4.14-stable patches

added patches:
	alsa-bebob-potential-info-leak-in-hwdep_read.patch
	binder-fix-uaf-when-releasing-todo-list.patch

diff --git a/queue-4.14/alsa-bebob-potential-info-leak-in-hwdep_read.patch b/queue-4.14/alsa-bebob-potential-info-leak-in-hwdep_read.patch
new file mode 100644 (file)
index 0000000..833ced5
--- /dev/null
+++ b/queue-4.14/alsa-bebob-potential-info-leak-in-hwdep_read.patch
@@ -0,0 +1,40 @@
+From b41c15f4e1c1f1657da15c482fa837c1b7384452 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 7 Oct 2020 10:49:28 +0300
+Subject: ALSA: bebob: potential info leak in hwdep_read()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit b41c15f4e1c1f1657da15c482fa837c1b7384452 upstream.
+
+The "count" variable needs to be capped on every path so that we don't
+copy too much information to the user.
+
+Fixes: 618eabeae711 ("ALSA: bebob: Add hwdep interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201007074928.GA2529578@mwanda
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/bebob/bebob_hwdep.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/firewire/bebob/bebob_hwdep.c
++++ b/sound/firewire/bebob/bebob_hwdep.c
+@@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char
+       }
+ 
+       memset(&event, 0, sizeof(event));
++      count = min_t(long, count, sizeof(event.lock_status));
+       if (bebob->dev_lock_changed) {
+               event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
+               event.lock_status.status = (bebob->dev_lock_count > 0);
+               bebob->dev_lock_changed = false;
+-
+-              count = min_t(long, count, sizeof(event.lock_status));
+       }
+ 
+       spin_unlock_irq(&bebob->lock);

diff --git a/queue-4.14/binder-fix-uaf-when-releasing-todo-list.patch b/queue-4.14/binder-fix-uaf-when-releasing-todo-list.patch
new file mode 100644 (file)
index 0000000..be18fa8
--- /dev/null
+++ b/queue-4.14/binder-fix-uaf-when-releasing-todo-list.patch
@@ -0,0 +1,113 @@
+From f3277cbfba763cd2826396521b9296de67cf1bbc Mon Sep 17 00:00:00 2001
+From: Todd Kjos <tkjos@google.com>
+Date: Fri, 9 Oct 2020 16:24:55 -0700
+Subject: binder: fix UAF when releasing todo list
+
+From: Todd Kjos <tkjos@google.com>
+
+commit f3277cbfba763cd2826396521b9296de67cf1bbc upstream.
+
+When releasing a thread todo list when tearing down
+a binder_proc, the following race was possible which
+could result in a use-after-free:
+
+1.  Thread 1: enter binder_release_work from binder_thread_release
+2.  Thread 2: binder_update_ref_for_handle() -> binder_dec_node_ilocked()
+3.  Thread 2: dec nodeA --> 0 (will free node)
+4.  Thread 1: ACQ inner_proc_lock
+5.  Thread 2: block on inner_proc_lock
+6.  Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA)
+7.  Thread 1: REL inner_proc_lock
+8.  Thread 2: ACQ inner_proc_lock
+9.  Thread 2: todo list cleanup, but work was already dequeued
+10. Thread 2: free node
+11. Thread 2: REL inner_proc_lock
+12. Thread 1: deref w->type (UAF)
+
+The problem was that for a BINDER_WORK_NODE, the binder_work element
+must not be accessed after releasing the inner_proc_lock while
+processing the todo list elements since another thread might be
+handling a deref on the node containing the binder_work element
+leading to the node being freed.
+
+Signed-off-by: Todd Kjos <tkjos@google.com>
+Link: https://lore.kernel.org/r/20201009232455.4054810-1-tkjos@google.com
+Cc: <stable@vger.kernel.org> # 4.14, 4.19, 5.4, 5.8
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/android/binder.c |   35 ++++++++++-------------------------
+ 1 file changed, 10 insertions(+), 25 deletions(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -286,7 +286,7 @@ struct binder_device {
+ struct binder_work {
+       struct list_head entry;
+ 
+-      enum {
++      enum binder_work_type {
+               BINDER_WORK_TRANSACTION = 1,
+               BINDER_WORK_TRANSACTION_COMPLETE,
+               BINDER_WORK_RETURN_ERROR,
+@@ -850,27 +850,6 @@ static struct binder_work *binder_dequeu
+       return w;
+ }
+ 
+-/**
+- * binder_dequeue_work_head() - Dequeues the item at head of list
+- * @proc:         binder_proc associated with list
+- * @list:         list to dequeue head
+- *
+- * Removes the head of the list if there are items on the list
+- *
+- * Return: pointer dequeued binder_work, NULL if list was empty
+- */
+-static struct binder_work *binder_dequeue_work_head(
+-                                      struct binder_proc *proc,
+-                                      struct list_head *list)
+-{
+-      struct binder_work *w;
+-
+-      binder_inner_proc_lock(proc);
+-      w = binder_dequeue_work_head_ilocked(list);
+-      binder_inner_proc_unlock(proc);
+-      return w;
+-}
+-
+ static void
+ binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
+ static void binder_free_thread(struct binder_thread *thread);
+@@ -4162,13 +4141,17 @@ static void binder_release_work(struct b
+                               struct list_head *list)
+ {
+       struct binder_work *w;
++      enum binder_work_type wtype;
+ 
+       while (1) {
+-              w = binder_dequeue_work_head(proc, list);
++              binder_inner_proc_lock(proc);
++              w = binder_dequeue_work_head_ilocked(list);
++              wtype = w ? w->type : 0;
++              binder_inner_proc_unlock(proc);
+               if (!w)
+                       return;
+ 
+-              switch (w->type) {
++              switch (wtype) {
+               case BINDER_WORK_TRANSACTION: {
+                       struct binder_transaction *t;
+ 
+@@ -4202,9 +4185,11 @@ static void binder_release_work(struct b
+                       kfree(death);
+                       binder_stats_deleted(BINDER_STAT_DEATH);
+               } break;
++              case BINDER_WORK_NODE:
++                      break;
+               default:
+                       pr_err("unexpected work type, %d, not freed\n",
+-                             w->type);
++                             wtype);
+                       break;
+               }
+       }

diff --git a/queue-4.14/series b/queue-4.14/series
index 6637c58307f65280f67cdb71172f74c26b722ecb..b187aaddbfe86e9a905b0f2cdd02d3e009d326da 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -6,3 +6,5 @@ net-usb-qmi_wwan-add-cellient-mpl200-card.patch
 tipc-fix-the-skb_unshare-in-tipc_buf_append.patch
 net-ipv4-always-honour-route-mtu-during-forwarding.patch
 r8169-fix-data-corruption-issue-on-rtl8402.patch
+binder-fix-uaf-when-releasing-todo-list.patch
+alsa-bebob-potential-info-leak-in-hwdep_read.patch