c54537bf098224a32dc31397793d4594d upstream.
Due to timer wheel implementation, a timer will usually fire
after its schedule.
For instance, for HZ=1000, a timeout between 512ms and 4s
has a granularity of 64ms.
For this range of values, the extra delay could be up to 63ms.
For TCP, this means that tp->rcv_tstamp may be after
inet_csk(sk)->icsk_timeout whenever the timer interrupt
finally triggers, if one packet came during the extra delay.
We need to make sure tcp_rtx_probe0_timed_out() handles this case.
Fixes: e89688e3e978 ("net: tcp: fix unexcepted socket die when snd_wnd is 0")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Menglong Dong <imagedong@tencent.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://lore.kernel.org/r/20240607125652.1472540-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e89688e3e97868451a5d05b38a9d2633d6785cd4 upstream.
In tcp_retransmit_timer(), a window shrunk connection will be regarded
as timeout if 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX'. This is not
right all the time.
The retransmits will become zero-window probes in tcp_retransmit_timer()
if the 'snd_wnd==0'. Therefore, the icsk->icsk_rto will come up to
TCP_RTO_MAX sooner or later.
However, the timer can be delayed and be triggered after 122877ms, not
TCP_RTO_MAX, as I tested.
Therefore, 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX' is always true
once the RTO come up to TCP_RTO_MAX, and the socket will die.
Fix this by replacing the 'tcp_jiffies32' with '(u32)icsk->icsk_timeout',
which is exact the timestamp of the timeout.
However, "tp->rcv_tstamp" can restart from idle, then tp->rcv_tstamp
could already be a long time (minutes or hours) in the past even on the
first RTO. So we double check the timeout with the duration of the
retransmission.
Meanwhile, making "2 * TCP_RTO_MAX" as the timeout to avoid the socket
dying too soon.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/netdev/CADxym3YyMiO+zMD4zj03YPM3FBi-1LHi6gSD2XT8pyAMM096pg@mail.gmail.com/
Signed-off-by: Menglong Dong <imagedong@tencent.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0d580fbd2db084a5c96ee9c00492236a279d5e0f upstream.
It appears linux-4.14 stable needs a backport of commit
88f8598d0a ("tcp: exit if nothing to retransmit on RTO timeout")
Since tcp_rtx_queue_empty() is not in pre 4.15 kernels,
let's refactor tcp_retransmit_timer() to only use tcp_rtx_queue_head()
I will provide to stable teams the squashed patches.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 69c7b2fe4c9cc1d3b1186d1c5606627ecf0de883 upstream.
The way the delayed work is handled in ceph_monc_stop() is prone to
races with mon_fault() and possibly also finish_hunting(). Both of
these can requeue the delayed work which wouldn't be canceled by any of
the following code in case that happens after cancel_delayed_work_sync()
runs -- __close_session() doesn't mess with the delayed work in order
to avoid interfering with the hunting interval logic. This part was
missed in commit b5d91704f5 ("libceph: behave in mon_fault() if
cur_mon < 0") and use-after-free can still ensue on monc and objects
that hang off of it, with monc->auth and monc->monmap being
particularly susceptible to quickly being reused.
To fix this:
- clear monc->cur_mon and monc->hunting as part of closing the session
in ceph_monc_stop()
- bail from delayed_work() if monc->cur_mon is cleared, similar to how
it's done in mon_fault() and finish_hunting() (based on monc->hunting)
- call cancel_delayed_work_sync() after the session is closed
Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/66857
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6db03b1929e207d2c6e84e75a9cd78124b3d6c6d upstream.
The internal mic boost on the VAIO models VJFE-CL and VJFE-IL is too high.
Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine
to limit the gain.
Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20240705141012.5368-1-edson.drosdeck@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7a0a6d0a7c805f9380381f4deedffdf87b93f408 upstream.
Read/write callbacks registered with nvmem core expect 0 to be returned
on success and a negative value to be returned on failure.
meson_efuse_read() and meson_efuse_write() call into
meson_sm_call_read() and meson_sm_call_write() respectively which return
the number of bytes read or written on success as per their api
description.
Fix to return error if meson_sm_call_read()/meson_sm_call_write()
returns an error else return 0.
Fixes: a29a63bdaf ("nvmem: meson-efuse: simplify read callback")
Cc: stable@vger.kernel.org
Signed-off-by: Joy Chakraborty <joychakr@google.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20240628113704.13742-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a368ecde8a5055b627749b09c6218ef793043e47 upstream.
Syzbot has identified a bug in usbcore (see the Closes: tag below)
caused by our assumption that the reserved bits in an endpoint
descriptor's bEndpointAddress field will always be 0. As a result of
the bug, the endpoint_is_duplicate() routine in config.c (and possibly
other routines as well) may believe that two descriptors are for
distinct endpoints, even though they have the same direction and
endpoint number. This can lead to confusion, including the bug
identified by syzbot (two descriptors with matching endpoint numbers
and directions, where one was interrupt and the other was bulk).
To fix the bug, we will clear the reserved bits in bEndpointAddress
when we parse the descriptor. (Note that both the USB-2.0 and USB-3.1
specs say these bits are "Reserved, reset to zero".) This requires us
to make a copy of the descriptor earlier in usb_parse_endpoint() and
use the copy instead of the original when checking for duplicates.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+8693a0bb9c10b554272a@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/0000000000003d868e061bc0f554@google.com/
Fixes: 0a8fd13462 ("USB: fix problems with duplicate endpoint addresses")
CC: Oliver Neukum <oneukum@suse.com>
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/205a5edc-7fef-4159-b64a-80374b6b101a@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 upstream.
Userspace provided string 's' could trivially have the length zero. Left
unchecked this will firstly result in an OOB read in the form
`if (str[0 - 1] == '\n') followed closely by an OOB write in the form
`str[0 - 1] = '\0'`.
There is already a validating check to catch strings that are too long.
Let's supply an additional check for invalid strings that are too short.
Signed-off-by: Lee Jones <lee@kernel.org>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3859e85de30815a20bce7db712ce3d94d40a682d upstream.
START BP-850K is a dot matrix printer that crashes when
it receives a Set-Interface request and needs USB_QUIRK_NO_SET_INTF
to work properly.
Cc: stable <stable@kernel.org>
Signed-off-by: jinxiaobo <jinxiaobo@uniontech.com>
Signed-off-by: WangYuli <wangyuli@uniontech.com>
Link: https://lore.kernel.org/r/202E4B2BD0F0FEA4+20240702154408.631201-1-wangyuli@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
