--- /dev/null
+From b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 4 Dec 2014 18:25:19 +0100
+Subject: KEYS: Fix stale key registration at error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream.
+
+When loading encrypted-keys module, if the last check of
+aes_get_sizes() in init_encrypted() fails, the driver just returns an
+error without unregistering its key type. This results in the stale
+entry in the list. In addition to memory leaks, this leads to a kernel
+crash when registering a new key type later.
+
+This patch fixes the problem by swapping the calls of aes_get_sizes()
+and register_key_type(), and releasing resources properly at the error
+paths.
+
+Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=908163
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/encrypted-keys/encrypted.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -1018,10 +1018,13 @@ static int __init init_encrypted(void)
+ ret = encrypted_shash_alloc();
+ if (ret < 0)
+ return ret;
++ ret = aes_get_sizes();
++ if (ret < 0)
++ goto out;
+ ret = register_key_type(&key_type_encrypted);
+ if (ret < 0)
+ goto out;
+- return aes_get_sizes();
++ return 0;
+ out:
+ encrypted_shash_release();
+ return ret;
--- /dev/null
+From d025933e29872cb1fe19fc54d80e4dfa4ee5779c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andreas=20M=C3=BCller?= <goo@stapelspeicher.org>
+Date: Fri, 12 Dec 2014 12:11:11 +0100
+Subject: mac80211: fix multicast LED blinking and counter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Andreas=20M=C3=BCller?= <goo@stapelspeicher.org>
+
+commit d025933e29872cb1fe19fc54d80e4dfa4ee5779c upstream.
+
+As multicast-frames can't be fragmented, "dot11MulticastReceivedFrameCount"
+stopped being incremented after the use-after-free fix. Furthermore, the
+RX-LED will be triggered by every multicast frame (which wouldn't happen
+before) which wouldn't allow the LED to rest at all.
+
+Fixes https://bugzilla.kernel.org/show_bug.cgi?id=89431 which also had the
+patch.
+
+Fixes: b8fff407a180 ("mac80211: fix use-after-free in defragmentation")
+Signed-off-by: Andreas Müller <goo@stapelspeicher.org>
+[rewrite commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1585,14 +1585,14 @@ ieee80211_rx_h_defragment(struct ieee802
+ sc = le16_to_cpu(hdr->seq_ctrl);
+ frag = sc & IEEE80211_SCTL_FRAG;
+
+- if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+- goto out;
+-
+ if (is_multicast_ether_addr(hdr->addr1)) {
+ rx->local->dot11MulticastReceivedFrameCount++;
+- goto out;
++ goto out_no_led;
+ }
+
++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++ goto out;
++
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+
+ if (skb_linearize(rx->skb))
+@@ -1683,9 +1683,10 @@ ieee80211_rx_h_defragment(struct ieee802
+ status->rx_flags |= IEEE80211_RX_FRAGMENTED;
+
+ out:
++ ieee80211_led_rx(rx->local);
++ out_no_led:
+ if (rx->sta)
+ rx->sta->rx_packets++;
+- ieee80211_led_rx(rx->local);
+ return RX_CONTINUE;
+ }
+
--- /dev/null
+From 28a9bc68124c319b2b3dc861e80828a8865fd1ba Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 17 Dec 2014 13:55:49 +0100
+Subject: mac80211: free management frame keys when removing station
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 28a9bc68124c319b2b3dc861e80828a8865fd1ba upstream.
+
+When writing the code to allow per-station GTKs, I neglected to
+take into account the management frame keys (index 4 and 5) when
+freeing the station and only added code to free the first four
+data frame keys.
+
+Fix this by iterating the array of keys over the right length.
+
+Fixes: e31b82136d1a ("cfg80211/mac80211: allow per-station GTKs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/key.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -607,7 +607,7 @@ void ieee80211_free_sta_keys(struct ieee
+ int i;
+
+ mutex_lock(&local->key_mtx);
+- for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
++ for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) {
+ key = key_mtx_dereference(local, sta->gtk[i]);
+ if (!key)
+ continue;
dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch
x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch
isofs-fix-unchecked-printing-of-er-records.patch
+keys-fix-stale-key-registration-at-error-path.patch
+mac80211-fix-multicast-led-blinking-and-counter.patch
+mac80211-free-management-frame-keys-when-removing-station.patch
+userns-unbreak-the-unprivileged-remount-tests.patch
--- /dev/null
+From db86da7cb76f797a1a8b445166a15cb922c6ff85 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Tue, 2 Dec 2014 13:56:30 -0600
+Subject: userns: Unbreak the unprivileged remount tests
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit db86da7cb76f797a1a8b445166a15cb922c6ff85 upstream.
+
+A security fix in caused the way the unprivileged remount tests were
+using user namespaces to break. Tweak the way user namespaces are
+being used so the test works again.
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/mount/unprivileged-remount-test.c | 32 ++++++++++----
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/tools/testing/selftests/mount/unprivileged-remount-test.c
++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
+@@ -48,17 +48,14 @@ static void die(char *fmt, ...)
+ exit(EXIT_FAILURE);
+ }
+
+-static void write_file(char *filename, char *fmt, ...)
++static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap)
+ {
+ char buf[4096];
+ int fd;
+ ssize_t written;
+ int buf_len;
+- va_list ap;
+
+- va_start(ap, fmt);
+ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
+- va_end(ap);
+ if (buf_len < 0) {
+ die("vsnprintf failed: %s\n",
+ strerror(errno));
+@@ -69,6 +66,8 @@ static void write_file(char *filename, c
+
+ fd = open(filename, O_WRONLY);
+ if (fd < 0) {
++ if ((errno == ENOENT) && enoent_ok)
++ return;
+ die("open of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+@@ -87,6 +86,26 @@ static void write_file(char *filename, c
+ }
+ }
+
++static void maybe_write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(true, filename, fmt, ap);
++ va_end(ap);
++
++}
++
++static void write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(false, filename, fmt, ap);
++ va_end(ap);
++
++}
++
+ static void create_and_enter_userns(void)
+ {
+ uid_t uid;
+@@ -100,13 +119,10 @@ static void create_and_enter_userns(void
+ strerror(errno));
+ }
+
++ maybe_write_file("/proc/self/setgroups", "deny");
+ write_file("/proc/self/uid_map", "0 %d 1", uid);
+ write_file("/proc/self/gid_map", "0 %d 1", gid);
+
+- if (setgroups(0, NULL) != 0) {
+- die("setgroups failed: %s\n",
+- strerror(errno));
+- }
+ if (setgid(0) != 0) {
+ die ("setgid(0) failed %s\n",
+ strerror(errno));
projects / thirdparty / kernel / stable-queue.git / commitdiff
