Please apply commit 941acd566b18 ("dmaengine: imx-sdma: Only check ratio
on parts that support 1:1") to the 5.1 stable branch.
Without this patch following error message is issues when writing to
UART 3 or UART 4 on an i.MX6 solo lite with Linux v5.1.4 (which fails).
imx-sdma 20ec000.sdma: Timeout waiting for CH0 ready
The problem is fixed when applying this patch on v5.1.4 tag.
regards;Richard.L
Commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream.
This is a backport to stable 3.18.y. Implementation in 3.18 differs using
chip->probing flag instead of chip->active atomic but it still has the UAF
issue.
If a USB sound card reports 0 interfaces, an error condition is triggered
and the function usb_audio_probe errors out. In the error path, there was a
use-after-free vulnerability where the memory object of the card was first
freed, followed by a decrement of the number of active chips. Moving the
decrement above the atomic_dec fixes the UAF.
[ The original problem was introduced in 3.1 kernel, while it was
developed in a different form. The Fixes tag below indicates the
original commit but it doesn't mean that the patch is applicable
cleanly. -- tiwai ]
Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
Reported-by: Hui Peng <benquike(a)gmail.com>
Reported-by: Mathias Payer <mathias.payer(a)nebelwelt.net>
Signed-off-by: Hui Peng <benquike(a)gmail.com>
Signed-off-by: Mathias Payer <mathias.payer(a)nebelwelt.net>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
[surenb(a)google.com: resolve 3.18 differences]
Signed-off-by: Suren Baghdasaryan <surenb(a)google.com>
---
Analysis for 3.18 codebase:
snd_usb_audio_create() sets card->device_data = chip
snd_usb_audio_probe() calls snd_card_free() and then resets chip->probing
snd_card_free() results in the following call chain:
snd_card_free_when_closed() which waits on release_completion
snd_card_do_free() calls snd_device_free_all() and signals release_completion
snd_card_do_free() calls __snd_device_free()
__snd_device_free() calls dev->ops->dev_free() == snd_usb_audio_dev_free()
snd_usb_audio_dev_free() calls snd_usb_audio_free(chip) and frees "chip"
chip->probing = 0 results in UAF
sound/usb/card.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/usb/card.c b/sound/usb/card.c
index f7dbdc10bf77..59fb1ef3cd55 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -593,9 +593,12 @@ snd_usb_audio_probe(struct usb_device *dev,
__error:
if (chip) {
+ /* chip->probing is inside the chip->card object,
+ * reset before memory is possibly returned.
+ */
+ chip->probing = 0;
if (!chip->num_interfaces)
snd_card_free(chip->card);
- chip->probing = 0;
}
mutex_unlock(®ister_mutex);
__err_val:
--
2.21.0.1020.gf2820cf01a-goog
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: videobuf2-core: Prevent size alignment wrapping buffer size to 0
Author: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Date: Wed Dec 12 07:27:10 2018 -0500
PAGE_ALIGN() may wrap the buffer size around to 0. Prevent this by
checking that the aligned value is not smaller than the unaligned one.
Note on backporting to stable: the file used to be under
drivers/media/v4l2-core, it was moved to the current location after 4.14.
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/common/videobuf2/videobuf2-core.c | 4 ++++
1 file changed, 4 insertions(+)
---
diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
index 3cf25abf5807..cfccee87909a 100644
--- a/drivers/media/common/videobuf2/videobuf2-core.c
+++ b/drivers/media/common/videobuf2/videobuf2-core.c
@@ -207,6 +207,10 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb)
for (plane = 0; plane < vb->num_planes; ++plane) {
unsigned long size = PAGE_ALIGN(vb->planes[plane].length);
+ /* Did it wrap around? */
+ if (size < vb->planes[plane].length)
+ goto free;
+
mem_priv = call_ptr_memop(vb, alloc,
q->alloc_devs[plane] ? : q->dev,
q->dma_attrs, size, q->dma_dir, q->gfp_flags);
This is an automatic generated email to let you know that the following patch were queued:
Subject: media: videobuf2-dma-sg: Prevent size from overflowing
Author: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Date: Wed Dec 12 07:44:14 2018 -0500
buf->size is an unsigned long; casting that to int will lead to an
overflow if buf->size exceeds INT_MAX.
Fix this by changing the type to unsigned long instead. This is possible
as the buf->size is always aligned to PAGE_SIZE, and therefore the size
will never have values lesser than 0.
Note on backporting to stable: the file used to be under
drivers/media/v4l2-core, it was moved to the current location after 4.14.
Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com>
Cc: stable(a)vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung(a)kernel.org>
drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
index 4a4c49d6085c..0f06f08346ba 100644
--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
@@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct vb2_dma_sg_buf *buf,
gfp_t gfp_flags)
{
unsigned int last_page = 0;
- int size = buf->size;
+ unsigned long size = buf->size;
while (size > 0) {
struct page *pages;