--- /dev/null
+From b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 4 Dec 2014 18:25:19 +0100
+Subject: KEYS: Fix stale key registration at error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream.
+
+When loading encrypted-keys module, if the last check of
+aes_get_sizes() in init_encrypted() fails, the driver just returns an
+error without unregistering its key type. This results in the stale
+entry in the list. In addition to memory leaks, this leads to a kernel
+crash when registering a new key type later.
+
+This patch fixes the problem by swapping the calls of aes_get_sizes()
+and register_key_type(), and releasing resources properly at the error
+paths.
+
+Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=908163
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/encrypted-keys/encrypted.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -1018,10 +1018,13 @@ static int __init init_encrypted(void)
+ ret = encrypted_shash_alloc();
+ if (ret < 0)
+ return ret;
++ ret = aes_get_sizes();
++ if (ret < 0)
++ goto out;
+ ret = register_key_type(&key_type_encrypted);
+ if (ret < 0)
+ goto out;
+- return aes_get_sizes();
++ return 0;
+ out:
+ encrypted_shash_release();
+ return ret;
--- /dev/null
+From d025933e29872cb1fe19fc54d80e4dfa4ee5779c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andreas=20M=C3=BCller?= <goo@stapelspeicher.org>
+Date: Fri, 12 Dec 2014 12:11:11 +0100
+Subject: mac80211: fix multicast LED blinking and counter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Andreas=20M=C3=BCller?= <goo@stapelspeicher.org>
+
+commit d025933e29872cb1fe19fc54d80e4dfa4ee5779c upstream.
+
+As multicast-frames can't be fragmented, "dot11MulticastReceivedFrameCount"
+stopped being incremented after the use-after-free fix. Furthermore, the
+RX-LED will be triggered by every multicast frame (which wouldn't happen
+before) which wouldn't allow the LED to rest at all.
+
+Fixes https://bugzilla.kernel.org/show_bug.cgi?id=89431 which also had the
+patch.
+
+Fixes: b8fff407a180 ("mac80211: fix use-after-free in defragmentation")
+Signed-off-by: Andreas Müller <goo@stapelspeicher.org>
+[rewrite commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1667,14 +1667,14 @@ ieee80211_rx_h_defragment(struct ieee802
+ sc = le16_to_cpu(hdr->seq_ctrl);
+ frag = sc & IEEE80211_SCTL_FRAG;
+
+- if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+- goto out;
+-
+ if (is_multicast_ether_addr(hdr->addr1)) {
+ rx->local->dot11MulticastReceivedFrameCount++;
+- goto out;
++ goto out_no_led;
+ }
+
++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++ goto out;
++
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+
+ if (skb_linearize(rx->skb))
+@@ -1765,9 +1765,10 @@ ieee80211_rx_h_defragment(struct ieee802
+ status->rx_flags |= IEEE80211_RX_FRAGMENTED;
+
+ out:
++ ieee80211_led_rx(rx->local);
++ out_no_led:
+ if (rx->sta)
+ rx->sta->rx_packets++;
+- ieee80211_led_rx(rx->local);
+ return RX_CONTINUE;
+ }
+
--- /dev/null
+From 28a9bc68124c319b2b3dc861e80828a8865fd1ba Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 17 Dec 2014 13:55:49 +0100
+Subject: mac80211: free management frame keys when removing station
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 28a9bc68124c319b2b3dc861e80828a8865fd1ba upstream.
+
+When writing the code to allow per-station GTKs, I neglected to
+take into account the management frame keys (index 4 and 5) when
+freeing the station and only added code to free the first four
+data frame keys.
+
+Fix this by iterating the array of keys over the right length.
+
+Fixes: e31b82136d1a ("cfg80211/mac80211: allow per-station GTKs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/key.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -650,7 +650,7 @@ void ieee80211_free_sta_keys(struct ieee
+ int i;
+
+ mutex_lock(&local->key_mtx);
+- for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
++ for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) {
+ key = key_mtx_dereference(local, sta->gtk[i]);
+ if (!key)
+ continue;
--- /dev/null
+From c297abfdf15b4480704d6b566ca5ca9438b12456 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Thu, 18 Dec 2014 10:57:19 -0600
+Subject: mnt: Fix a memory stomp in umount
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit c297abfdf15b4480704d6b566ca5ca9438b12456 upstream.
+
+While reviewing the code of umount_tree I realized that when we append
+to a preexisting unmounted list we do not change pprev of the former
+first item in the list.
+
+Which means later in namespace_unlock hlist_del_init(&mnt->mnt_hash) on
+the former first item of the list will stomp unmounted.first leaving
+it set to some random mount point which we are likely to free soon.
+
+This isn't likely to hit, but if it does I don't know how anyone could
+track it down.
+
+[ This happened because we don't have all the same operations for
+ hlist's as we do for normal doubly-linked lists. In particular,
+ list_splice() is easy on our standard doubly-linked lists, while
+ hlist_splice() doesn't exist and needs both start/end entries of the
+ hlist. And commit 38129a13e6e7 incorrectly open-coded that missing
+ hlist_splice().
+
+ We should think about making these kinds of "mindless" conversions
+ easier to get right by adding the missing hlist helpers - Linus ]
+
+Fixes: 38129a13e6e71f666e0468e99fdd932a687b4d7e switch mnt_hash to hlist
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/namespace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1286,6 +1286,8 @@ void umount_tree(struct mount *mnt, int
+ }
+ if (last) {
+ last->mnt_hash.next = unmounted.first;
++ if (unmounted.first)
++ unmounted.first->pprev = &last->mnt_hash.next;
+ unmounted.first = tmp_list.first;
+ unmounted.first->pprev = &unmounted.first;
+ }
x86-asm-traps-disable-tracing-and-kprobes-in-fixup_bad_iret-and-sync_regs.patch
x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch
isofs-fix-unchecked-printing-of-er-records.patch
+keys-fix-stale-key-registration-at-error-path.patch
+mac80211-fix-multicast-led-blinking-and-counter.patch
+mac80211-free-management-frame-keys-when-removing-station.patch
+mnt-fix-a-memory-stomp-in-umount.patch
+thermal-fix-error-path-in-thermal_init.patch
+userns-unbreak-the-unprivileged-remount-tests.patch
--- /dev/null
+From 9d367e5e7b05c71a8c1ac4e9b6e00ba45a79f2fc Mon Sep 17 00:00:00 2001
+From: Luis Henriques <luis.henriques@canonical.com>
+Date: Wed, 3 Dec 2014 21:20:21 +0000
+Subject: thermal: Fix error path in thermal_init()
+
+From: Luis Henriques <luis.henriques@canonical.com>
+
+commit 9d367e5e7b05c71a8c1ac4e9b6e00ba45a79f2fc upstream.
+
+thermal_unregister_governors() and class_unregister() were being called in
+the wrong order.
+
+Fixes: 80a26a5c22b9 ("Thermal: build thermal governors into thermal_sys module")
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/thermal/thermal_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1824,10 +1824,10 @@ static int __init thermal_init(void)
+
+ exit_netlink:
+ genetlink_exit();
+-unregister_governors:
+- thermal_unregister_governors();
+ unregister_class:
+ class_unregister(&thermal_class);
++unregister_governors:
++ thermal_unregister_governors();
+ error:
+ idr_destroy(&thermal_tz_idr);
+ idr_destroy(&thermal_cdev_idr);
--- /dev/null
+From db86da7cb76f797a1a8b445166a15cb922c6ff85 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Tue, 2 Dec 2014 13:56:30 -0600
+Subject: userns: Unbreak the unprivileged remount tests
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+commit db86da7cb76f797a1a8b445166a15cb922c6ff85 upstream.
+
+A security fix in caused the way the unprivileged remount tests were
+using user namespaces to break. Tweak the way user namespaces are
+being used so the test works again.
+
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/mount/unprivileged-remount-test.c | 32 ++++++++++----
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/tools/testing/selftests/mount/unprivileged-remount-test.c
++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
+@@ -48,17 +48,14 @@ static void die(char *fmt, ...)
+ exit(EXIT_FAILURE);
+ }
+
+-static void write_file(char *filename, char *fmt, ...)
++static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap)
+ {
+ char buf[4096];
+ int fd;
+ ssize_t written;
+ int buf_len;
+- va_list ap;
+
+- va_start(ap, fmt);
+ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
+- va_end(ap);
+ if (buf_len < 0) {
+ die("vsnprintf failed: %s\n",
+ strerror(errno));
+@@ -69,6 +66,8 @@ static void write_file(char *filename, c
+
+ fd = open(filename, O_WRONLY);
+ if (fd < 0) {
++ if ((errno == ENOENT) && enoent_ok)
++ return;
+ die("open of %s failed: %s\n",
+ filename, strerror(errno));
+ }
+@@ -87,6 +86,26 @@ static void write_file(char *filename, c
+ }
+ }
+
++static void maybe_write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(true, filename, fmt, ap);
++ va_end(ap);
++
++}
++
++static void write_file(char *filename, char *fmt, ...)
++{
++ va_list ap;
++
++ va_start(ap, fmt);
++ vmaybe_write_file(false, filename, fmt, ap);
++ va_end(ap);
++
++}
++
+ static void create_and_enter_userns(void)
+ {
+ uid_t uid;
+@@ -100,13 +119,10 @@ static void create_and_enter_userns(void
+ strerror(errno));
+ }
+
++ maybe_write_file("/proc/self/setgroups", "deny");
+ write_file("/proc/self/uid_map", "0 %d 1", uid);
+ write_file("/proc/self/gid_map", "0 %d 1", gid);
+
+- if (setgroups(0, NULL) != 0) {
+- die("setgroups failed: %s\n",
+- strerror(errno));
+- }
+ if (setgid(0) != 0) {
+ die ("setgid(0) failed %s\n",
+ strerror(errno));
projects / thirdparty / kernel / stable-queue.git / commitdiff
