This is the start of the stable review cycle for the 4.4.286 release.
There are 41 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 07 Oct 2021 08:32:44 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.286-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.286-rc2
NeilBrown <neilb(a)suse.com>
cred: allow get_cred() and put_cred() to be given NULL.
Anirudh Rayabharam <mail(a)anirudhrb.com>
HID: usbhid: free raw_report buffers in usbhid_stop
Jozsef Kadlecsik <kadlec(a)netfilter.org>
netfilter: ipset: Fix oversized kvmalloc() calls
F.A.Sulaiman <asha.16(a)itfac.mrt.ac.lk>
HID: betop: fix slab-out-of-bounds Write in betop_probe
Suzuki K Poulose <suzuki.poulose(a)arm.com>
arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55
Sai Krishna Potthuri <lakshmi.sai.krishna.potthuri(a)xilinx.com>
EDAC/synopsys: Fix wrong value type assignment for edac_mode
yangerkun <yangerkun(a)huawei.com>
ext4: fix potential infinite loop in ext4_dx_readdir()
Johan Hovold <johan(a)kernel.org>
ipack: ipoctal: fix module reference leak
Johan Hovold <johan(a)kernel.org>
ipack: ipoctal: fix missing allocation-failure check
Johan Hovold <johan(a)kernel.org>
ipack: ipoctal: fix tty-registration error handling
Johan Hovold <johan(a)kernel.org>
ipack: ipoctal: fix tty registration race
Johan Hovold <johan(a)kernel.org>
ipack: ipoctal: fix stack information leak
Jacob Keller <jacob.e.keller(a)intel.com>
e100: fix buffer overrun in e100_get_regs
Jacob Keller <jacob.e.keller(a)intel.com>
e100: fix length calculation in e100_get_regs_len
Andrea Claudi <aclaudi(a)redhat.com>
ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
Johannes Berg <johannes.berg(a)intel.com>
mac80211: fix use-after-free in CCMP/GCMP RX
Igor Matheus Andrade Torrente <igormtorrente(a)gmail.com>
tty: Fix out-of-bound vmalloc access in imageblit
Linus Torvalds <torvalds(a)linux-foundation.org>
qnx4: work around gcc false positive warning bug
Linus Torvalds <torvalds(a)linux-foundation.org>
spi: Fix tegra20 build with CONFIG_PM=n
Guenter Roeck <linux(a)roeck-us.net>
net: 6pack: Fix tx timeout and slot time
Guenter Roeck <linux(a)roeck-us.net>
alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile
Dan Li <ashimida(a)linux.alibaba.com>
arm64: Mark __stack_chk_guard as __ro_after_init
Helge Deller <deller(a)gmx.de>
parisc: Use absolute_pointer() to define PAGE0
Linus Torvalds <torvalds(a)linux-foundation.org>
qnx4: avoid stringop-overread errors
Linus Torvalds <torvalds(a)linux-foundation.org>
sparc: avoid stringop-overread errors
Guenter Roeck <linux(a)roeck-us.net>
net: i825xx: Use absolute_pointer for memcpy from fixed memory location
Guenter Roeck <linux(a)roeck-us.net>
compiler.h: Introduce absolute_pointer macro
Guenter Roeck <linux(a)roeck-us.net>
m68k: Double cast io functions to unsigned long
Zhihao Cheng <chengzhihao1(a)huawei.com>
blktrace: Fix uaf in blk_trace access after removing by sysfs
Baokun Li <libaokun1(a)huawei.com>
scsi: iscsi: Adjust iface sysfs attr detection
Aya Levin <ayal(a)nvidia.com>
net/mlx4_en: Don't allow aRFS for encapsulated packets
Johan Hovold <johan(a)kernel.org>
net: hso: fix muxed tty registration
Slark Xiao <slark_xiao(a)163.com>
USB: serial: option: add device id for Foxconn T99W265
Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
USB: serial: option: remove duplicate USB device ID
Carlo Lobrano <c.lobrano(a)gmail.com>
USB: serial: option: add Telit LN920 compositions
Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
USB: serial: mos7840: remove duplicated 0xac24 device ID
Uwe Brandt <uwe.brandt(a)gmail.com>
USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
Jan Beulich <jbeulich(a)suse.com>
xen/x86: fix PV trap handling on secondary processors
Steve French <stfrench(a)microsoft.com>
cifs: fix incorrect check for null pointer in header_assemble
Dan Carpenter <dan.carpenter(a)oracle.com>
usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
Dan Carpenter <dan.carpenter(a)oracle.com>
usb: gadget: r8a66597: fix a loop in set_feature()
-------------
Diffstat:
Makefile | 4 +-
arch/alpha/include/asm/io.h | 6 +--
arch/arm64/Kconfig | 2 +-
arch/arm64/kernel/process.c | 2 +-
arch/arm64/mm/proc.S | 4 +-
arch/m68k/include/asm/raw_io.h | 20 ++++----
arch/parisc/include/asm/page.h | 2 +-
arch/sparc/kernel/mdesc.c | 3 +-
arch/x86/xen/enlighten.c | 15 +++---
drivers/edac/synopsys_edac.c | 2 +-
drivers/hid/hid-betopff.c | 13 +++--
drivers/hid/usbhid/hid-core.c | 13 ++++-
drivers/ipack/devices/ipoctal.c | 63 +++++++++++++++++------
drivers/net/ethernet/i825xx/82596.c | 2 +-
drivers/net/ethernet/intel/e100.c | 22 +++++---
drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 3 ++
drivers/net/hamradio/6pack.c | 4 +-
drivers/net/usb/hso.c | 12 ++---
drivers/scsi/scsi_transport_iscsi.c | 8 +--
drivers/spi/spi-tegra20-slink.c | 4 +-
drivers/tty/vt/vt.c | 21 +++++++-
drivers/usb/gadget/udc/r8a66597-udc.c | 2 +-
drivers/usb/musb/tusb6010.c | 1 +
drivers/usb/serial/cp210x.c | 1 +
drivers/usb/serial/mos7840.c | 2 -
drivers/usb/serial/option.c | 11 +++-
fs/cifs/connect.c | 5 +-
fs/ext4/dir.c | 6 +--
fs/qnx4/dir.c | 69 +++++++++++++++++++-------
include/linux/compiler.h | 2 +
include/linux/cred.h | 14 ++++--
kernel/trace/blktrace.c | 8 +++
net/mac80211/wpa.c | 6 +++
net/netfilter/ipset/ip_set_hash_gen.h | 4 +-
net/netfilter/ipvs/ip_vs_conn.c | 4 ++
35 files changed, 254 insertions(+), 106 deletions(-)
Commit f5cb779ba163 ("ANDROID: binder: remove waitqueue when thread
exits.") fixed the use-after-free in eventpoll but aio still has the
same issue because it doesn't honor the POLLFREE flag.
Add support for the POLLFREE flag to force complete iocb inline in
aio_poll_wake(). A thread may use it to signal it's exit and/or request
to cleanup while pending poll request. In this case, aio_poll_wake()
needs to make sure it doesn't keep any reference to the queue entry
before returning from wake to avoid possible use after free via
poll_cancel() path.
The POLLFREE flag is no more exclusive to the epoll and is being
shared with the aio. Remove comment from poll.h to avoid confusion.
This fixes a use after free issue between binder thread and aio
interactions in certain sequence of events [1].
[1] https://lore.kernel.org/all/CAKUd0B_TCXRY4h1hTztfwWbNSFQqsudDLn2S_28csgWZmZ…
Fixes: f5cb779ba163 ("ANDROID: binder: remove waitqueue when thread exits.")
Signed-off-by: Ramji Jiyani <ramjiyani(a)google.com>
Reviewed-by: Jeff Moyer <jmoyer(a)redhat.com>
Cc: stable(a)vger.kernel.org # 4.19+
---
Changes since v1:
- Removed parenthesis around POLLFREE macro definition as per review.
- Updated description to refer UAF issue discussion this patch fixes.
- Updated description to remove reference to parenthesis change.
- Added Reviewed-by
Changes since v2:
- Added Fixes tag.
- Added stable tag for backporting on 4.19+ LTS releases
---
fs/aio.c | 45 ++++++++++++++++++---------------
include/uapi/asm-generic/poll.h | 2 +-
2 files changed, 26 insertions(+), 21 deletions(-)
diff --git a/fs/aio.c b/fs/aio.c
index 51b08ab01dff..5d539c05df42 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1674,6 +1674,7 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
{
struct poll_iocb *req = container_of(wait, struct poll_iocb, wait);
struct aio_kiocb *iocb = container_of(req, struct aio_kiocb, poll);
+ struct kioctx *ctx = iocb->ki_ctx;
__poll_t mask = key_to_poll(key);
unsigned long flags;
@@ -1683,29 +1684,33 @@ static int aio_poll_wake(struct wait_queue_entry *wait, unsigned mode, int sync,
list_del_init(&req->wait.entry);
- if (mask && spin_trylock_irqsave(&iocb->ki_ctx->ctx_lock, flags)) {
- struct kioctx *ctx = iocb->ki_ctx;
+ /*
+ * Use irqsave/irqrestore because not all filesystems (e.g. fuse)
+ * call this function with IRQs disabled and because IRQs have to
+ * be disabled before ctx_lock is obtained.
+ */
+ if (mask & POLLFREE) {
+ /* Force complete iocb inline to remove refs to deleted entry */
+ spin_lock_irqsave(&ctx->ctx_lock, flags);
+ } else if (!(mask && spin_trylock_irqsave(&ctx->ctx_lock, flags))) {
+ /* Can't complete iocb inline; schedule for later */
+ schedule_work(&req->work);
+ return 1;
+ }
- /*
- * Try to complete the iocb inline if we can. Use
- * irqsave/irqrestore because not all filesystems (e.g. fuse)
- * call this function with IRQs disabled and because IRQs
- * have to be disabled before ctx_lock is obtained.
- */
- list_del(&iocb->ki_list);
- iocb->ki_res.res = mangle_poll(mask);
- req->done = true;
- if (iocb->ki_eventfd && eventfd_signal_allowed()) {
- iocb = NULL;
- INIT_WORK(&req->work, aio_poll_put_work);
- schedule_work(&req->work);
- }
- spin_unlock_irqrestore(&ctx->ctx_lock, flags);
- if (iocb)
- iocb_put(iocb);
- } else {
+ /* complete iocb inline */
+ list_del(&iocb->ki_list);
+ iocb->ki_res.res = mangle_poll(mask);
+ req->done = true;
+ if (iocb->ki_eventfd && eventfd_signal_allowed()) {
+ iocb = NULL;
+ INIT_WORK(&req->work, aio_poll_put_work);
schedule_work(&req->work);
}
+ spin_unlock_irqrestore(&ctx->ctx_lock, flags);
+ if (iocb)
+ iocb_put(iocb);
+
return 1;
}
diff --git a/include/uapi/asm-generic/poll.h b/include/uapi/asm-generic/poll.h
index 41b509f410bf..f9c520ce4bf4 100644
--- a/include/uapi/asm-generic/poll.h
+++ b/include/uapi/asm-generic/poll.h
@@ -29,7 +29,7 @@
#define POLLRDHUP 0x2000
#endif
-#define POLLFREE (__force __poll_t)0x4000 /* currently only for epoll */
+#define POLLFREE (__force __poll_t)0x4000
#define POLL_BUSY_LOOP (__force __poll_t)0x8000
--
2.33.0.800.g4c38ced690-goog