From: Greg Kroah-Hartman Date: Thu, 25 Aug 2022 11:50:00 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.10.140~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=511bc0d6db8a17a89d7d2c372e35eae390e5cc72;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: audit-fix-potential-double-free-on-error-path-from-fsnotify_add_inode_mark.patch kernel-sys_ni-add-compat-entry-for-fadvise64_64.patch parisc-fix-exception-handler-for-fldw-and-fstw-instructions.patch --- diff --git a/queue-5.4/audit-fix-potential-double-free-on-error-path-from-fsnotify_add_inode_mark.patch b/queue-5.4/audit-fix-potential-double-free-on-error-path-from-fsnotify_add_inode_mark.patch new file mode 100644 index 00000000000..0db11315099 --- /dev/null +++ b/queue-5.4/audit-fix-potential-double-free-on-error-path-from-fsnotify_add_inode_mark.patch @@ -0,0 +1,37 @@ +From ad982c3be4e60c7d39c03f782733503cbd88fd2a Mon Sep 17 00:00:00 2001 +From: Gaosheng Cui +Date: Mon, 22 Aug 2022 10:29:05 +0800 +Subject: audit: fix potential double free on error path from fsnotify_add_inode_mark + +From: Gaosheng Cui + +commit ad982c3be4e60c7d39c03f782733503cbd88fd2a upstream. + +Audit_alloc_mark() assign pathname to audit_mark->path, on error path +from fsnotify_add_inode_mark(), fsnotify_put_mark will free memory +of audit_mark->path, but the caller of audit_alloc_mark will free +the pathname again, so there will be double free problem. + +Fix this by resetting audit_mark->path to NULL pointer on error path +from fsnotify_add_inode_mark(). + +Cc: stable@vger.kernel.org +Fixes: 7b1293234084d ("fsnotify: Add group pointer in fsnotify_init_mark()") +Signed-off-by: Gaosheng Cui +Reviewed-by: Jan Kara +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + kernel/audit_fsnotify.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/audit_fsnotify.c ++++ b/kernel/audit_fsnotify.c +@@ -102,6 +102,7 @@ struct audit_fsnotify_mark *audit_alloc_ + + ret = fsnotify_add_inode_mark(&audit_mark->mark, inode, true); + if (ret < 0) { ++ audit_mark->path = NULL; + fsnotify_put_mark(&audit_mark->mark); + audit_mark = ERR_PTR(ret); + } diff --git a/queue-5.4/kernel-sys_ni-add-compat-entry-for-fadvise64_64.patch b/queue-5.4/kernel-sys_ni-add-compat-entry-for-fadvise64_64.patch new file mode 100644 index 00000000000..119aa1dacad --- /dev/null +++ b/queue-5.4/kernel-sys_ni-add-compat-entry-for-fadvise64_64.patch @@ -0,0 +1,46 @@ +From a8faed3a02eeb75857a3b5d660fa80fe79db77a3 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Sun, 7 Aug 2022 15:09:34 -0700 +Subject: kernel/sys_ni: add compat entry for fadvise64_64 + +From: Randy Dunlap + +commit a8faed3a02eeb75857a3b5d660fa80fe79db77a3 upstream. + +When CONFIG_ADVISE_SYSCALLS is not set/enabled and CONFIG_COMPAT is +set/enabled, the riscv compat_syscall_table references +'compat_sys_fadvise64_64', which is not defined: + +riscv64-linux-ld: arch/riscv/kernel/compat_syscall_table.o:(.rodata+0x6f8): +undefined reference to `compat_sys_fadvise64_64' + +Add 'fadvise64_64' to kernel/sys_ni.c as a conditional COMPAT function so +that when CONFIG_ADVISE_SYSCALLS is not set, there is a fallback function +available. + +Link: https://lkml.kernel.org/r/20220807220934.5689-1-rdunlap@infradead.org +Fixes: d3ac21cacc24 ("mm: Support compiling out madvise and fadvise") +Signed-off-by: Randy Dunlap +Suggested-by: Arnd Bergmann +Reviewed-by: Arnd Bergmann +Cc: Josh Triplett +Cc: Paul Walmsley +Cc: Palmer Dabbelt +Cc: Albert Ou +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sys_ni.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/sys_ni.c ++++ b/kernel/sys_ni.c +@@ -268,6 +268,7 @@ COND_SYSCALL_COMPAT(keyctl); + + /* mm/fadvise.c */ + COND_SYSCALL(fadvise64_64); ++COND_SYSCALL_COMPAT(fadvise64_64); + + /* mm/, CONFIG_MMU only */ + COND_SYSCALL(swapon); diff --git a/queue-5.4/parisc-fix-exception-handler-for-fldw-and-fstw-instructions.patch b/queue-5.4/parisc-fix-exception-handler-for-fldw-and-fstw-instructions.patch new file mode 100644 index 00000000000..0be9adf7be7 --- /dev/null +++ b/queue-5.4/parisc-fix-exception-handler-for-fldw-and-fstw-instructions.patch @@ -0,0 +1,49 @@ +From 7ae1f5508d9a33fd58ed3059bd2d569961e3b8bd Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 20 Aug 2022 17:59:17 +0200 +Subject: parisc: Fix exception handler for fldw and fstw instructions + +From: Helge Deller + +commit 7ae1f5508d9a33fd58ed3059bd2d569961e3b8bd upstream. + +The exception handler is broken for unaligned memory acceses with fldw +and fstw instructions, because it trashes or uses randomly some other +floating point register than the one specified in the instruction word +on loads and stores. + +The instruction "fldw 0(addr),%fr22L" (and the other fldw/fstw +instructions) encode the target register (%fr22) in the rightmost 5 bits +of the instruction word. The 7th rightmost bit of the instruction word +defines if the left or right half of %fr22 should be used. + +While processing unaligned address accesses, the FR3() define is used to +extract the offset into the local floating-point register set. But the +calculation in FR3() was buggy, so that for example instead of %fr22, +register %fr12 [((22 * 2) & 0x1f) = 12] was used. + +This bug has been since forever in the parisc kernel and I wonder why it +wasn't detected earlier. Interestingly I noticed this bug just because +the libime debian package failed to build on *native* hardware, while it +successfully built in qemu. + +This patch corrects the bitshift and masking calculation in FR3(). + +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/kernel/unaligned.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/parisc/kernel/unaligned.c ++++ b/arch/parisc/kernel/unaligned.c +@@ -107,7 +107,7 @@ + #define R1(i) (((i)>>21)&0x1f) + #define R2(i) (((i)>>16)&0x1f) + #define R3(i) ((i)&0x1f) +-#define FR3(i) ((((i)<<1)&0x1f)|(((i)>>6)&1)) ++#define FR3(i) ((((i)&0x1f)<<1)|(((i)>>6)&1)) + #define IM(i,n) (((i)>>1&((1<<(n-1))-1))|((i)&1?((0-1L)<<(n-1)):0)) + #define IM5_2(i) IM((i)>>16,5) + #define IM5_3(i) IM((i),5) diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..d89cfe96b71 --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,3 @@ +audit-fix-potential-double-free-on-error-path-from-fsnotify_add_inode_mark.patch +parisc-fix-exception-handler-for-fldw-and-fstw-instructions.patch +kernel-sys_ni-add-compat-entry-for-fadvise64_64.patch