fixes for 4.14

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.14/nbd-verify-socket-is-supported-during-setup.patch b/queue-4.14/nbd-verify-socket-is-supported-during-setup.patch
new file mode 100644 (file)
index 0000000..6e2b08b
--- /dev/null
+++ b/queue-4.14/nbd-verify-socket-is-supported-during-setup.patch
@@ -0,0 +1,78 @@
+From 75ac87a898aef23679dc11dcddfed1f612df8cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 16:27:34 -0500
+Subject: nbd: verify socket is supported during setup
+
+From: Mike Christie <mchristi@redhat.com>
+
+[ Upstream commit cf1b2326b734896734c6e167e41766f9cee7686a ]
+
+nbd requires socket families to support the shutdown method so the nbd
+recv workqueue can be woken up from its sock_recvmsg call. If the socket
+does not support the callout we will leave recv works running or get hangs
+later when the device or module is removed.
+
+This adds a check during socket connection/reconnection to make sure the
+socket being passed in supports the needed callout.
+
+Reported-by: syzbot+24c12fa8d218ed26011a@syzkaller.appspotmail.com
+Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs")
+Tested-by: Richard W.M. Jones <rjones@redhat.com>
+Signed-off-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 3e45004407963..f3d0bc9a99058 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -912,6 +912,25 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
+       return ret;
+ }
+ 
++static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
++                                   int *err)
++{
++      struct socket *sock;
++
++      *err = 0;
++      sock = sockfd_lookup(fd, err);
++      if (!sock)
++              return NULL;
++
++      if (sock->ops->shutdown == sock_no_shutdown) {
++              dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
++              *err = -EINVAL;
++              return NULL;
++      }
++
++      return sock;
++}
++
+ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+                         bool netlink)
+ {
+@@ -921,7 +940,7 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg,
+       struct nbd_sock *nsock;
+       int err;
+ 
+-      sock = sockfd_lookup(arg, &err);
++      sock = nbd_get_socket(nbd, arg, &err);
+       if (!sock)
+               return err;
+ 
+@@ -973,7 +992,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg)
+       int i;
+       int err;
+ 
+-      sock = sockfd_lookup(arg, &err);
++      sock = nbd_get_socket(nbd, arg, &err);
+       if (!sock)
+               return err;
+ 
+-- 
+2.20.1
+

diff --git a/queue-4.14/series b/queue-4.14/series
index a161588497c9b837733689260ce3740d14a87382..151bc528e0b6c4bced5fcf24603ec28ee3ee4045 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -54,3 +54,5 @@ nbd-fix-possible-sysfs-duplicate-warning.patch
 nfsv4-fix-leak-of-clp-cl_acceptor-string.patch
 s390-uaccess-avoid-false-positive-compiler-warnings.patch
 tracing-initialize-iter-seq-after-zeroing-in-tracing.patch
+nbd-verify-socket-is-supported-during-setup.patch
+usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch

diff --git a/queue-4.14/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch b/queue-4.14/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
new file mode 100644 (file)
index 0000000..c4103d1
--- /dev/null
+++ b/queue-4.14/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
@@ -0,0 +1,39 @@
+From 3513b7a28caf190acd48db8be9a1982da17ccdc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 17:11:15 +0300
+Subject: USB: legousbtower: fix a signedness bug in tower_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fd47a417e75e2506eb3672ae569b1c87e3774155 ]
+
+The problem is that sizeof() is unsigned long so negative error codes
+are type promoted to high positive values and the condition becomes
+false.
+
+Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/legousbtower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 378a565ec989f..a1ed6be874715 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -881,7 +881,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+                                 get_version_reply,
+                                 sizeof(*get_version_reply),
+                                 1000);
+-      if (result < sizeof(*get_version_reply)) {
++      if (result != sizeof(*get_version_reply)) {
+               if (result >= 0)
+                       result = -EIO;
+               dev_err(idev, "get version request failed: %d\n", result);
+-- 
+2.20.1
+