- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19 00/78] backport stable-4.19.167
by Yang Yingliang 14 Jan '21

14 Jan '21

Adrian Hunter (1): scsi: ufs-pci: Ensure UFS device is in PowerDown mode for suspend-to-disk ->poweroff() Alexey Dobriyan (2): proc: change ->nlink under proc_subdir_lock proc: fix lookup in /proc/net subdirectories after setns(2) Antoine Tenart (4): net-sysfs: take the rtnl lock when storing xps_cpus net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc net-sysfs: take the rtnl lock when storing xps_rxqs net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc Ard Biesheuvel (1): crypto: ecdh - avoid buffer overflow in ecdh_set_secret() Arnd Bergmann (1): usb: gadget: select CONFIG_CRC32 Bard Liao (1): Revert "device property: Keep secondary firmware node secondary by type" Bart Van Assche (2): scsi: ide: Do not set the RQF_PREEMPT flag for sense requests scsi: scsi_transport_spi: Set RQF_PM for domain validation commands Bean Huo (1): scsi: ufs: Fix wrong print message in dev_err() Bjørn Mork (2): net: usb: qmi_wwan: add Quectel EM160R-GL USB: serial: option: add Quectel EM160R-GL Chandana Kishori Chiluveru (1): usb: gadget: configfs: Preserve function ordering after bind failure Christophe JAILLET (1): staging: mt7621-dma: Fix a resource leak in an error handling path Cong Wang (1): erspan: fix version 1 check in gre_parse_header() Dan Carpenter (1): atm: idt77252: call pci_disable_device() on error path Dan Williams (1): x86/mm: Fix leak of pmd ptlock Daniel Palmer (1): USB: serial: option: add LongSung M5710 module support David Disseldorp (1): scsi: target: Fix XCOPY NAA identifier lookup Dexuan Cui (1): video: hyperv_fb: Fix the mmap() regression for v5.4.y and older Dinghao Liu (1): net: ethernet: Fix memleak in ethoc_probe Dominique Martinet (1): kbuild: don't hardcode depmod path Eddie Hung (1): usb: gadget: configfs: Fix use-after-free issue with udc_name Filipe Manana (1): btrfs: send: fix wrong file path when there is an inode with a pending rmdir Florian Fainelli (1): net: systemport: set dev->max_mtu to UMAC_MAX_MTU_SIZE Florian Westphal (1): netfilter: xt_RATEEST: reject non-null terminated string from userspace Greg Kroah-Hartman (1): Linux 4.19.167 Grygorii Strashko (1): net: ethernet: ti: cpts: fix ethtool output when no ptp_clock registered Guillaume Nault (1): ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() Hans de Goede (1): Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close Heiner Kallweit (1): r8169: work around power-saving bug on some chip versions Huang Shijie (1): lib/genalloc: fix the overflow when size is too big Jeff Dike (1): virtio_net: Fix recursive call to cpus_read_lock() Jerome Brunet (1): usb: gadget: f_uac2: reset wMaxPacketSize Johan Hovold (4): USB: serial: iuu_phoenix: fix DMA from stack USB: yurex: fix control-URB timeout handling USB: usblp: fix DMA to stack USB: serial: keyspan_pda: remove unused variable John Wang (1): net/ncsi: Use real net-device for response handler Kailang Yang (1): ALSA: hda/realtek - Fix speaker volume control on Lenovo C940 Linus Torvalds (1): depmod: handle the case of /sbin/depmod without /sbin in PATH Manish Chopra (1): qede: fix offload for IPIP tunnel packets Manish Narani (1): usb: gadget: u_ether: Fix MTU size mismatch with RX packet size Michael Grzeschik (1): USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set Paolo Bonzini (1): KVM: x86: fix shift out of bounds reported by UBSAN Randy Dunlap (2): net: sched: prevent invalid Scell_log shift count usb: usbip: vhci_hcd: protect shift size Rasmus Villemoes (2): ethernet: ucc_geth: fix use-after-free in ucc_geth_remove() ethernet: ucc_geth: set dev->max_mtu to 1518 Roger Pau Monne (1): xen/pvh: correctly setup the PV EFI interface for dom0 Roland Dreier (1): CDC-NCM: remove "connected" log message Sean Young (1): USB: cdc-acm: blacklist another IR Droid device Serge Semin (1): usb: dwc3: ulpi: Use VStsDone to detect PHY regs access completion Sriharsha Allenki (1): usb: gadget: Fix spinlock lockup on usb_function_deactivate Stefan Chulski (3): net: mvpp2: Add TCAM entry to drop flow control pause frames net: mvpp2: prs: fix PPPoE with ipv6 packet parse net: mvpp2: Fix GoP port 3 Networking Complex Control configurations Subash Abhinov Kasiviswanathan (1): netfilter: x_tables: Update remaining dereference to RCU Sylwester Dziedziuch (1): i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs Takashi Iwai (2): ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks ALSA: hda/via: Fix runtime PM for Clevo W35xSS Tetsuo Handa (1): USB: cdc-wdm: Fix use after free in service_outstanding_interrupt(). Thinh Nguyen (1): usb: uas: Add PNY USB Portable SSD to unusual_uas Vasily Averin (1): netfilter: ipset: fix shift-out-of-bounds in htable_bits() Xie He (1): net: hdlc_ppp: Fix issues when mod_timer is called while timer is running Yang Yingliang (1): USB: gadget: legacy: fix return error code in acm_ms_bind() Ying-Tsun Huang (1): x86/mtrr: Correct the range check before performing MTRR type lookups Yu Kuai (1): usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() Yunfeng Ye (1): workqueue: Kick a worker based on the actual activation of delayed works Yunjian Wang (3): tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS net: hns: fix return value check in __lb_other_process() vhost_net: fix ubuf refcount incorrectly when sendmsg fails Zqiang (1): usb: gadget: function: printer: Fix a memory leak for interface descriptor bo liu (1): ALSA: hda/conexant: add a new hda codec CX11970 taehyun.cho (1): usb: gadget: enable super speed plus Makefile | 4 +- arch/x86/kernel/cpu/mtrr/generic.c | 6 +- arch/x86/kvm/mmu.h | 2 +- arch/x86/mm/pgtable.c | 2 + arch/x86/xen/efi.c | 12 +- arch/x86/xen/enlighten_pv.c | 2 +- arch/x86/xen/enlighten_pvh.c | 4 + arch/x86/xen/xen-ops.h | 4 +- crypto/ecdh.c | 3 +- drivers/atm/idt77252.c | 2 +- drivers/base/core.c | 2 +- drivers/bluetooth/hci_h5.c | 8 +- drivers/ide/ide-atapi.c | 1 - drivers/ide/ide-io.c | 5 - drivers/net/ethernet/broadcom/bcmsysport.c | 1 + drivers/net/ethernet/ethoc.c | 3 +- drivers/net/ethernet/freescale/ucc_geth.c | 3 +- .../net/ethernet/hisilicon/hns/hns_ethtool.c | 4 + drivers/net/ethernet/intel/i40e/i40e.h | 3 + drivers/net/ethernet/intel/i40e/i40e_main.c | 10 ++ .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 +- .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +- .../net/ethernet/marvell/mvpp2/mvpp2_prs.c | 38 +++++- .../net/ethernet/marvell/mvpp2/mvpp2_prs.h | 2 +- drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 + drivers/net/ethernet/realtek/r8169.c | 6 +- drivers/net/ethernet/ti/cpts.c | 2 + drivers/net/tun.c | 2 +- drivers/net/usb/cdc_ncm.c | 3 - drivers/net/usb/qmi_wwan.c | 1 + drivers/net/virtio_net.c | 12 +- drivers/net/wan/hdlc_ppp.c | 7 ++ drivers/scsi/scsi_transport_spi.c | 27 ++-- drivers/scsi/ufs/ufshcd-pci.c | 34 ++++- drivers/scsi/ufs/ufshcd.c | 2 +- drivers/staging/mt7621-dma/mtk-hsdma.c | 4 +- drivers/target/target_core_xcopy.c | 119 ++++++++++-------- drivers/target/target_core_xcopy.h | 1 + drivers/usb/chipidea/ci_hdrc_imx.c | 6 +- drivers/usb/class/cdc-acm.c | 4 + drivers/usb/class/cdc-wdm.c | 16 ++- drivers/usb/class/usblp.c | 21 +++- drivers/usb/dwc3/core.h | 1 + drivers/usb/dwc3/ulpi.c | 2 +- drivers/usb/gadget/Kconfig | 2 + drivers/usb/gadget/composite.c | 10 +- drivers/usb/gadget/configfs.c | 19 ++- drivers/usb/gadget/function/f_printer.c | 1 + drivers/usb/gadget/function/f_uac2.c | 69 +++++++--- drivers/usb/gadget/function/u_ether.c | 9 +- drivers/usb/gadget/legacy/acm_ms.c | 4 +- drivers/usb/host/xhci.c | 24 ++-- drivers/usb/misc/yurex.c | 3 + drivers/usb/serial/iuu_phoenix.c | 20 ++- drivers/usb/serial/keyspan_pda.c | 2 - drivers/usb/serial/option.c | 3 + drivers/usb/storage/unusual_uas.h | 7 ++ drivers/usb/usbip/vhci_hcd.c | 2 + drivers/vhost/net.c | 6 +- drivers/video/fbdev/hyperv_fb.c | 6 +- fs/btrfs/send.c | 49 +++++--- fs/proc/generic.c | 55 +++++--- fs/proc/internal.h | 7 ++ fs/proc/proc_net.c | 16 --- include/linux/proc_fs.h | 8 +- include/net/red.h | 4 +- kernel/workqueue.c | 13 +- lib/genalloc.c | 25 ++-- net/core/net-sysfs.c | 65 ++++++++-- net/ipv4/fib_frontend.c | 2 +- net/ipv4/gre_demux.c | 2 +- net/ipv4/netfilter/arp_tables.c | 2 +- net/ipv4/netfilter/ip_tables.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 2 +- net/ncsi/ncsi-rsp.c | 2 +- net/netfilter/ipset/ip_set_hash_gen.h | 20 +-- net/netfilter/xt_RATEEST.c | 3 + net/sched/sch_choke.c | 2 +- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 2 +- net/sched/sch_sfq.c | 2 +- scripts/depmod.sh | 2 + sound/pci/hda/hda_intel.c | 2 - sound/pci/hda/patch_conexant.c | 1 + sound/pci/hda/patch_realtek.c | 6 + sound/pci/hda/patch_via.c | 13 ++ sound/usb/midi.c | 4 + 87 files changed, 624 insertions(+), 278 deletions(-) -- 2.25.1

1 78

[PATCH kernel-4.19 0/8] backport stable-4.19.166
by Yang Yingliang 11 Jan '21

11 Jan '21

Felix Fietkau (1): Revert "mtd: spinand: Fix OOB read" Greg Kroah-Hartman (1): Linux 4.19.166 Jonathan Cameron (2): iio:imu:bmi160: Fix alignment and data leak issues iio:magnetometer:mag3110: Fix alignment and data leak issues. Josh Poimboeuf (1): kdev_t: always inline major/minor helper functions Tudor Ambarus (1): dmaengine: at_hdmac: Substitute kzalloc with kmalloc Yu Kuai (2): dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate() dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate() Makefile | 2 +- drivers/dma/at_hdmac.c | 11 ++++++++--- drivers/iio/imu/bmi160/bmi160_core.c | 13 +++++++++---- drivers/iio/magnetometer/mag3110.c | 13 +++++++++---- drivers/mtd/nand/spi/core.c | 4 ---- include/linux/kdev_t.h | 22 +++++++++++----------- 6 files changed, 38 insertions(+), 27 deletions(-) -- 2.25.1

1 8

[PATCH kernel-4.19 1/5] arm64/ascend: mm: Fix hugetlb check node error
by Yang Yingliang 11 Jan '21

11 Jan '21

From: Fang Lijun <fanglijun3(a)huawei.com> ascend inclusion category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- The vm_flags will changed by MAP_CHECKNODE, so we must use it for output argument. Fixes: 66bd45db2b03 ("arm64/ascend: mm: Fix arm32 compile warnings") Signed-off-by: Fang Lijun <fanglijun3(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/mman.h | 7 ++++--- mm/mmap.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/include/linux/mman.h b/include/linux/mman.h index d35d984c058c..a8ea591faed7 100644 --- a/include/linux/mman.h +++ b/include/linux/mman.h @@ -76,15 +76,16 @@ static inline int dvpp_mmap_zone(unsigned long addr) { return 0; } #ifdef CONFIG_COHERENT_DEVICE #define CHECKNODE_BITS 48 #define CHECKNODE_MASK (~((_AC(1, UL) << CHECKNODE_BITS) - 1)) -static inline void set_vm_checknode(vm_flags_t vm_flags, unsigned long flags) +static inline void set_vm_checknode(vm_flags_t *vm_flags, unsigned long flags) { if (is_set_cdmmask()) - vm_flags |= VM_CHECKNODE | ((((flags >> MAP_HUGE_SHIFT) & + *vm_flags |= VM_CHECKNODE | ((((flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK) << CHECKNODE_BITS) & CHECKNODE_MASK); } #else #define CHECKNODE_BITS (0) -static inline void set_vm_checknode(vm_flags_t vm_flags, unsigned long flags) {} +static inline void set_vm_checknode(vm_flags_t *vm_flags, unsigned long flags) +{} #endif /* diff --git a/mm/mmap.c b/mm/mmap.c index 9dfef56dd0e8..e0399b087430 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1579,7 +1579,7 @@ unsigned long __do_mmap(struct mm_struct *mm, struct file *file, * hugetlbfs file mmap will use it to check node */ if (flags & MAP_CHECKNODE) - set_vm_checknode(vm_flags, flags); + set_vm_checknode(&vm_flags, flags); addr = __mmap_region(mm, file, addr, len, vm_flags, pgoff, uf); if (!IS_ERR_VALUE(addr) && -- 2.25.1

1 4

openEuler kernel sig meeting
by openEuler conference 11 Jan '21

11 Jan '21

2 1

[PATCH openEuler-1.0-LTS] HID: core: Sanitize event code and type when mapping input
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Marc Zyngier <maz(a)kernel.org> stable inclusion from linux-4.19.144 commit a47b8511d90528c77346597e2012100dfc28cd8c CVE: CVE-2020-0465 -------------------------------- commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream. When calling into hid_map_usage(), the passed event code is blindly stored as is, even if it doesn't fit in the associated bitmap. This event code can come from a variety of sources, including devices masquerading as input devices, only a bit more "programmable". Instead of taking the event code at face value, check that it actually fits the corresponding bitmap, and if it doesn't: - spit out a warning so that we know which device is acting up - NULLify the bitmap pointer so that we catch unexpected uses Code paths that can make use of untrusted inputs can now check that the mapping was indeed correct and bail out if not. Cc: stable(a)vger.kernel.org Signed-off-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/hid-input.c | 4 ++++ drivers/hid/hid-multitouch.c | 2 ++ include/linux/hid.h | 42 +++++++++++++++++++++++++----------- 3 files changed, 35 insertions(+), 13 deletions(-) diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c index dbb0cbe65fc9..0062b37ef98f 100644 --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -1125,6 +1125,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel } mapped: + /* Mapping failed, bail out */ + if (!bit) + return; + if (device->driver->input_mapped && device->driver->input_mapped(device, hidinput, field, usage, &bit, &max) < 0) { diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index f9167d0e095c..dfb2548e0052 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -841,6 +841,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, code = BTN_0 + ((usage->hid - 1) & HID_USAGE); hid_map_usage(hi, usage, bit, max, EV_KEY, code); + if (!*bit) + return -1; input_set_capability(hi->input, EV_KEY, code); return 1; diff --git a/include/linux/hid.h b/include/linux/hid.h index 8b3e5e8a72fb..bbbe6c0e0e26 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -956,34 +956,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) { * @max: maximal valid usage->code to consider later (out parameter) * @type: input event type (EV_KEY, EV_REL, ...) * @c: code which corresponds to this usage and type + * + * The value pointed to by @bit will be set to NULL if either @type is + * an unhandled event type, or if @c is out of range for @type. This + * can be used as an error condition. */ static inline void hid_map_usage(struct hid_input *hidinput, struct hid_usage *usage, unsigned long **bit, int *max, - __u8 type, __u16 c) + __u8 type, unsigned int c) { struct input_dev *input = hidinput->input; - - usage->type = type; - usage->code = c; + unsigned long *bmap = NULL; + unsigned int limit = 0; switch (type) { case EV_ABS: - *bit = input->absbit; - *max = ABS_MAX; + bmap = input->absbit; + limit = ABS_MAX; break; case EV_REL: - *bit = input->relbit; - *max = REL_MAX; + bmap = input->relbit; + limit = REL_MAX; break; case EV_KEY: - *bit = input->keybit; - *max = KEY_MAX; + bmap = input->keybit; + limit = KEY_MAX; break; case EV_LED: - *bit = input->ledbit; - *max = LED_MAX; + bmap = input->ledbit; + limit = LED_MAX; break; } + + if (unlikely(c > limit || !bmap)) { + pr_warn_ratelimited("%s: Invalid code %d type %d\n", + input->name, c, type); + *bit = NULL; + return; + } + + usage->type = type; + usage->code = c; + *max = limit; + *bit = bmap; } /** @@ -997,7 +1012,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput, __u8 type, __u16 c) { hid_map_usage(hidinput, usage, bit, max, type, c); - clear_bit(c, *bit); + if (*bit) + clear_bit(usage->code, *bit); } /** -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Sergey Matyukevich <sergey.matyukevich.os(a)quantenna.com> stable inclusion from linux-4.19.108 commit 0fb31bd53a5e27394916758173eb748c5e0dbd47 CVE: CVE-2020-27068 -------------------------------- [ Upstream commit ea75080110a4c1fa011b0a73cb8f42227143ee3e ] The nl80211_policy is missing for NL80211_ATTR_STATUS_CODE attribute. As a result, for strictly validated commands, it's assumed to not be supported. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os(a)quantenna.com> Link: https://lore.kernel.org/r/20200213131608.10541-2-sergey.matyukevich.os@quan… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 5075fd293feb..de9580f13914 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -323,6 +323,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, + [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, [NL80211_ATTR_PID] = { .type = NLA_U32 }, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] speakup: Reject setting the speakup line discipline outside of speakup
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v5.10-rc7 commit f0992098cadb4c9c6a00703b66cafe604e178fea category: bugfix bugzilla: NA CVE: CVE-2020-27830 -------------------------------- Speakup exposing a line discipline allows userland to try to use it, while it is deemed to be useless, and thus uselessly exposes potential bugs. One of them is simply that in such a case if the line sends data, spk_ttyio_receive_buf2 is called and crashes since spk_ttyio_synth is NULL. This change restricts the use of the speakup line discipline to speakup drivers, thus avoiding such kind of issues altogether. Cc: stable(a)vger.kernel.org Reported-by: Shisong Qin <qinshisong1205(a)gmail.com> Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Tested-by: Shisong Qin <qinshisong1205(a)gmail.com> Link: https://lore.kernel.org/r/20201129193523.hm3f6n5xrn6fiyyc@function Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/accessibility/speakup/spk_ttyio.c [yyl: spk_ttyio.c is in drivers/staging/speakup/ in kernel-4.19] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/staging/speakup/spk_ttyio.c | 36 ++++++++++++++++++----------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c index 6c754ddf1257..8bc7db55daeb 100644 --- a/drivers/staging/speakup/spk_ttyio.c +++ b/drivers/staging/speakup/spk_ttyio.c @@ -47,27 +47,21 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty) { struct spk_ldisc_data *ldisc_data; + if (tty != speakup_tty) + /* Somebody tried to use this line discipline outside speakup */ + return -ENODEV; + if (tty->ops->write == NULL) return -EOPNOTSUPP; - mutex_lock(&speakup_tty_mutex); - if (speakup_tty) { - mutex_unlock(&speakup_tty_mutex); - return -EBUSY; - } - speakup_tty = tty; ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL); - if (!ldisc_data) { - speakup_tty = NULL; - mutex_unlock(&speakup_tty_mutex); + if (!ldisc_data) return -ENOMEM; - } sema_init(&ldisc_data->sem, 0); ldisc_data->buf_free = true; - speakup_tty->disc_data = ldisc_data; - mutex_unlock(&speakup_tty_mutex); + tty->disc_data = ldisc_data; return 0; } @@ -187,9 +181,25 @@ static int spk_ttyio_initialise_ldisc(struct spk_synth *synth) tty_unlock(tty); + mutex_lock(&speakup_tty_mutex); + speakup_tty = tty; ret = tty_set_ldisc(tty, N_SPEAKUP); if (ret) - pr_err("speakup: Failed to set N_SPEAKUP on tty\n"); + speakup_tty = NULL; + mutex_unlock(&speakup_tty_mutex); + + if (!ret) + /* Success */ + return 0; + + pr_err("speakup: Failed to set N_SPEAKUP on tty\n"); + + tty_lock(tty); + if (tty->ops->close) + tty->ops->close(tty, NULL); + tty_unlock(tty); + + tty_kclose(tty); return ret; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] tty: Fix ->pgrp locking in tiocspgrp()
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v5.10-rc7 commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc category: bugfix bugzilla: NA CVE: CVE-2020-29661 -------------------------------- tiocspgrp() takes two tty_struct pointers: One to the tty that userspace passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`). These pointers are different when ioctl() is called with a master fd. To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock. This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on both sides of a PTY pair to corrupt the refcount of `struct pid`, leading to use-after-free errors. Fixes: 47f86834bbd4 ("redo locking of tty->pgrp") CC: stable(a)kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/tty_jobctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c index c4ecd66fafef..a42dec3c95d0 100644 --- a/drivers/tty/tty_jobctrl.c +++ b/drivers/tty/tty_jobctrl.c @@ -494,10 +494,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t if (session_of_pgrp(pgrp) != task_session(current)) goto out_unlock; retval = 0; - spin_lock_irq(&tty->ctrl_lock); + spin_lock_irq(&real_tty->ctrl_lock); put_pid(real_tty->pgrp); real_tty->pgrp = get_pid(pgrp); - spin_unlock_irq(&tty->ctrl_lock); + spin_unlock_irq(&real_tty->ctrl_lock); out_unlock: rcu_read_unlock(); return retval; -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from linux-4.19.124 commit a507658fdb2ad8ca282b0eb42f2a40b805deb1e6 CVE: CVE-2020-27786 -------------------------------- commit c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d upstream. The rawmidi core allows user to resize the runtime buffer via ioctl, and this may lead to UAF when performed during concurrent reads or writes: the read/write functions unlock the runtime lock temporarily during copying form/to user-space, and that's the race window. This patch fixes the hole by introducing a reference counter for the runtime buffer read/write access and returns -EBUSY error when the resize is performed concurrently against read/write. Note that the ref count field is a simple integer instead of refcount_t here, since the all contexts accessing the buffer is basically protected with a spinlock, hence we need no expensive atomic ops. Also, note that this busy check is needed only against read / write functions, and not in receive/transmit callbacks; the race can happen only at the spinlock hole mentioned in the above, while the whole function is protected for receive / transmit callbacks. Reported-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWr… Link: https://lore.kernel.org/r/s5heerw3r5z.wl-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/sound/rawmidi.h | 1 + sound/core/rawmidi.c | 31 +++++++++++++++++++++++++++---- 2 files changed, 28 insertions(+), 4 deletions(-) diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h index 6665cb29e1a2..7a908a81cef4 100644 --- a/include/sound/rawmidi.h +++ b/include/sound/rawmidi.h @@ -76,6 +76,7 @@ struct snd_rawmidi_runtime { size_t avail_min; /* min avail for wakeup */ size_t avail; /* max used buffer for wakeup */ size_t xruns; /* over/underruns counter */ + int buffer_ref; /* buffer reference count */ /* misc */ spinlock_t lock; wait_queue_head_t sleep; diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index a52d6d16efc4..9b26973fe697 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -112,6 +112,17 @@ static void snd_rawmidi_input_event_work(struct work_struct *work) runtime->event(runtime->substream); } +/* buffer refcount management: call with runtime->lock held */ +static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime) +{ + runtime->buffer_ref++; +} + +static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime) +{ + runtime->buffer_ref--; +} + static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream) { struct snd_rawmidi_runtime *runtime; @@ -661,6 +672,11 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime, if (!newbuf) return -ENOMEM; spin_lock_irq(&runtime->lock); + if (runtime->buffer_ref) { + spin_unlock_irq(&runtime->lock); + kvfree(newbuf); + return -EBUSY; + } oldbuf = runtime->buffer; runtime->buffer = newbuf; runtime->buffer_size = params->buffer_size; @@ -960,8 +976,10 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream, long result = 0, count1; struct snd_rawmidi_runtime *runtime = substream->runtime; unsigned long appl_ptr; + int err = 0; spin_lock_irqsave(&runtime->lock, flags); + snd_rawmidi_buffer_ref(runtime); while (count > 0 && runtime->avail) { count1 = runtime->buffer_size - runtime->appl_ptr; if (count1 > count) @@ -980,16 +998,19 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream, if (userbuf) { spin_unlock_irqrestore(&runtime->lock, flags); if (copy_to_user(userbuf + result, - runtime->buffer + appl_ptr, count1)) { - return result > 0 ? result : -EFAULT; - } + runtime->buffer + appl_ptr, count1)) + err = -EFAULT; spin_lock_irqsave(&runtime->lock, flags); + if (err) + goto out; } result += count1; count -= count1; } + out: + snd_rawmidi_buffer_unref(runtime); spin_unlock_irqrestore(&runtime->lock, flags); - return result; + return result > 0 ? result : err; } long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream, @@ -1261,6 +1282,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, return -EAGAIN; } } + snd_rawmidi_buffer_ref(runtime); while (count > 0 && runtime->avail > 0) { count1 = runtime->buffer_size - runtime->appl_ptr; if (count1 > count) @@ -1292,6 +1314,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, } __end: count1 = runtime->avail < runtime->buffer_size; + snd_rawmidi_buffer_unref(runtime); spin_unlock_irqrestore(&runtime->lock, flags); if (count1) snd_rawmidi_output_trigger(substream, 1); -- 2.25.1

1 0

[PATCH kernel-4.19 1/5] Kconfig: disable KTASK by default
by Yang Yingliang 08 Jan '21

08 Jan '21

hulk inclusion category: bugfix bugzilla: 46923 CVE: NA ---------------------------------------------- Enable KTASK in vfio, if the BAR size of some straight through equipment device is too large, it will cause guest crash on booting. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index 6880b55901bb..71b09d998413 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -352,7 +352,7 @@ config AUDIT_TREE config KTASK bool "Multithread CPU-intensive kernel work" depends on SMP - default y + default n help Parallelize CPU-intensive kernel work. This feature is designed for big machines that can take advantage of their extra CPUs to speed up -- 2.25.1

1 4

2024

2023

2022

2021

2020

2019

Kernel