Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com>
在 2021/10/23 22:40, huangzhuoli 写道:
> From: John Keeping <john(a)metanate.com>
>
> stable inclusion
> from stable-v5.10.44
> commit 90547d5db50bcb2705709e420e0af51535109113
> bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=426
> CVE: NA
>
> -------------------------------------------------
>
> [ Upstream commit 0c1f3193b1cdd21e7182f97dc9bca7d284d18a15 ]
>
> The third parameter of module_param() is permissions for the sysfs node
> but it looks like it is being used as the initial value of the parameter
> here. In fact, false here equates to omitting the file from sysfs and
> does not affect the value of require_signatures.
>
> Making the parameter writable is not simple because going from
> false->true is fine but it should not be possible to remove the
> requirement to verify a signature. But it can be useful to inspect the
> value of this parameter from userspace, so change the permissions to
> make a read-only file in sysfs.
>
> Signed-off-by: John Keeping <john(a)metanate.com>
> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
> Signed-off-by: Sasha Levin <sashal(a)kernel.org>
> Signed-off-by: huangzhuoli <bioagr_huangzl(a)163.com>
> ---
> drivers/md/dm-verity-verify-sig.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
> index 614e43db93aa..919154ae4cae 100644
> --- a/drivers/md/dm-verity-verify-sig.c
> +++ b/drivers/md/dm-verity-verify-sig.c
> @@ -15,7 +15,7 @@
> #define DM_VERITY_VERIFY_ERR(s) DM_VERITY_ROOT_HASH_VERIFICATION " " s
>
> static bool require_signatures;
> -module_param(require_signatures, bool, false);
> +module_param(require_signatures, bool, 0444);
> MODULE_PARM_DESC(require_signatures,
> "Verify the roothash of dm-verity hash tree");
>
Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com>
在 2021/10/23 22:40, huangzhuoli 写道:
> From: John Keeping <john(a)metanate.com>
>
> stable inclusion
> from stable-v5.10.44
> commit 90547d5db50bcb2705709e420e0af51535109113
> bugzilla:https://bugzilla.openeuler.org/show_bug.cgi?id=426
> CVE: NA
>
> -------------------------------------------------
>
> [ Upstream commit 0c1f3193b1cdd21e7182f97dc9bca7d284d18a15 ]
>
> The third parameter of module_param() is permissions for the sysfs node
> but it looks like it is being used as the initial value of the parameter
> here. In fact, false here equates to omitting the file from sysfs and
> does not affect the value of require_signatures.
>
> Making the parameter writable is not simple because going from
> false->true is fine but it should not be possible to remove the
> requirement to verify a signature. But it can be useful to inspect the
> value of this parameter from userspace, so change the permissions to
> make a read-only file in sysfs.
>
> Signed-off-by: John Keeping <john(a)metanate.com>
> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com>
> Signed-off-by: Sasha Levin <sashal(a)kernel.org>
> Signed-off-by: huangzhuoli <bioagr_huangzl(a)163.com>
> ---
> drivers/md/dm-verity-verify-sig.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
> index 614e43db93aa..919154ae4cae 100644
> --- a/drivers/md/dm-verity-verify-sig.c
> +++ b/drivers/md/dm-verity-verify-sig.c
> @@ -15,7 +15,7 @@
> #define DM_VERITY_VERIFY_ERR(s) DM_VERITY_ROOT_HASH_VERIFICATION " " s
>
> static bool require_signatures;
> -module_param(require_signatures, bool, false);
> +module_param(require_signatures, bool, 0444);
> MODULE_PARM_DESC(require_signatures,
> "Verify the roothash of dm-verity hash tree");
>
From: Wesley Cheng <wcheng(a)codeaurora.org>
stable inclusion
from stable-v5.10.44
commit 5cead896962d8b25dee8a8efc85b076572732b86
bugzilla: https://bugzilla.openeuler.org/show_bug.cgi?id=406
CVE: NA
-------------------------------------------------
commit 6fc1db5e6211e30fbb1cee8d7925d79d4ed2ae14 upstream.
During unbind, ffs_func_eps_disable() will be executed, resulting in
completion callbacks for any pending USB requests. When using AIO,
irrespective of the completion status, io_data work is queued to
io_completion_wq to evaluate and handle the completed requests. Since
work runs asynchronously to the unbind() routine, there can be a
scenario where the work runs after the USB gadget has been fully
removed, resulting in accessing of a resource which has been already
freed. (i.e. usb_ep_free_request() accessing the USB ep structure)
Explicitly drain the io_completion_wq, instead of relying on the
destroy_workqueue() (in ffs_data_put()) to make sure no pending
completion work items are running.
Signed-off-by: Wesley Cheng <wcheng(a)codeaurora.org>
Cc: stable <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/r/1621644261-1236-1-git-send-email-wcheng@codeauror…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: liuhao <qq1107732331(a)qq.com>
---
drivers/usb/gadget/function/f_fs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index ffe67d836b0c..7df180b110af 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3566,6 +3566,9 @@ static void ffs_func_unbind(struct usb_configuration *c,
ffs->func = NULL;
}
+ /* Drain any pending AIO completions */
+ drain_workqueue(ffs->io_completion_wq);
+
if (!--opts->refcnt)
functionfs_unbind(ffs);
--
2.23.0