5.15-stable patches

added patches:
	alsa-firewire-lib-fix-to-check-cycle-continuity.patch
	tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch

diff --git a/queue-5.15/alsa-firewire-lib-fix-to-check-cycle-continuity.patch b/queue-5.15/alsa-firewire-lib-fix-to-check-cycle-continuity.patch
new file mode 100644 (file)
index 0000000..a9c36ef
--- /dev/null
+++ b/queue-5.15/alsa-firewire-lib-fix-to-check-cycle-continuity.patch
@@ -0,0 +1,39 @@
+From 77ce96543b03f437c6b45f286d8110db2b6622a3 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sun, 18 Feb 2024 12:30:26 +0900
+Subject: ALSA: firewire-lib: fix to check cycle continuity
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit 77ce96543b03f437c6b45f286d8110db2b6622a3 upstream.
+
+The local helper function to compare the given pair of cycle count
+evaluates them. If the left value is less than the right value, the
+function returns negative value.
+
+If the safe cycle is less than the current cycle, it is the case of
+cycle lost. However, it is not currently handled properly.
+
+This commit fixes the bug.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 705794c53b00 ("ALSA: firewire-lib: check cycle continuity")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20240218033026.72577-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/amdtp-stream.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -934,7 +934,7 @@ static int generate_device_pkt_descs(str
+                               // to the reason.
+                               unsigned int safe_cycle = increment_ohci_cycle_count(next_cycle,
+                                                               IR_JUMBO_PAYLOAD_MAX_SKIP_CYCLES);
+-                              lost = (compare_ohci_cycle_count(safe_cycle, cycle) > 0);
++                              lost = (compare_ohci_cycle_count(safe_cycle, cycle) < 0);
+                       }
+                       if (lost) {
+                               dev_err(&s->unit->device, "Detect discontinuity of cycle: %d %d\n",

diff --git a/queue-5.15/series b/queue-5.15/series
index 85fd4674e45eb2f20b62fb968df988a895c3d456..a310ccac5aa1591e7f8e047c6af8ea12d1327932 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -44,3 +44,5 @@ alsa-drop-leftover-snd-rtctimer-stuff-from-makefile.patch
 fbcon-always-restore-the-old-font-data-in-fbcon_do_s.patch
 afs-fix-endless-loop-in-directory-parsing.patch
 riscv-sparse-memory-vmemmap-out-of-bounds-fix.patch
+tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch
+alsa-firewire-lib-fix-to-check-cycle-continuity.patch

diff --git a/queue-5.15/tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch b/queue-5.15/tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch
new file mode 100644 (file)
index 0000000..1de0782
--- /dev/null
+++ b/queue-5.15/tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch
@@ -0,0 +1,43 @@
+From 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Fri, 1 Mar 2024 22:04:06 +0900
+Subject: tomoyo: fix UAF write bug in tomoyo_write_control()
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream.
+
+Since tomoyo_write_control() updates head->write_buf when write()
+of long lines is requested, we need to fetch head->write_buf after
+head->io_sem is held.  Otherwise, concurrent write() requests can
+cause use-after-free-write and double-free problems.
+
+Reported-by: Sam Sun <samsun1006219@gmail.com>
+Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji8g@mail.gmail.com
+Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.")
+Cc:  <stable@vger.kernel.org> # Linux 3.1+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/tomoyo/common.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/security/tomoyo/common.c
++++ b/security/tomoyo/common.c
+@@ -2657,13 +2657,14 @@ ssize_t tomoyo_write_control(struct tomo
+ {
+       int error = buffer_len;
+       size_t avail_len = buffer_len;
+-      char *cp0 = head->write_buf;
++      char *cp0;
+       int idx;
+ 
+       if (!head->write)
+               return -EINVAL;
+       if (mutex_lock_interruptible(&head->io_sem))
+               return -EINTR;
++      cp0 = head->write_buf;
+       head->read_user_buf_avail = 0;
+       idx = tomoyo_read_lock();
+       /* Read a line and dispatch it to the policy handler. */