From: Sasha Levin Date: Wed, 30 Oct 2019 11:28:34 +0000 (-0400) Subject: fixes for 4.14 X-Git-Tag: v4.4.199~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=41ca2a683b3b45ee058ef4ab3baf76bbdb18fb0c;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/nbd-verify-socket-is-supported-during-setup.patch b/queue-4.14/nbd-verify-socket-is-supported-during-setup.patch new file mode 100644 index 00000000000..6e2b08b1f7d --- /dev/null +++ b/queue-4.14/nbd-verify-socket-is-supported-during-setup.patch @@ -0,0 +1,78 @@ +From 75ac87a898aef23679dc11dcddfed1f612df8cc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2019 16:27:34 -0500 +Subject: nbd: verify socket is supported during setup + +From: Mike Christie + +[ Upstream commit cf1b2326b734896734c6e167e41766f9cee7686a ] + +nbd requires socket families to support the shutdown method so the nbd +recv workqueue can be woken up from its sock_recvmsg call. If the socket +does not support the callout we will leave recv works running or get hangs +later when the device or module is removed. + +This adds a check during socket connection/reconnection to make sure the +socket being passed in supports the needed callout. + +Reported-by: syzbot+24c12fa8d218ed26011a@syzkaller.appspotmail.com +Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs") +Tested-by: Richard W.M. Jones +Signed-off-by: Mike Christie +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 3e45004407963..f3d0bc9a99058 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -912,6 +912,25 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx, + return ret; + } + ++static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, ++ int *err) ++{ ++ struct socket *sock; ++ ++ *err = 0; ++ sock = sockfd_lookup(fd, err); ++ if (!sock) ++ return NULL; ++ ++ if (sock->ops->shutdown == sock_no_shutdown) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); ++ *err = -EINVAL; ++ return NULL; ++ } ++ ++ return sock; ++} ++ + static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + bool netlink) + { +@@ -921,7 +940,7 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + struct nbd_sock *nsock; + int err; + +- sock = sockfd_lookup(arg, &err); ++ sock = nbd_get_socket(nbd, arg, &err); + if (!sock) + return err; + +@@ -973,7 +992,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) + int i; + int err; + +- sock = sockfd_lookup(arg, &err); ++ sock = nbd_get_socket(nbd, arg, &err); + if (!sock) + return err; + +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series index a161588497c..151bc528e0b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -54,3 +54,5 @@ nbd-fix-possible-sysfs-duplicate-warning.patch nfsv4-fix-leak-of-clp-cl_acceptor-string.patch s390-uaccess-avoid-false-positive-compiler-warnings.patch tracing-initialize-iter-seq-after-zeroing-in-tracing.patch +nbd-verify-socket-is-supported-during-setup.patch +usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch diff --git a/queue-4.14/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch b/queue-4.14/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch new file mode 100644 index 00000000000..c4103d19313 --- /dev/null +++ b/queue-4.14/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch @@ -0,0 +1,39 @@ +From 3513b7a28caf190acd48db8be9a1982da17ccdc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 17:11:15 +0300 +Subject: USB: legousbtower: fix a signedness bug in tower_probe() + +From: Dan Carpenter + +[ Upstream commit fd47a417e75e2506eb3672ae569b1c87e3774155 ] + +The problem is that sizeof() is unsigned long so negative error codes +are type promoted to high positive values and the condition becomes +false. + +Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe") +Signed-off-by: Dan Carpenter +Acked-by: Johan Hovold +Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/legousbtower.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c +index 378a565ec989f..a1ed6be874715 100644 +--- a/drivers/usb/misc/legousbtower.c ++++ b/drivers/usb/misc/legousbtower.c +@@ -881,7 +881,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device + get_version_reply, + sizeof(*get_version_reply), + 1000); +- if (result < sizeof(*get_version_reply)) { ++ if (result != sizeof(*get_version_reply)) { + if (result >= 0) + result = -EIO; + dev_err(idev, "get version request failed: %d\n", result); +-- +2.20.1 +