This is the start of the stable review cycle for the 5.1.3 release.
There are 46 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri 17 May 2019 09:04:22 AM UTC.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.1.3-rc1.…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.1.3-rc1
Damien Le Moal <damien.lemoal(a)wdc.com>
f2fs: Fix use of number of devices
Dexuan Cui <decui(a)microsoft.com>
PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary
Dexuan Cui <decui(a)microsoft.com>
PCI: hv: Add hv_pci_remove_slots() when we unload the driver
Dexuan Cui <decui(a)microsoft.com>
PCI: hv: Fix a memory leak in hv_eject_device_work()
YueHaibing <yuehaibing(a)huawei.com>
virtio_ring: Fix potential mem leak in virtqueue_add_indirect_packed
Laurentiu Tudor <laurentiu.tudor(a)nxp.com>
powerpc/booke64: set RI in default MSR
Russell Currey <ruscur(a)russell.cc>
powerpc/powernv/idle: Restore IAMR after idle
Rick Lindsley <ricklind(a)linux.vnet.ibm.com>
powerpc/book3s/64: check for NULL pointer in pgd_alloc()
Dan Carpenter <dan.carpenter(a)oracle.com>
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
Dan Carpenter <dan.carpenter(a)oracle.com>
drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
Paul Bolle <pebolle(a)tiscali.nl>
isdn: bas_gigaset: use usb_fill_int_urb() properly
Eric Dumazet <edumazet(a)google.com>
flow_dissector: disable preemption around BPF calls
Heiner Kallweit <hkallweit1(a)gmail.com>
net: phy: fix phy_validate_pause
Jason Wang <jasowang(a)redhat.com>
tuntap: synchronize through tfiles array instead of tun->numqueues
Jason Wang <jasowang(a)redhat.com>
tuntap: fix dividing by zero in ebpf queue selection
Oliver Neukum <oneukum(a)suse.com>
aqc111: fix double endianness swap on BE
Oliver Neukum <oneukum(a)suse.com>
aqc111: fix writing to the phy on BE
Oliver Neukum <oneukum(a)suse.com>
aqc111: fix endianness issue in aqc111_change_mtu
Stephen Suryaputra <ssuryaextr(a)gmail.com>
vrf: sit mtu should not be updated when vrf netdev is the link
Hangbin Liu <liuhangbin(a)gmail.com>
vlan: disable SIOCSHWTSTAMP in container
Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan(a)gmail.com>
tipc: fix hanging clients using poll with EPOLLOUT flag
Paolo Abeni <pabeni(a)redhat.com>
selinux: do not report error on connect(AF_UNSPEC)
YueHaibing <yuehaibing(a)huawei.com>
packet: Fix error path in packet_init
Christophe Leroy <christophe.leroy(a)c-s.fr>
net: ucc_geth - fix Oops when changing number of buffers in the ring
Thomas Bogendoerfer <tbogendoerfer(a)suse.de>
net: seeq: fix crash caused by not set dev.parent
Harini Katakam <harini.katakam(a)xilinx.com>
net: macb: Change interrupt and napi enable order in open
Corentin Labbe <clabbe(a)baylibre.com>
net: ethernet: stmmac: dwmac-sun8i: enable support of unicast filtering
YueHaibing <yuehaibing(a)huawei.com>
net: dsa: Fix error cleanup path in dsa_init_module
David Ahern <dsahern(a)gmail.com>
ipv4: Fix raw socket lookup for local traffic
Hangbin Liu <liuhangbin(a)gmail.com>
fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied
Laurentiu Tudor <laurentiu.tudor(a)nxp.com>
dpaa_eth: fix SG frame cleanup
Tobin C. Harding <tobin(a)kernel.org>
bridge: Fix error path for kobject_init_and_add()
Jarod Wilson <jarod(a)redhat.com>
bonding: fix arp_validate toggling in active-backup mode
Nigel Croxon <ncroxon(a)redhat.com>
Don't jump to compute_result state from check_result state
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
rtlwifi: rtl8723ae: Fix missing break in switch statement
Petr Štetiar <ynezz(a)true.cz>
mwl8k: Fix rate_idx underflow
Johan Hovold <johan(a)kernel.org>
USB: serial: fix unthrottle races
Hans de Goede <hdegoede(a)redhat.com>
virt: vbox: Sanity-check parameter types for hgcm-calls coming from userspace
Andrea Parri <andrea.parri(a)amarulasolutions.com>
kernfs: fix barrier usage in __kernfs_new_node()
Wolfram Sang <wsa+renesas(a)sang-engineering.com>
i2c: core: ratelimit 'transfer when suspended' errors
Kees Cook <keescook(a)chromium.org>
selftests/seccomp: Handle namespace failures gracefully
Lei YU <mine260309(a)gmail.com>
hwmon: (occ) Fix extended status bits
Stefan Wahren <stefan.wahren(a)i2se.com>
hwmon: (pwm-fan) Disable PWM if fetching cooling data fails
Mario Limonciello <mario.limonciello(a)dell.com>
platform/x86: dell-laptop: fix rfkill functionality
Jiaxun Yang <jiaxun.yang(a)flygoat.com>
platform/x86: thinkpad_acpi: Disable Bluetooth for some machines
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
platform/x86: sony-laptop: Fix unintentional fall-through
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/include/asm/book3s/64/pgalloc.h | 3 +
arch/powerpc/include/asm/reg_booke.h | 2 +-
arch/powerpc/kernel/idle_book3s.S | 20 ++++++
drivers/hwmon/occ/sysfs.c | 8 +--
drivers/hwmon/pwm-fan.c | 2 +-
drivers/i2c/i2c-core-base.c | 5 +-
drivers/isdn/gigaset/bas-gigaset.c | 9 +--
drivers/md/raid5.c | 19 ++----
drivers/net/bonding/bond_options.c | 7 ---
drivers/net/ethernet/cadence/macb_main.c | 6 +-
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +-
drivers/net/ethernet/freescale/ucc_geth_ethtool.c | 8 +--
drivers/net/ethernet/seeq/sgiseeq.c | 1 +
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 2 +
drivers/net/phy/phy_device.c | 11 ++--
drivers/net/tun.c | 14 ++++-
drivers/net/usb/aqc111.c | 31 +++++++---
drivers/net/wireless/marvell/mwl8k.c | 13 ++--
.../net/wireless/realtek/rtlwifi/rtl8723ae/hw.c | 1 +
drivers/pci/controller/pci-hyperv.c | 23 +++++++
drivers/platform/x86/dell-laptop.c | 6 +-
drivers/platform/x86/sony-laptop.c | 8 ++-
drivers/platform/x86/thinkpad_acpi.c | 72 +++++++++++++++++++++-
drivers/usb/serial/generic.c | 39 +++++++++---
drivers/virt/fsl_hypervisor.c | 29 +++++----
drivers/virt/vboxguest/vboxguest_core.c | 31 ++++++++++
drivers/virtio/virtio_ring.c | 1 +
fs/f2fs/data.c | 17 +++--
fs/f2fs/f2fs.h | 13 +++-
fs/f2fs/file.c | 2 +-
fs/f2fs/gc.c | 2 +-
fs/f2fs/segment.c | 13 ++--
fs/kernfs/dir.c | 5 +-
include/linux/i2c.h | 3 +-
net/8021q/vlan_dev.c | 4 +-
net/bridge/br_if.c | 13 ++--
net/core/fib_rules.c | 6 +-
net/core/flow_dissector.c | 3 +
net/dsa/dsa.c | 11 +++-
net/ipv4/raw.c | 4 +-
net/ipv6/sit.c | 2 +-
net/packet/af_packet.c | 25 ++++++--
net/tipc/socket.c | 4 +-
security/selinux/hooks.c | 8 +--
tools/testing/selftests/seccomp/seccomp_bpf.c | 43 +++++++------
46 files changed, 399 insertions(+), 156 deletions(-)
From: Eric Biggers <ebiggers(a)google.com>
The "hmac(sha3-224-generic)" algorithm has a descsize of 368 bytes,
which is greater than HASH_MAX_DESCSIZE (360) which is only enough for
sha3-224-generic. The check in shash_prepare_alg() doesn't catch this
because the HMAC template doesn't set descsize on the algorithms, but
rather sets it on each individual HMAC transform.
This causes a stack buffer overflow when SHASH_DESC_ON_STACK() is used
with hmac(sha3-224-generic).
Fix it by increasing HASH_MAX_DESCSIZE to the real maximum. Also add a
sanity check to hmac_init().
This was detected by the improved crypto self-tests in v5.2, by loading
the tcrypt module with CONFIG_CRYPTO_MANAGER_EXTRA_TESTS=y enabled. I
didn't notice this bug when I ran the self-tests by requesting the
algorithms via AF_ALG (i.e., not using tcrypt), probably because the
stack layout differs in the two cases and that made a difference here.
KASAN report:
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:359 [inline]
BUG: KASAN: stack-out-of-bounds in shash_default_import+0x52/0x80 crypto/shash.c:223
Write of size 360 at addr ffff8880651defc8 by task insmod/3689
CPU: 2 PID: 3689 Comm: insmod Tainted: G E 5.1.0-10741-g35c99ffa20edd #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x86/0xc5 lib/dump_stack.c:113
print_address_description+0x7f/0x260 mm/kasan/report.c:188
__kasan_report+0x144/0x187 mm/kasan/report.c:317
kasan_report+0x12/0x20 mm/kasan/common.c:614
check_memory_region_inline mm/kasan/generic.c:185 [inline]
check_memory_region+0x137/0x190 mm/kasan/generic.c:191
memcpy+0x37/0x50 mm/kasan/common.c:125
memcpy include/linux/string.h:359 [inline]
shash_default_import+0x52/0x80 crypto/shash.c:223
crypto_shash_import include/crypto/hash.h:880 [inline]
hmac_import+0x184/0x240 crypto/hmac.c:102
hmac_init+0x96/0xc0 crypto/hmac.c:107
crypto_shash_init include/crypto/hash.h:902 [inline]
shash_digest_unaligned+0x9f/0xf0 crypto/shash.c:194
crypto_shash_digest+0xe9/0x1b0 crypto/shash.c:211
generate_random_hash_testvec.constprop.11+0x1ec/0x5b0 crypto/testmgr.c:1331
test_hash_vs_generic_impl+0x3f7/0x5c0 crypto/testmgr.c:1420
__alg_test_hash+0x26d/0x340 crypto/testmgr.c:1502
alg_test_hash+0x22e/0x330 crypto/testmgr.c:1552
alg_test.part.7+0x132/0x610 crypto/testmgr.c:4931
alg_test+0x1f/0x40 crypto/testmgr.c:4952
Fixes: b68a7ec1e9a3 ("crypto: hash - Remove VLA usage")
Reported-by: Corentin Labbe <clabbe.montjoie(a)gmail.com>
Cc: <stable(a)vger.kernel.org> # v4.20+
Cc: Kees Cook <keescook(a)chromium.org>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
crypto/hmac.c | 2 ++
include/crypto/hash.h | 8 +++++++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/crypto/hmac.c b/crypto/hmac.c
index a68c1266121f5..241b1868c1d01 100644
--- a/crypto/hmac.c
+++ b/crypto/hmac.c
@@ -157,6 +157,8 @@ static int hmac_init_tfm(struct crypto_tfm *tfm)
parent->descsize = sizeof(struct shash_desc) +
crypto_shash_descsize(hash);
+ if (WARN_ON(parent->descsize > HASH_MAX_DESCSIZE))
+ return -EINVAL;
ctx->hash = hash;
return 0;
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index d21bea2c43829..d6702b4a457f9 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -150,7 +150,13 @@ struct shash_desc {
};
#define HASH_MAX_DIGESTSIZE 64
-#define HASH_MAX_DESCSIZE 360
+
+/*
+ * Worst case is hmac(sha3-224-generic). Its context is a nested 'shash_desc'
+ * containing a 'struct sha3_state'.
+ */
+#define HASH_MAX_DESCSIZE (sizeof(struct shash_desc) + 360)
+
#define HASH_MAX_STATESIZE 512
#define SHASH_DESC_ON_STACK(shash, ctx) \
--
2.21.0.1020.gf2820cf01a-goog