4.14-stable patches

added patches:
	fbdev-fb_pm2fb-avoid-potential-divide-by-zero-error.patch
	ftrace-fix-null-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch
	hid-hidraw-fix-memory-leak-in-hidraw_release.patch
	media-pvrusb2-fix-memory-leak-in-pvr_probe.patch

diff --git a/queue-4.14/fbdev-fb_pm2fb-avoid-potential-divide-by-zero-error.patch b/queue-4.14/fbdev-fb_pm2fb-avoid-potential-divide-by-zero-error.patch
new file mode 100644 (file)
index 0000000..f5d37f8
--- /dev/null
+++ b/queue-4.14/fbdev-fb_pm2fb-avoid-potential-divide-by-zero-error.patch
@@ -0,0 +1,47 @@
+From 19f953e7435644b81332dd632ba1b2d80b1e37af Mon Sep 17 00:00:00 2001
+From: Letu Ren <fantasquex@gmail.com>
+Date: Thu, 18 Aug 2022 18:44:24 +0800
+Subject: fbdev: fb_pm2fb: Avoid potential divide by zero error
+
+From: Letu Ren <fantasquex@gmail.com>
+
+commit 19f953e7435644b81332dd632ba1b2d80b1e37af upstream.
+
+In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be
+copied from user, then go through `fb_set_var()` and
+`info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`.
+Along the path, `var->pixclock` won't be modified. This function checks
+whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is
+zero, there will be a divide by zero error. So, it is necessary to check
+whether denominator is zero to avoid crash. As this bug is found by
+Syzkaller, logs are listed below.
+
+divide error in pm2fb_check_var
+Call Trace:
+ <TASK>
+ fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015
+ do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
+ fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
+
+Reported-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Letu Ren <fantasquex@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/pm2fb.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/video/fbdev/pm2fb.c
++++ b/drivers/video/fbdev/pm2fb.c
+@@ -614,6 +614,11 @@ static int pm2fb_check_var(struct fb_var
+               return -EINVAL;
+       }
+ 
++      if (!var->pixclock) {
++              DPRINTK("pixclock is zero\n");
++              return -EINVAL;
++      }
++
+       if (PICOS2KHZ(var->pixclock) > PM2_MAX_PIXCLOCK) {
+               DPRINTK("pixclock too high (%ldKHz)\n",
+                       PICOS2KHZ(var->pixclock));

diff --git a/queue-4.14/ftrace-fix-null-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch b/queue-4.14/ftrace-fix-null-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch
new file mode 100644 (file)
index 0000000..76f5582
--- /dev/null
+++ b/queue-4.14/ftrace-fix-null-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch
@@ -0,0 +1,93 @@
+From c3b0f72e805f0801f05fa2aa52011c4bfc694c44 Mon Sep 17 00:00:00 2001
+From: Yang Jihong <yangjihong1@huawei.com>
+Date: Thu, 18 Aug 2022 11:26:59 +0800
+Subject: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+commit c3b0f72e805f0801f05fa2aa52011c4bfc694c44 upstream.
+
+ftrace_startup does not remove ops from ftrace_ops_list when
+ftrace_startup_enable fails:
+
+register_ftrace_function
+  ftrace_startup
+    __register_ftrace_function
+      ...
+      add_ftrace_ops(&ftrace_ops_list, ops)
+      ...
+    ...
+    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
+    ...
+  return 0 // ops is in the ftrace_ops_list.
+
+When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
+unregister_ftrace_function
+  ftrace_shutdown
+    if (unlikely(ftrace_disabled))
+            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,
+                             // as a result, ops is still in the ftrace_ops_list
+    __unregister_ftrace_function
+    ...
+
+If ops is dynamically allocated, it will be free later, in this case,
+is_ftrace_trampoline accesses NULL pointer:
+
+is_ftrace_trampoline
+  ftrace_ops_trampoline
+    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!
+
+Syzkaller reports as follows:
+[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b
+[ 1203.508039] #PF: supervisor read access in kernel mode
+[ 1203.508798] #PF: error_code(0x0000) - not-present page
+[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0
+[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI
+[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8
+[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0
+[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00
+[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246
+[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866
+[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b
+[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07
+[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399
+[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008
+[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
+[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0
+[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+
+Therefore, when ftrace_startup_enable fails, we need to rollback registration
+process and remove ops from ftrace_ops_list.
+
+Link: https://lkml.kernel.org/r/20220818032659.56209-1-yangjihong1@huawei.com
+
+Suggested-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/ftrace.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2818,6 +2818,16 @@ static int ftrace_startup(struct ftrace_
+ 
+       ftrace_startup_enable(command);
+ 
++      /*
++       * If ftrace is in an undefined state, we just remove ops from list
++       * to prevent the NULL pointer, instead of totally rolling it back and
++       * free trampoline, because those actions could cause further damage.
++       */
++      if (unlikely(ftrace_disabled)) {
++              __unregister_ftrace_function(ops);
++              return -ENODEV;
++      }
++
+       ops->flags &= ~FTRACE_OPS_FL_ADDING;
+ 
+       return 0;

diff --git a/queue-4.14/hid-hidraw-fix-memory-leak-in-hidraw_release.patch b/queue-4.14/hid-hidraw-fix-memory-leak-in-hidraw_release.patch
new file mode 100644 (file)
index 0000000..6c77976
--- /dev/null
+++ b/queue-4.14/hid-hidraw-fix-memory-leak-in-hidraw_release.patch
@@ -0,0 +1,68 @@
+From a5623a203cffe2d2b84d2f6c989d9017db1856af Mon Sep 17 00:00:00 2001
+From: Karthik Alapati <mail@karthek.com>
+Date: Thu, 28 Jul 2022 21:13:17 +0530
+Subject: HID: hidraw: fix memory leak in hidraw_release()
+
+From: Karthik Alapati <mail@karthek.com>
+
+commit a5623a203cffe2d2b84d2f6c989d9017db1856af upstream.
+
+Free the buffered reports before deleting the list entry.
+
+BUG: memory leak
+unreferenced object 0xffff88810e72f180 (size 32):
+  comm "softirq", pid 0, jiffies 4294945143 (age 16.080s)
+  hex dump (first 32 bytes):
+    64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00  d..j............
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<ffffffff814ac6c3>] kmemdup+0x23/0x50 mm/util.c:128
+    [<ffffffff8357c1d2>] kmemdup include/linux/fortify-string.h:440 [inline]
+    [<ffffffff8357c1d2>] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521
+    [<ffffffff8356ddad>] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992
+    [<ffffffff8356e41e>] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065
+    [<ffffffff835f0d3f>] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284
+    [<ffffffff82d3c7f9>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670
+    [<ffffffff82d3cc26>] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747
+    [<ffffffff82ef1e14>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
+    [<ffffffff812f50a8>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474
+    [<ffffffff812f5586>] expire_timers kernel/time/timer.c:1519 [inline]
+    [<ffffffff812f5586>] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790
+    [<ffffffff812f56e4>] __run_timers kernel/time/timer.c:1768 [inline]
+    [<ffffffff812f56e4>] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803
+    [<ffffffff848000e6>] __do_softirq+0xe6/0x2ea kernel/softirq.c:571
+    [<ffffffff81246db0>] invoke_softirq kernel/softirq.c:445 [inline]
+    [<ffffffff81246db0>] __irq_exit_rcu kernel/softirq.c:650 [inline]
+    [<ffffffff81246db0>] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662
+    [<ffffffff84574f02>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106
+    [<ffffffff84600c8b>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
+    [<ffffffff8458a070>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
+    [<ffffffff8458a070>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
+    [<ffffffff8458a070>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
+    [<ffffffff8458a070>] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554
+
+Link: https://syzkaller.appspot.com/bug?id=19a04b43c75ed1092021010419b5e560a8172c4f
+Reported-by: syzbot+f59100a0428e6ded9443@syzkaller.appspotmail.com
+Signed-off-by: Karthik Alapati <mail@karthek.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hidraw.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -354,10 +354,13 @@ static int hidraw_release(struct inode *
+       unsigned int minor = iminor(inode);
+       struct hidraw_list *list = file->private_data;
+       unsigned long flags;
++      int i;
+ 
+       mutex_lock(&minors_lock);
+ 
+       spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
++      for (i = list->tail; i < list->head; i++)
++              kfree(list->buffer[i].value);
+       list_del(&list->node);
+       spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
+       kfree(list);

diff --git a/queue-4.14/media-pvrusb2-fix-memory-leak-in-pvr_probe.patch b/queue-4.14/media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
new file mode 100644 (file)
index 0000000..8102648
--- /dev/null
+++ b/queue-4.14/media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
@@ -0,0 +1,36 @@
+From 945a9a8e448b65bec055d37eba58f711b39f66f0 Mon Sep 17 00:00:00 2001
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+Date: Thu, 9 Jun 2022 08:35:28 +0100
+Subject: media: pvrusb2: fix memory leak in pvr_probe
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+commit 945a9a8e448b65bec055d37eba58f711b39f66f0 upstream.
+
+The error handling code in pvr2_hdw_create forgets to unregister the
+v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create,
+it calls pvr2_context_destroy to destroy context, but mp->hdw is NULL,
+which leads to that pvr2_hdw_destroy directly returns.
+
+Fix this by adding v4l2_device_unregister to decrease the refcount of
+usb interface.
+
+Reported-by: syzbot+77b432d57c4791183ed4@syzkaller.appspotmail.com
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -2604,6 +2604,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct
+               del_timer_sync(&hdw->encoder_run_timer);
+               del_timer_sync(&hdw->encoder_wait_timer);
+               flush_work(&hdw->workpoll);
++              v4l2_device_unregister(&hdw->v4l2_dev);
+               usb_free_urb(hdw->ctl_read_urb);
+               usb_free_urb(hdw->ctl_write_urb);
+               kfree(hdw->ctl_read_buffer);

diff --git a/queue-4.14/series b/queue-4.14/series
index 60fc530f05471a0a0b0ade31510fada12acbcaed..c543a6450d10dbd31332f83333fe5f2bda3b7ac7 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -30,3 +30,7 @@ x86-cpu-add-tiger-lake-to-intel-family.patch
 x86-bugs-add-unknown-reporting-for-mmio-stale-data.patch
 kbuild-fix-include-path-in-scripts-makefile.modpost.patch
 bluetooth-l2cap-fix-build-errors-in-some-archs.patch
+media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
+hid-hidraw-fix-memory-leak-in-hidraw_release.patch
+fbdev-fb_pm2fb-avoid-potential-divide-by-zero-error.patch
+ftrace-fix-null-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch