From: Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com>
Due to the lack of checks on the clc array, if the firmware supports
more clc configuration, it will cause illegal memory access.
Cc: stable(a)vger.kernel.org
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Ming Yen Hsieh <mingyen.hsieh(a)mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 9dc22fbe25d3..c6c380571fd8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -638,6 +638,9 @@ static int mt7925_load_clc(struct mt792x_dev *dev, const char *fw_name)
for (offset = 0; offset < len; offset += le32_to_cpu(clc->len)) {
clc = (const struct mt7925_clc *)(clc_base + offset);
+ if (clc->idx > ARRAY_SIZE(phy->clc))
+ break;
+
/* do not init buf again if chip reset triggered */
if (phy->clc[clc->idx])
continue;
--
2.18.0
From: Tetsuo Handa <penguin-kernel(a)i-love.sakura.ne.jp>
[ Upstream commit 37ae5a0f5287a52cf51242e76ccf198d02ffe495]
Since lo_simple_ioctl(LOOP_SET_BLOCK_SIZE) and ioctl(NBD_SET_BLKSIZE) pass
user-controlled "unsigned long arg" to blk_validate_block_size(),
"unsigned long" should be used for validation.
Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
Reviewed-by: Christoph Hellwig <hch(a)lst.de>
Link: https://lore.kernel.org/r/9ecbf057-4375-c2db-ab53-e4cc0dff953d@i-love.sakur…
Signed-off-by: Jens Axboe <axboe(a)kernel.dk>
(cherry picked from commit 37ae5a0f5287a52cf51242e76ccf198d02ffe495)
Signed-off-by: David Hunter <david.hunter.linux(a)gmail.com>
---
V1 --> V2
- put upstream commit after subject
- put the original Author
- Added a few people I needed to CC
---
include/linux/blkdev.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 905844172cfd..c6d57814988d 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -235,7 +235,7 @@ struct request {
void *end_io_data;
};
-static inline int blk_validate_block_size(unsigned int bsize)
+static inline int blk_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;
--
2.43.0
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Author: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Date: Wed Aug 7 09:22:10 2024 +0200
The cec_msg_set_reply_to() helper function never zeroed the
struct cec_msg flags field, this can cause unexpected behavior
if flags was uninitialized to begin with.
Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Fixes: 0dbacebede1e ("[media] cec: move the CEC framework out of staging and to media")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org>
include/uapi/linux/cec.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
---
diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h
index 894fffc66f2c..b2af1dddd4d7 100644
--- a/include/uapi/linux/cec.h
+++ b/include/uapi/linux/cec.h
@@ -132,6 +132,8 @@ static inline void cec_msg_init(struct cec_msg *msg,
* Set the msg destination to the orig initiator and the msg initiator to the
* orig destination. Note that msg and orig may be the same pointer, in which
* case the change is done in place.
+ *
+ * It also zeroes the reply, timeout and flags fields.
*/
static inline void cec_msg_set_reply_to(struct cec_msg *msg,
struct cec_msg *orig)
@@ -139,7 +141,9 @@ static inline void cec_msg_set_reply_to(struct cec_msg *msg,
/* The destination becomes the initiator and vice versa */
msg->msg[0] = (cec_msg_destination(orig) << 4) |
cec_msg_initiator(orig);
- msg->reply = msg->timeout = 0;
+ msg->reply = 0;
+ msg->timeout = 0;
+ msg->flags = 0;
}
/**
Zero and negative number is not a valid IRQ for in-kernel code and the
irq_of_parse_and_map() function returns zero on error. So this check for
valid IRQs should only accept values > 0.
Cc: stable(a)vger.kernel.org
Fixes: 2d9e31b9412c ("dmaengine: moxart: remove NO_IRQ")
Signed-off-by: Ma Ke <make24(a)iscas.ac.cn>
---
Changes in v3:
- added missed changelog v2.
Changes in v2:
- added Cc stable line;
- added Fixes line.
---
drivers/dma/moxart-dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/moxart-dma.c b/drivers/dma/moxart-dma.c
index 66dc6d31b603..16dd3c5aba4d 100644
--- a/drivers/dma/moxart-dma.c
+++ b/drivers/dma/moxart-dma.c
@@ -568,7 +568,7 @@ static int moxart_probe(struct platform_device *pdev)
return -ENOMEM;
irq = irq_of_parse_and_map(node, 0);
- if (!irq) {
+ if (irq <= 0) {
dev_err(dev, "no IRQ resource\n");
return -EINVAL;
}
--
2.25.1
This is the start of the stable review cycle for the 6.10.6 release.
There are 25 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 18 Aug 2024 08:52:13 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.10.6-rc2…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 6.10.6-rc2
Aurabindo Pillai <aurabindo.pillai(a)amd.com>
drm/amd/display: Add misc DC changes for DCN401
Niklas Cassel <cassel(a)kernel.org>
Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error"
Sean Young <sean(a)mess.org>
media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com>
drm/amdgpu/display: Fix null pointer dereference in dc_stream_program_cursor_position
Wayne Lin <Wayne.Lin(a)amd.com>
drm/amd/display: Solve mst monitors blank out problem after resume
Kees Cook <kees(a)kernel.org>
binfmt_flat: Fix corruption when not offsetting data start
Gergo Koteles <soyer(a)irl.hu>
platform/x86: ideapad-laptop: add a mutex to synchronize VPC commands
Gergo Koteles <soyer(a)irl.hu>
platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
Gergo Koteles <soyer(a)irl.hu>
platform/x86: ideapad-laptop: introduce a generic notification chain
Shyam Sundar S K <Shyam-sundar.S-k(a)amd.com>
platform/x86/amd/pmf: Fix to Update HPD Data When ALS is Disabled
Takashi Iwai <tiwai(a)suse.de>
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com>
fs/ntfs3: Do copy_to_user out of run_lock
Pei Li <peili.dev(a)gmail.com>
jfs: Fix shift-out-of-bounds in dbDiscardAG
Edward Adam Davis <eadavis(a)qq.com>
jfs: fix null ptr deref in dtInsertEntry
Willem de Bruijn <willemb(a)google.com>
fou: remove warn in gue_gro_receive on unsupported protocol
Chao Yu <chao(a)kernel.org>
f2fs: fix to cover read extent cache access with lock
Chao Yu <chao(a)kernel.org>
f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
yunshui <jiangyunshui(a)kylinos.cn>
bpf, net: Use DEV_STAT_INC()
Simon Trimmer <simont(a)opensource.cirrus.com>
ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
WangYuli <wangyuli(a)uniontech.com>
nvme/pci: Add APST quirk for Lenovo N60z laptop
Huacai Chen <chenhuacai(a)kernel.org>
LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
Fangzhi Zuo <jerry.zuo(a)amd.com>
drm/amd/display: Prevent IPX From Link Detect and Set Mode
Harry Wentland <harry.wentland(a)amd.com>
drm/amd/display: Separate setting and programming of cursor
Wayne Lin <wayne.lin(a)amd.com>
drm/amd/display: Defer handling mst up request in resume
Kees Cook <kees(a)kernel.org>
exec: Fix ToCToU between perm check and set-uid/gid usage
-------------
Diffstat:
Makefile | 4 +-
arch/loongarch/include/uapi/asm/unistd.h | 1 +
drivers/ata/libata-scsi.c | 15 ++-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +-
.../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +
.../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 6 +-
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 94 ++++++++-----
drivers/gpu/drm/amd/display/dc/dc_stream.h | 8 ++
.../drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c | 2 +-
drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +----
drivers/nvme/host/pci.c | 7 +
drivers/platform/x86/Kconfig | 1 +
drivers/platform/x86/amd/pmf/spc.c | 32 ++---
drivers/platform/x86/ideapad-laptop.c | 148 ++++++++++++++++++---
drivers/platform/x86/ideapad-laptop.h | 9 ++
drivers/platform/x86/lenovo-ymc.c | 60 +--------
fs/binfmt_flat.c | 4 +-
fs/exec.c | 8 +-
fs/f2fs/extent_cache.c | 50 +++----
fs/f2fs/f2fs.h | 2 +-
fs/f2fs/gc.c | 10 ++
fs/f2fs/inode.c | 10 +-
fs/jfs/jfs_dmap.c | 2 +
fs/jfs/jfs_dtree.c | 2 +
fs/ntfs3/frecord.c | 75 ++++++++++-
net/core/filter.c | 8 +-
net/ipv4/fou_core.c | 2 +-
sound/soc/codecs/cs35l56-shared.c | 1 +
sound/usb/mixer.c | 7 +
29 files changed, 411 insertions(+), 212 deletions(-)