From: Greg Kroah-Hartman Date: Sat, 22 Apr 2023 16:37:48 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.314~64 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=721c5ac26c587ac53c568702911179e93285ef53;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: memstick-fix-memory-leak-if-card-device-is-never-registered.patch nilfs2-initialize-unused-bytes-in-segment-summary-blocks.patch --- diff --git a/queue-4.14/memstick-fix-memory-leak-if-card-device-is-never-registered.patch b/queue-4.14/memstick-fix-memory-leak-if-card-device-is-never-registered.patch new file mode 100644 index 00000000000..e29d331c7a8 --- /dev/null +++ b/queue-4.14/memstick-fix-memory-leak-if-card-device-is-never-registered.patch @@ -0,0 +1,61 @@ +From 4b6d621c9d859ff89e68cebf6178652592676013 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sat, 1 Apr 2023 22:03:27 +0200 +Subject: memstick: fix memory leak if card device is never registered + +From: Greg Kroah-Hartman + +commit 4b6d621c9d859ff89e68cebf6178652592676013 upstream. + +When calling dev_set_name() memory is allocated for the name for the +struct device. Once that structure device is registered, or attempted +to be registerd, with the driver core, the driver core will handle +cleaning up that memory when the device is removed from the system. + +Unfortunatly for the memstick code, there is an error path that causes +the struct device to never be registered, and so the memory allocated in +dev_set_name will be leaked. Fix that leak by manually freeing it right +before the memory for the device is freed. + +Cc: Maxim Levitsky +Cc: Alex Dubov +Cc: Ulf Hansson +Cc: "Rafael J. Wysocki" +Cc: Hans de Goede +Cc: Kay Sievers +Cc: linux-mmc@vger.kernel.org +Fixes: 0252c3b4f018 ("memstick: struct device - replace bus_id with dev_name(), dev_set_name()") +Cc: stable +Co-developed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +Co-developed-by: Mirsad Goran Todorovac +Signed-off-by: Mirsad Goran Todorovac +Link: https://lore.kernel.org/r/20230401200327.16800-1-gregkh@linuxfoundation.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memstick/core/memstick.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/memstick/core/memstick.c ++++ b/drivers/memstick/core/memstick.c +@@ -416,6 +416,7 @@ static struct memstick_dev *memstick_all + return card; + err_out: + host->card = old_card; ++ kfree_const(card->dev.kobj.name); + kfree(card); + return NULL; + } +@@ -471,8 +472,10 @@ static void memstick_check(struct work_s + put_device(&card->dev); + host->card = NULL; + } +- } else ++ } else { ++ kfree_const(card->dev.kobj.name); + kfree(card); ++ } + } + + out_power_off: diff --git a/queue-4.14/nilfs2-initialize-unused-bytes-in-segment-summary-blocks.patch b/queue-4.14/nilfs2-initialize-unused-bytes-in-segment-summary-blocks.patch new file mode 100644 index 00000000000..97f98cd3d09 --- /dev/null +++ b/queue-4.14/nilfs2-initialize-unused-bytes-in-segment-summary-blocks.patch @@ -0,0 +1,80 @@ +From ef832747a82dfbc22a3702219cc716f449b24e4a Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Tue, 18 Apr 2023 02:35:13 +0900 +Subject: nilfs2: initialize unused bytes in segment summary blocks + +From: Ryusuke Konishi + +commit ef832747a82dfbc22a3702219cc716f449b24e4a upstream. + +Syzbot still reports uninit-value in nilfs_add_checksums_on_logs() for +KMSAN enabled kernels after applying commit 7397031622e0 ("nilfs2: +initialize "struct nilfs_binfo_dat"->bi_pad field"). + +This is because the unused bytes at the end of each block in segment +summaries are not initialized. So this fixes the issue by padding the +unused bytes with null bytes. + +Link: https://lkml.kernel.org/r/20230417173513.12598-1-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Tested-by: Ryusuke Konishi +Reported-by: syzbot+048585f3f4227bb2b49b@syzkaller.appspotmail.com + Link: https://syzkaller.appspot.com/bug?extid=048585f3f4227bb2b49b +Cc: Alexander Potapenko +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/segment.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -444,6 +444,23 @@ static int nilfs_segctor_reset_segment_b + return 0; + } + ++/** ++ * nilfs_segctor_zeropad_segsum - zero pad the rest of the segment summary area ++ * @sci: segment constructor object ++ * ++ * nilfs_segctor_zeropad_segsum() zero-fills unallocated space at the end of ++ * the current segment summary block. ++ */ ++static void nilfs_segctor_zeropad_segsum(struct nilfs_sc_info *sci) ++{ ++ struct nilfs_segsum_pointer *ssp; ++ ++ ssp = sci->sc_blk_cnt > 0 ? &sci->sc_binfo_ptr : &sci->sc_finfo_ptr; ++ if (ssp->offset < ssp->bh->b_size) ++ memset(ssp->bh->b_data + ssp->offset, 0, ++ ssp->bh->b_size - ssp->offset); ++} ++ + static int nilfs_segctor_feed_segment(struct nilfs_sc_info *sci) + { + sci->sc_nblk_this_inc += sci->sc_curseg->sb_sum.nblocks; +@@ -452,6 +469,7 @@ static int nilfs_segctor_feed_segment(st + * The current segment is filled up + * (internal code) + */ ++ nilfs_segctor_zeropad_segsum(sci); + sci->sc_curseg = NILFS_NEXT_SEGBUF(sci->sc_curseg); + return nilfs_segctor_reset_segment_buffer(sci); + } +@@ -556,6 +574,7 @@ static int nilfs_segctor_add_file_block( + goto retry; + } + if (unlikely(required)) { ++ nilfs_segctor_zeropad_segsum(sci); + err = nilfs_segbuf_extend_segsum(segbuf); + if (unlikely(err)) + goto failed; +@@ -1544,6 +1563,7 @@ static int nilfs_segctor_collect(struct + nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA); + sci->sc_stage = prev_stage; + } ++ nilfs_segctor_zeropad_segsum(sci); + nilfs_segctor_truncate_segments(sci, sci->sc_curseg, nilfs->ns_sufile); + return 0; + diff --git a/queue-4.14/series b/queue-4.14/series index 644a9c64252..07d393e9830 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -12,3 +12,5 @@ scsi-core-improve-scsi_vpd_inquiry-checks.patch net-dsa-b53-mmap-add-phy-ops.patch s390-ptrace-fix-ptrace_get_last_break-error-handling.patch xen-netback-use-same-error-messages-for-same-errors.patch +nilfs2-initialize-unused-bytes-in-segment-summary-blocks.patch +memstick-fix-memory-leak-if-card-device-is-never-registered.patch