4.14-stable patches

added patches:
	atm-idt77252-fix-use-after-free-bugs-caused-by-tst_timer.patch
	xen-xenbus-fix-return-type-in-xenbus_file_read.patch

diff --git a/queue-4.14/atm-idt77252-fix-use-after-free-bugs-caused-by-tst_timer.patch b/queue-4.14/atm-idt77252-fix-use-after-free-bugs-caused-by-tst_timer.patch
new file mode 100644 (file)
index 0000000..81c91a3
--- /dev/null
+++ b/queue-4.14/atm-idt77252-fix-use-after-free-bugs-caused-by-tst_timer.patch
@@ -0,0 +1,51 @@
+From 3f4093e2bf4673f218c0bf17d8362337c400e77b Mon Sep 17 00:00:00 2001
+From: Duoming Zhou <duoming@zju.edu.cn>
+Date: Fri, 5 Aug 2022 15:00:08 +0800
+Subject: atm: idt77252: fix use-after-free bugs caused by tst_timer
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+commit 3f4093e2bf4673f218c0bf17d8362337c400e77b upstream.
+
+There are use-after-free bugs caused by tst_timer. The root cause
+is that there are no functions to stop tst_timer in idt77252_exit().
+One of the possible race conditions is shown below:
+
+    (thread 1)          |        (thread 2)
+                        |  idt77252_init_one
+                        |    init_card
+                        |      fill_tst
+                        |        mod_timer(&card->tst_timer, ...)
+idt77252_exit           |  (wait a time)
+                        |  tst_timer
+                        |
+                        |    ...
+  kfree(card) // FREE   |
+                        |    card->soft_tst[e] // USE
+
+The idt77252_dev is deallocated in idt77252_exit() and used in
+timer handler.
+
+This patch adds del_timer_sync() in idt77252_exit() in order that
+the timer handler could be stopped before the idt77252_dev is
+deallocated.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://lore.kernel.org/r/20220805070008.18007-1-duoming@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/atm/idt77252.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -3768,6 +3768,7 @@ static void __exit idt77252_exit(void)
+               card = idt77252_chain;
+               dev = card->atmdev;
+               idt77252_chain = card->next;
++              del_timer_sync(&card->tst_timer);
+ 
+               if (dev->phy->stop)
+                       dev->phy->stop(dev);

diff --git a/queue-4.14/series b/queue-4.14/series
index 9072693f739277586a57ea0fd9035c6a8d19f7fa..31e4c577583d6873be4a3948a09954e2303a1708 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -192,3 +192,5 @@ geneve-do-not-use-rt_tos-for-ipv6-flowlabel.patch
 vsock-fix-memory-leak-in-vsock_connect.patch
 vsock-set-socket-state-back-to-ss_unconnected-in-vsock_connect_timeout.patch
 tools-build-switch-to-new-openssl-api-for-test-libcrypto.patch
+xen-xenbus-fix-return-type-in-xenbus_file_read.patch
+atm-idt77252-fix-use-after-free-bugs-caused-by-tst_timer.patch

diff --git a/queue-4.14/xen-xenbus-fix-return-type-in-xenbus_file_read.patch b/queue-4.14/xen-xenbus-fix-return-type-in-xenbus_file_read.patch
new file mode 100644 (file)
index 0000000..75c9f57
--- /dev/null
+++ b/queue-4.14/xen-xenbus-fix-return-type-in-xenbus_file_read.patch
@@ -0,0 +1,48 @@
+From 32ad11127b95236dfc52375f3707853194a7f4b4 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 4 Aug 2022 10:11:33 +0300
+Subject: xen/xenbus: fix return type in xenbus_file_read()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 32ad11127b95236dfc52375f3707853194a7f4b4 upstream.
+
+This code tries to store -EFAULT in an unsigned int.  The
+xenbus_file_read() function returns type ssize_t so the negative value
+is returned as a positive value to the user.
+
+This change forces another change to the min() macro.  Originally, the
+min() macro used "unsigned" type which checkpatch complains about.  Also
+unsigned type would break if "len" were not capped at MAX_RW_COUNT.  Use
+size_t for the min().  (No effect on runtime for the min_t() change).
+
+Fixes: 2fb3683e7b16 ("xen: Add xenbus device driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
+Link: https://lore.kernel.org/r/YutxJUaUYRG/VLVc@kili
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/xenbus/xenbus_dev_frontend.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
+@@ -125,7 +125,7 @@ static ssize_t xenbus_file_read(struct f
+ {
+       struct xenbus_file_priv *u = filp->private_data;
+       struct read_buffer *rb;
+-      unsigned i;
++      ssize_t i;
+       int ret;
+ 
+       mutex_lock(&u->reply_mutex);
+@@ -145,7 +145,7 @@ again:
+       rb = list_entry(u->read_buffers.next, struct read_buffer, list);
+       i = 0;
+       while (i < len) {
+-              unsigned sz = min((unsigned)len - i, rb->len - rb->cons);
++              size_t sz = min_t(size_t, len - i, rb->len - rb->cons);
+ 
+               ret = copy_to_user(ubuf + i, &rb->msg[rb->cons], sz);
+