From: Greg Kroah-Hartman Date: Wed, 15 Sep 2021 12:52:47 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.14.5~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f37c0137ac4d8fc61063fc2e69af773f5717c34b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: crypto-public_key-fix-overflow-during-implicit-conversion.patch media-rc-loopback-return-number-of-emitters-rather-than-error.patch media-uvc-don-t-do-dma-on-stack.patch power-supply-max17042-handle-fails-of-reading-status-register.patch vmci-fix-null-pointer-dereference-when-unmapping-queue-pair.patch --- diff --git a/queue-4.9/crypto-public_key-fix-overflow-during-implicit-conversion.patch b/queue-4.9/crypto-public_key-fix-overflow-during-implicit-conversion.patch new file mode 100644 index 00000000000..37ed417036a --- /dev/null +++ b/queue-4.9/crypto-public_key-fix-overflow-during-implicit-conversion.patch @@ -0,0 +1,70 @@ +From f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a Mon Sep 17 00:00:00 2001 +From: zhenwei pi +Date: Thu, 19 Aug 2021 20:37:10 +0800 +Subject: crypto: public_key: fix overflow during implicit conversion + +From: zhenwei pi + +commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream. + +Hit kernel warning like this, it can be reproduced by verifying 256 +bytes datafile by keyctl command, run script: +RAWDATA=rawdata +SIGDATA=sigdata + +modprobe pkcs8_key_parser + +rm -rf *.der *.pem *.pfx +rm -rf $RAWDATA +dd if=/dev/random of=$RAWDATA bs=256 count=1 + +openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \ + -subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=xx.com/emailAddress=yy@xx.com" + +KEY_ID=`openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER | keyctl \ + padd asymmetric 123 @s` + +keyctl pkey_sign $KEY_ID 0 $RAWDATA enc=pkcs1 hash=sha1 > $SIGDATA +keyctl pkey_verify $KEY_ID 0 $RAWDATA $SIGDATA enc=pkcs1 hash=sha1 + +Then the kernel reports: + WARNING: CPU: 5 PID: 344556 at crypto/rsa-pkcs1pad.c:540 + pkcs1pad_verify+0x160/0x190 + ... + Call Trace: + public_key_verify_signature+0x282/0x380 + ? software_key_query+0x12d/0x180 + ? keyctl_pkey_params_get+0xd6/0x130 + asymmetric_key_verify_signature+0x66/0x80 + keyctl_pkey_verify+0xa5/0x100 + do_syscall_64+0x35/0xb0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +The reason of this issue, in function 'asymmetric_key_verify_signature': +'.digest_size(u8) = params->in_len(u32)' leads overflow of an u8 value, +so use u32 instead of u8 for digest_size field. And reorder struct +public_key_signature, it saves 8 bytes on a 64-bit machine. + +Cc: stable@vger.kernel.org +Signed-off-by: zhenwei pi +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + include/crypto/public_key.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/crypto/public_key.h ++++ b/include/crypto/public_key.h +@@ -35,9 +35,9 @@ extern void public_key_free(struct publi + struct public_key_signature { + struct asymmetric_key_id *auth_ids[2]; + u8 *s; /* Signature */ +- u32 s_size; /* Number of bytes in signature */ + u8 *digest; +- u8 digest_size; /* Number of bytes in digest */ ++ u32 s_size; /* Number of bytes in signature */ ++ u32 digest_size; /* Number of bytes in digest */ + const char *pkey_algo; + const char *hash_algo; + }; diff --git a/queue-4.9/media-rc-loopback-return-number-of-emitters-rather-than-error.patch b/queue-4.9/media-rc-loopback-return-number-of-emitters-rather-than-error.patch new file mode 100644 index 00000000000..1071d70d3f2 --- /dev/null +++ b/queue-4.9/media-rc-loopback-return-number-of-emitters-rather-than-error.patch @@ -0,0 +1,31 @@ +From 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Sat, 3 Jul 2021 15:37:17 +0200 +Subject: media: rc-loopback: return number of emitters rather than error + +From: Sean Young + +commit 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 upstream. + +The LIRC_SET_TRANSMITTER_MASK ioctl should return the number of emitters +if an invalid list was set. + +Cc: stable@vger.kernel.org +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/rc-loopback.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/rc/rc-loopback.c ++++ b/drivers/media/rc/rc-loopback.c +@@ -55,7 +55,7 @@ static int loop_set_tx_mask(struct rc_de + + if ((mask & (RXMASK_REGULAR | RXMASK_LEARNING)) != mask) { + dprintk("invalid tx mask: %u\n", mask); +- return -EINVAL; ++ return 2; + } + + dprintk("setting tx mask: %u\n", mask); diff --git a/queue-4.9/media-uvc-don-t-do-dma-on-stack.patch b/queue-4.9/media-uvc-don-t-do-dma-on-stack.patch new file mode 100644 index 00000000000..851ca592320 --- /dev/null +++ b/queue-4.9/media-uvc-don-t-do-dma-on-stack.patch @@ -0,0 +1,96 @@ +From 1a10d7fdb6d0e235e9d230916244cc2769d3f170 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Thu, 17 Jun 2021 14:33:29 +0200 +Subject: media: uvc: don't do DMA on stack + +From: Mauro Carvalho Chehab + +commit 1a10d7fdb6d0e235e9d230916244cc2769d3f170 upstream. + +As warned by smatch: + drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i) + drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i) + +those two functions call uvc_query_ctrl passing a pointer to +a data at the DMA stack. those are used to send URBs via +usb_control_msg(). Using DMA stack is not supported and should +not work anymore on modern Linux versions. + +So, use a kmalloc'ed buffer. + +Cc: stable@vger.kernel.org # Kernel 4.9 and upper +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_v4l2.c | 34 +++++++++++++++++++++++----------- + 1 file changed, 23 insertions(+), 11 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -881,8 +881,8 @@ static int uvc_ioctl_g_input(struct file + { + struct uvc_fh *handle = fh; + struct uvc_video_chain *chain = handle->chain; ++ u8 *buf; + int ret; +- u8 i; + + if (chain->selector == NULL || + (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) { +@@ -890,22 +890,27 @@ static int uvc_ioctl_g_input(struct file + return 0; + } + ++ buf = kmalloc(1, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ + ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id, + chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, +- &i, 1); +- if (ret < 0) +- return ret; ++ buf, 1); ++ if (!ret) ++ *input = *buf - 1; + +- *input = i - 1; +- return 0; ++ kfree(buf); ++ ++ return ret; + } + + static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) + { + struct uvc_fh *handle = fh; + struct uvc_video_chain *chain = handle->chain; ++ u8 *buf; + int ret; +- u32 i; + + ret = uvc_acquire_privileges(handle); + if (ret < 0) +@@ -921,10 +926,17 @@ static int uvc_ioctl_s_input(struct file + if (input >= chain->selector->bNrInPins) + return -EINVAL; + +- i = input + 1; +- return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, +- chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, +- &i, 1); ++ buf = kmalloc(1, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ *buf = input + 1; ++ ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, ++ chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, ++ buf, 1); ++ kfree(buf); ++ ++ return ret; + } + + static int uvc_ioctl_queryctrl(struct file *file, void *fh, diff --git a/queue-4.9/power-supply-max17042-handle-fails-of-reading-status-register.patch b/queue-4.9/power-supply-max17042-handle-fails-of-reading-status-register.patch new file mode 100644 index 00000000000..6f057a4d611 --- /dev/null +++ b/queue-4.9/power-supply-max17042-handle-fails-of-reading-status-register.patch @@ -0,0 +1,43 @@ +From 54784ffa5b267f57161eb8fbb811499f22a0a0bf Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 16 Aug 2021 10:27:14 +0200 +Subject: power: supply: max17042: handle fails of reading status register + +From: Krzysztof Kozlowski + +commit 54784ffa5b267f57161eb8fbb811499f22a0a0bf upstream. + +Reading status register can fail in the interrupt handler. In such +case, the regmap_read() will not store anything useful under passed +'val' variable and random stack value will be used to determine type of +interrupt. + +Handle the regmap_read() failure to avoid handling interrupt type and +triggering changed power supply event based on random stack value. + +Fixes: 39e7213edc4f ("max17042_battery: Support regmap to access device's registers") +Cc: +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/max17042_battery.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -760,8 +760,12 @@ static irqreturn_t max17042_thread_handl + { + struct max17042_chip *chip = dev; + u32 val; ++ int ret; ++ ++ ret = regmap_read(chip->regmap, MAX17042_STATUS, &val); ++ if (ret) ++ return IRQ_HANDLED; + +- regmap_read(chip->regmap, MAX17042_STATUS, &val); + if ((val & STATUS_INTR_SOCMIN_BIT) || + (val & STATUS_INTR_SOCMAX_BIT)) { + dev_info(&chip->client->dev, "SOC threshold INTR\n"); diff --git a/queue-4.9/series b/queue-4.9/series index e07d89607ca..d35cbbb995d 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -91,3 +91,8 @@ rtc-tps65910-correct-driver-module-alias.patch pci-msi-skip-masking-msi-x-on-xen-pv.patch powerpc-perf-hv-gpci-fix-counter-value-parsing.patch xen-fix-setting-of-max_pfn-in-shared_info.patch +crypto-public_key-fix-overflow-during-implicit-conversion.patch +power-supply-max17042-handle-fails-of-reading-status-register.patch +vmci-fix-null-pointer-dereference-when-unmapping-queue-pair.patch +media-uvc-don-t-do-dma-on-stack.patch +media-rc-loopback-return-number-of-emitters-rather-than-error.patch diff --git a/queue-4.9/vmci-fix-null-pointer-dereference-when-unmapping-queue-pair.patch b/queue-4.9/vmci-fix-null-pointer-dereference-when-unmapping-queue-pair.patch new file mode 100644 index 00000000000..df14cfde32a --- /dev/null +++ b/queue-4.9/vmci-fix-null-pointer-dereference-when-unmapping-queue-pair.patch @@ -0,0 +1,79 @@ +From a30dc6cf0dc51419021550152e435736aaef8799 Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Wed, 18 Aug 2021 20:48:45 +0800 +Subject: VMCI: fix NULL pointer dereference when unmapping queue pair + +From: Wang Hai + +commit a30dc6cf0dc51419021550152e435736aaef8799 upstream. + +I got a NULL pointer dereference report when doing fuzz test: + +Call Trace: + qp_release_pages+0xae/0x130 + qp_host_unregister_user_memory.isra.25+0x2d/0x80 + vmci_qp_broker_unmap+0x191/0x320 + ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 + vmci_host_unlocked_ioctl+0x59f/0xd50 + ? do_vfs_ioctl+0x14b/0xa10 + ? tomoyo_file_ioctl+0x28/0x30 + ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 + __x64_sys_ioctl+0xea/0x120 + do_syscall_64+0x34/0xb0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +When a queue pair is created by the following call, it will not +register the user memory if the page_store is NULL, and the +entry->state will be set to VMCIQPB_CREATED_NO_MEM. + +vmci_host_unlocked_ioctl + vmci_host_do_alloc_queuepair + vmci_qp_broker_alloc + qp_broker_alloc + qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM; + +When unmapping this queue pair, qp_host_unregister_user_memory() will +be called to unregister the non-existent user memory, which will +result in a null pointer reference. It will also change +VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be +present in this operation. + +Only when the qp broker has mem, it can unregister the user +memory when unmapping the qp broker. + +Only when the qp broker has no mem, it can register the user +memory when mapping the qp broker. + +Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") +Cc: stable +Reported-by: Hulk Robot +Reviewed-by: Jorgen Hansen +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20210818124845.488312-1-wanghai38@huawei.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -2344,7 +2344,8 @@ int vmci_qp_broker_map(struct vmci_handl + is_local = entry->qp.flags & VMCI_QPFLAG_LOCAL; + result = VMCI_SUCCESS; + +- if (context_id != VMCI_HOST_CONTEXT_ID) { ++ if (context_id != VMCI_HOST_CONTEXT_ID && ++ !QPBROKERSTATE_HAS_MEM(entry)) { + struct vmci_qp_page_store page_store; + + page_store.pages = guest_mem; +@@ -2454,7 +2455,8 @@ int vmci_qp_broker_unmap(struct vmci_han + + is_local = entry->qp.flags & VMCI_QPFLAG_LOCAL; + +- if (context_id != VMCI_HOST_CONTEXT_ID) { ++ if (context_id != VMCI_HOST_CONTEXT_ID && ++ QPBROKERSTATE_HAS_MEM(entry)) { + qp_acquire_queue_mutex(entry->produce_q); + result = qp_save_headers(entry); + if (result < VMCI_SUCCESS)