The idea is to check: a) the owning user_ns of cgroup_ns, b)
capabilities in init_user_ns.
The commit 24f600856418 ("cgroup-v1: Require capabilities to set
release_agent") got this wrong in the write handler of release_agent
since it checked user_ns of the opener (may be different from the owning
user_ns of cgroup_ns).
Secondly, to avoid possibly confused deputy, the capability of the
opener must be checked.
Fixes: 24f600856418 ("cgroup-v1: Require capabilities to set release_agent")
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/stable/20220216121142.GB30035@blackbody.suse.cz/
Signed-off-by: Michal Koutný <mkoutny(a)suse.com>
---
kernel/cgroup/cgroup-v1.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 0e877dbcfeea..afc6c0e9c966 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -546,6 +546,7 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
char *buf, size_t nbytes, loff_t off)
{
struct cgroup *cgrp;
+ struct cgroup_file_ctx *ctx;
BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
@@ -553,8 +554,9 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
* Release agent gets called with all capabilities,
* require capabilities to set release agent.
*/
- if ((of->file->f_cred->user_ns != &init_user_ns) ||
- !capable(CAP_SYS_ADMIN))
+ ctx = of->priv;
+ if ((ctx->ns->user_ns != &init_user_ns) ||
+ !file_ns_capable(of->file, &init_user_ns, CAP_SYS_ADMIN))
return -EPERM;
cgrp = cgroup_kn_lock_live(of->kn, false);
--
2.34.1
This is the start of the stable review cycle for the 4.19.231 release.
There are 58 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.231-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.231-rc1
Marc St-Amand <mstamand(a)ciena.com>
net: macb: Align the dma and coherent dma masks
Slark Xiao <slark_xiao(a)163.com>
net: usb: qmi_wwan: Add support for Dell DW5829e
JaeSang Yoo <js.yoo.5b(a)gmail.com>
tracing: Fix tp_printk option related with tp_printk_stop_on_boot
Zoltán Böszörményi <zboszor(a)gmail.com>
ata: libata-core: Disable TRIM on M88V29
Brenda Streiff <brenda.streiff(a)ni.com>
kconfig: let 'shell' return enough output for deep path names
Christian Hewitt <christianshewitt(a)gmail.com>
arm64: dts: meson-gx: add ATF BL32 reserved-memory region
Florian Westphal <fw(a)strlen.de>
netfilter: conntrack: don't refresh sctp entries in closed state
Guo Ren <guoren(a)linux.alibaba.com>
irqchip/sifive-plic: Add missing thead,c900-plic match string
Wan Jiabing <wanjiabing(a)vivo.com>
ARM: OMAP2+: hwmod: Add of_node_put() before break
Jim Mattson <jmattson(a)google.com>
KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
Miaoqian Lin <linmq006(a)gmail.com>
Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
Kimberly Brown <kimbrownkd(a)gmail.com>
Drivers: hv: vmbus: Expose monitor data only when monitor pages are used
david regan <dregan(a)mail.com>
mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
Kamal Dasu <kdasu.kdev(a)gmail.com>
mtd: rawnand: brcmnand: Refactored code to introduce helper functions
Rafał Miłecki <rafal(a)milecki.pl>
i2c: brcmstb: fix support for DSL and CM variants
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
dmaengine: sh: rcar-dmac: Check for error num after setting mask
Eric Dumazet <edumazet(a)google.com>
net: sched: limit TC_ACT_REPEAT loops
Eliav Farber <farbere(a)amazon.com>
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Do not report writeback errors in nfs_getattr()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: LOOKUP_DIRECTORY is also ok with symlinks
Laibin Qiu <qiulaibin(a)huawei.com>
block/wbt: fix negative inflight counter when remove scsi device
Zhang Yi <yi.zhang(a)huawei.com>
ext4: check for out-of-order index extents in ext4_valid_extent_entries()
Anders Roxell <anders.roxell(a)linaro.org>
powerpc/lib/sstep: fix 'ptesync' build error
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix missing codec probe on Shenker Dock 15
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix regression on forced probe mask option
Kees Cook <keescook(a)chromium.org>
libsubcmd: Fix use-after-free for realloc(..., 0)
Eric Dumazet <edumazet(a)google.com>
bonding: fix data-races around agg_select_timer
Eric Dumazet <edumazet(a)google.com>
drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
Xin Long <lucien.xin(a)gmail.com>
ping: fix the dif and sdif check in ping_lookup
Miquel Raynal <miquel.raynal(a)bootlin.com>
net: ieee802154: ca8210: Fix lifs/sifs periods
Mans Rullgard <mans(a)mansr.com>
net: dsa: lan9303: fix reset on probe
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: gen2: fix locking when "HW not ready"
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: fix locking when "HW not ready"
Seth Forshee <sforshee(a)digitalocean.com>
vsock: remove vsock from connected table when connect is interrupted by a signal
Christian Löhle <CLoehle(a)hyperstone.com>
mmc: block: fix read single on recovery logic
Eric W. Biederman <ebiederm(a)xmission.com>
taskstats: Cleanup the use of task->exit_code
Guillaume Nault <gnault(a)redhat.com>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
Nicholas Bishop <nicholasbishop(a)google.com>
drm/radeon: Fix backlight control on iMac 12,1
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: fix use-after-free
Igor Pylypiv <ipylypiv(a)google.com>
Revert "module, async: async_synchronize_full() on module init iff async is used"
Sagi Grimberg <sagi(a)grimberg.me>
nvme-rdma: fix possible use-after-free in transport error_recovery work
Sagi Grimberg <sagi(a)grimberg.me>
nvme: fix a possible use-after-free in controller reset during load
Darrick J. Wong <djwong(a)kernel.org>
quota: make dquot_quota_sync return errors from ->sync_fs
Darrick J. Wong <djwong(a)kernel.org>
vfs: make freeze_super abort when sync_filesystem returns error
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: improve the incomplete fix to avoid UAF and NPD bugs
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Adapt the situation that /dev/zram0 is being used
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram01.sh: Fix compression ratio calculation
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Skip max_comp_streams interface on newer kernel
Miquel Raynal <miquel.raynal(a)bootlin.com>
net: ieee802154: at86rf230: Stop leaking skb's
Dāvis Mosāns <davispuh(a)gmail.com>
btrfs: send: in case of IO error log it
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix sglist access in ccio-dma.c
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix data TLB miss in sba_unmap_sg
Randy Dunlap <rdunlap(a)infradead.org>
serial: parisc: GSC: fix build when IOSAPIC is not set
Jann Horn <jannh(a)google.com>
net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
Nathan Chancellor <nathan(a)kernel.org>
Makefile.extrawarn: Move -Wunaligned-access to W=1
-------------
Diffstat:
Documentation/ABI/stable/sysfs-bus-vmbus | 12 +-
Makefile | 4 +-
arch/arm/mach-omap2/omap_hwmod.c | 4 +-
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +
arch/powerpc/lib/sstep.c | 2 +
arch/x86/kvm/pmu.c | 2 +-
block/bfq-iosched.c | 2 +
block/elevator.c | 2 -
drivers/ata/libata-core.c | 1 +
drivers/dma/sh/rcar-dmac.c | 4 +-
drivers/edac/edac_mc.c | 2 +-
drivers/gpu/drm/radeon/atombios_encoders.c | 3 +-
drivers/hv/channel_mgmt.c | 1 +
drivers/hv/hyperv_vmbus.h | 2 +
drivers/hv/vmbus_drv.c | 82 ++++++++++++-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/irqchip/irq-sifive-plic.c | 1 +
drivers/mmc/core/block.c | 28 ++---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 102 ++++++++++------
drivers/mtd/nand/raw/qcom_nandc.c | 14 +--
drivers/net/bonding/bond_3ad.c | 30 ++++-
drivers/net/dsa/lan9303-core.c | 2 +-
drivers/net/ethernet/cadence/macb_main.c | 2 +-
drivers/net/ieee802154/at86rf230.c | 13 +-
drivers/net/ieee802154/ca8210.c | 4 +-
drivers/net/usb/ax88179_178a.c | 68 ++++++-----
drivers/net/usb/qmi_wwan.c | 2 +
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +
.../net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 3 +-
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +-
drivers/nvme/host/core.c | 9 +-
drivers/nvme/host/rdma.c | 1 +
drivers/parisc/ccio-dma.c | 3 +-
drivers/parisc/sba_iommu.c | 3 +-
drivers/tty/serial/8250/8250_gsc.c | 2 +-
fs/btrfs/send.c | 4 +
fs/ext4/extents.c | 21 ++--
fs/nfs/dir.c | 4 +-
fs/nfs/inode.c | 9 +-
fs/quota/dquot.c | 11 +-
fs/super.c | 19 +--
include/linux/sched.h | 1 -
include/net/bond_3ad.h | 2 +-
kernel/async.c | 3 -
kernel/module.c | 25 +---
kernel/trace/trace.c | 4 +
kernel/tsacct.c | 7 +-
net/ax25/af_ax25.c | 9 +-
net/core/drop_monitor.c | 11 +-
net/ipv4/ping.c | 11 +-
net/ipv4/xfrm4_policy.c | 3 +-
net/netfilter/nf_conntrack_proto_sctp.c | 9 ++
net/sched/act_api.c | 13 +-
net/vmw_vsock/af_vsock.c | 1 +
scripts/Makefile.extrawarn | 1 +
scripts/kconfig/preprocess.c | 2 +-
sound/pci/hda/hda_intel.c | 5 +-
sound/soc/soc-ops.c | 29 +++--
tools/lib/subcmd/subcmd-util.h | 11 +-
tools/testing/selftests/zram/zram.sh | 15 +--
tools/testing/selftests/zram/zram01.sh | 33 ++---
tools/testing/selftests/zram/zram02.sh | 1 -
tools/testing/selftests/zram/zram_lib.sh | 134 ++++++++++++++-------
63 files changed, 526 insertions(+), 295 deletions(-)
This is the start of the stable review cycle for the 4.9.303 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.303-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.303-rc1
Slark Xiao <slark_xiao(a)163.com>
net: usb: qmi_wwan: Add support for Dell DW5829e
JaeSang Yoo <js.yoo.5b(a)gmail.com>
tracing: Fix tp_printk option related with tp_printk_stop_on_boot
Zoltán Böszörményi <zboszor(a)gmail.com>
ata: libata-core: Disable TRIM on M88V29
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Do not report writeback errors in nfs_getattr()
Jim Mattson <jmattson(a)google.com>
KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
Rafał Miłecki <rafal(a)milecki.pl>
i2c: brcmstb: fix support for DSL and CM variants
Eliav Farber <farbere(a)amazon.com>
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: LOOKUP_DIRECTORY is also ok with symlinks
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix missing codec probe on Shenker Dock 15
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix regression on forced probe mask option
Kees Cook <keescook(a)chromium.org>
libsubcmd: Fix use-after-free for realloc(..., 0)
Eric Dumazet <edumazet(a)google.com>
drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: fix locking when "HW not ready"
Seth Forshee <sforshee(a)digitalocean.com>
vsock: remove vsock from connected table when connect is interrupted by a signal
Sunil Muthuswamy <sunilmut(a)microsoft.com>
vsock: correct removal of socket from the list
Eric W. Biederman <ebiederm(a)xmission.com>
taskstats: Cleanup the use of task->exit_code
Guillaume Nault <gnault(a)redhat.com>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
Nicholas Bishop <nicholasbishop(a)google.com>
drm/radeon: Fix backlight control on iMac 12,1
Darrick J. Wong <djwong(a)kernel.org>
quota: make dquot_quota_sync return errors from ->sync_fs
Darrick J. Wong <djwong(a)kernel.org>
vfs: make freeze_super abort when sync_filesystem returns error
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: improve the incomplete fix to avoid UAF and NPD bugs
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Adapt the situation that /dev/zram0 is being used
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram01.sh: Fix compression ratio calculation
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Skip max_comp_streams interface on newer kernel
Miquel Raynal <miquel.raynal(a)bootlin.com>
net: ieee802154: at86rf230: Stop leaking skb's
Dāvis Mosāns <davispuh(a)gmail.com>
btrfs: send: in case of IO error log it
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix sglist access in ccio-dma.c
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix data TLB miss in sba_unmap_sg
Randy Dunlap <rdunlap(a)infradead.org>
serial: parisc: GSC: fix build when IOSAPIC is not set
Jann Horn <jannh(a)google.com>
net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
Nathan Chancellor <nathan(a)kernel.org>
Makefile.extrawarn: Move -Wunaligned-access to W=1
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kvm/pmu.c | 2 +-
drivers/ata/libata-core.c | 1 +
drivers/edac/edac_mc.c | 2 +-
drivers/gpu/drm/radeon/atombios_encoders.c | 3 +-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/net/ieee802154/at86rf230.c | 13 ++-
drivers/net/usb/ax88179_178a.c | 68 +++++++-----
drivers/net/usb/qmi_wwan.c | 2 +
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +-
drivers/parisc/ccio-dma.c | 3 +-
drivers/parisc/sba_iommu.c | 3 +-
drivers/tty/serial/8250/8250_gsc.c | 2 +-
fs/btrfs/send.c | 4 +
fs/nfs/dir.c | 4 +-
fs/nfs/inode.c | 7 +-
fs/quota/dquot.c | 11 +-
fs/super.c | 19 ++--
kernel/trace/trace.c | 4 +
kernel/tsacct.c | 7 +-
net/ax25/af_ax25.c | 9 +-
net/core/drop_monitor.c | 11 +-
net/ipv4/xfrm4_policy.c | 3 +-
net/vmw_vsock/af_vsock.c | 39 ++-----
scripts/Makefile.extrawarn | 1 +
sound/pci/hda/hda_intel.c | 5 +-
sound/soc/soc-ops.c | 29 +++--
tools/lib/subcmd/subcmd-util.h | 11 +-
tools/testing/selftests/zram/zram.sh | 15 +--
tools/testing/selftests/zram/zram01.sh | 33 ++----
tools/testing/selftests/zram/zram02.sh | 1 -
tools/testing/selftests/zram/zram_lib.sh | 134 ++++++++++++++++--------
32 files changed, 250 insertions(+), 205 deletions(-)
The driver_override field from platform driver should not be initialized
from const memory because the core later kfree() it, for example when
driver_override is set via sysfs.
Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
---
drivers/clk/imx/clk-scu.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
index 083da31dc3ea..78ed40a0e3e2 100644
--- a/drivers/clk/imx/clk-scu.c
+++ b/drivers/clk/imx/clk-scu.c
@@ -683,7 +683,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
return ERR_PTR(ret);
}
- pdev->driver_override = "imx-scu-clk";
+ pdev->driver_override = kstrdup("imx-scu-clk", GFP_KERNEL);
+ if (!pdev->driver_override) {
+ platform_device_put(pdev);
+ return ERR_PTR(-ENOMEM);
+ }
ret = imx_clk_scu_attach_pd(&pdev->dev, rsrc_id);
if (ret)
--
2.32.0