From 10cbb2685561d6d7ddf01b2f074d489f6404db22 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 20 Apr 2021 09:32:07 +0200 Subject: [PATCH] drop net-rds-avoid-potential-use-after-free-in-rds_send_r.patch from everywhere. Stupid professors trying to trick kernel reviewers... --- ...tential-use-after-free-in-rds_send_r.patch | 50 ------------------- queue-4.14/series | 1 - ...tential-use-after-free-in-rds_send_r.patch | 50 ------------------- queue-4.19/series | 1 - ...tential-use-after-free-in-rds_send_r.patch | 50 ------------------- queue-4.4/series | 1 - ...tential-use-after-free-in-rds_send_r.patch | 50 ------------------- queue-4.9/series | 1 - ...tential-use-after-free-in-rds_send_r.patch | 50 ------------------- queue-5.10/series | 1 - ...tential-use-after-free-in-rds_send_r.patch | 50 ------------------- queue-5.11/series | 1 - ...tential-use-after-free-in-rds_send_r.patch | 50 ------------------- queue-5.4/series | 1 - 14 files changed, 357 deletions(-) delete mode 100644 queue-4.14/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch delete mode 100644 queue-4.19/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch delete mode 100644 queue-4.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch delete mode 100644 queue-4.9/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch delete mode 100644 queue-5.10/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch delete mode 100644 queue-5.11/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch delete mode 100644 queue-5.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch diff --git a/queue-4.14/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch b/queue-4.14/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch deleted file mode 100644 index 917860c0f1a..00000000000 --- a/queue-4.14/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 223d9c65a0f929306cd69e4ccf1f74dad3ed9167 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Apr 2021 19:09:12 -0500 -Subject: net/rds: Avoid potential use after free in rds_send_remove_from_sock - -From: Aditya Pakki - -[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ] - -In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource -is freed and later under spinlock, causing potential use-after-free. -Set the free pointer to NULL to avoid undefined behavior. - -Signed-off-by: Aditya Pakki -Acked-by: Santosh Shilimkar -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/rds/message.c | 1 + - net/rds/send.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rds/message.c b/net/rds/message.c -index 4318cc9b78f7..b6765ead733b 100644 ---- a/net/rds/message.c -+++ b/net/rds/message.c -@@ -91,6 +91,7 @@ void rds_message_put(struct rds_message *rm) - rds_message_purge(rm); - - kfree(rm); -+ rm = NULL; - } - } - EXPORT_SYMBOL_GPL(rds_message_put); -diff --git a/net/rds/send.c b/net/rds/send.c -index 23f2d81e7967..3a8e1f72bf33 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -645,7 +645,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) - unlock_and_drop: - spin_unlock_irqrestore(&rm->m_rs_lock, flags); - rds_message_put(rm); -- if (was_on_sock) -+ if (was_on_sock && rm) - rds_message_put(rm); - } - --- -2.30.2 - diff --git a/queue-4.14/series b/queue-4.14/series index c524cbf5320..e9fe996d9fa 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -15,7 +15,6 @@ net-ieee802154-forbid-monitor-for-add-llsec-devkey.patch net-ieee802154-stop-dump-llsec-seclevels-for-monitor.patch net-ieee802154-forbid-monitor-for-add-llsec-seclevel.patch pcnet32-use-pci_resource_len-to-validate-pci-resourc.patch -net-rds-avoid-potential-use-after-free-in-rds_send_r.patch net-tipc-fix-spelling-errors-in-net-tipc-module.patch mac80211-clear-sta-fast_rx-when-sta-removed-from-4-a.patch input-i8042-fix-pegatron-c15b-id-entry.patch diff --git a/queue-4.19/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch b/queue-4.19/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch deleted file mode 100644 index 7034728ad85..00000000000 --- a/queue-4.19/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch +++ /dev/null @@ -1,50 +0,0 @@ -From ff1a1a262bd5c9680d7c29f4d4f80ad6b82933f9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Apr 2021 19:09:12 -0500 -Subject: net/rds: Avoid potential use after free in rds_send_remove_from_sock - -From: Aditya Pakki - -[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ] - -In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource -is freed and later under spinlock, causing potential use-after-free. -Set the free pointer to NULL to avoid undefined behavior. - -Signed-off-by: Aditya Pakki -Acked-by: Santosh Shilimkar -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/rds/message.c | 1 + - net/rds/send.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rds/message.c b/net/rds/message.c -index 4b00b1152a5f..e35c9c914df0 100644 ---- a/net/rds/message.c -+++ b/net/rds/message.c -@@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm) - rds_message_purge(rm); - - kfree(rm); -+ rm = NULL; - } - } - EXPORT_SYMBOL_GPL(rds_message_put); -diff --git a/net/rds/send.c b/net/rds/send.c -index 26e2c2305f7a..f480a447a432 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -655,7 +655,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) - unlock_and_drop: - spin_unlock_irqrestore(&rm->m_rs_lock, flags); - rds_message_put(rm); -- if (was_on_sock) -+ if (was_on_sock && rm) - rds_message_put(rm); - } - --- -2.30.2 - diff --git a/queue-4.19/series b/queue-4.19/series index 1b9466b8142..46f6e7bb4ef 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -19,7 +19,6 @@ net-ieee802154-forbid-monitor-for-add-llsec-devkey.patch net-ieee802154-stop-dump-llsec-seclevels-for-monitor.patch net-ieee802154-forbid-monitor-for-add-llsec-seclevel.patch pcnet32-use-pci_resource_len-to-validate-pci-resourc.patch -net-rds-avoid-potential-use-after-free-in-rds_send_r.patch net-tipc-fix-spelling-errors-in-net-tipc-module.patch mac80211-clear-sta-fast_rx-when-sta-removed-from-4-a.patch input-s6sy761-fix-coordinate-read-bit-shift.patch diff --git a/queue-4.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch b/queue-4.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch deleted file mode 100644 index 13b5798605b..00000000000 --- a/queue-4.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch +++ /dev/null @@ -1,50 +0,0 @@ -From c04acb504c005d8ac0ae208870b806ee877dbae0 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Apr 2021 19:09:12 -0500 -Subject: net/rds: Avoid potential use after free in rds_send_remove_from_sock - -From: Aditya Pakki - -[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ] - -In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource -is freed and later under spinlock, causing potential use-after-free. -Set the free pointer to NULL to avoid undefined behavior. - -Signed-off-by: Aditya Pakki -Acked-by: Santosh Shilimkar -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/rds/message.c | 1 + - net/rds/send.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rds/message.c b/net/rds/message.c -index 756c73729126..decf2ee33c23 100644 ---- a/net/rds/message.c -+++ b/net/rds/message.c -@@ -89,6 +89,7 @@ void rds_message_put(struct rds_message *rm) - rds_message_purge(rm); - - kfree(rm); -+ rm = NULL; - } - } - EXPORT_SYMBOL_GPL(rds_message_put); -diff --git a/net/rds/send.c b/net/rds/send.c -index 1a3c6acdd3f8..1415a296f7b2 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -668,7 +668,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) - unlock_and_drop: - spin_unlock_irqrestore(&rm->m_rs_lock, flags); - rds_message_put(rm); -- if (was_on_sock) -+ if (was_on_sock && rm) - rds_message_put(rm); - } - --- -2.30.2 - diff --git a/queue-4.4/series b/queue-4.4/series index 1ca4501df7f..e2e336cf89e 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -14,7 +14,6 @@ net-ieee802154-forbid-monitor-for-add-llsec-devkey.patch net-ieee802154-stop-dump-llsec-seclevels-for-monitor.patch net-ieee802154-forbid-monitor-for-add-llsec-seclevel.patch pcnet32-use-pci_resource_len-to-validate-pci-resourc.patch -net-rds-avoid-potential-use-after-free-in-rds_send_r.patch net-tipc-fix-spelling-errors-in-net-tipc-module.patch input-i8042-fix-pegatron-c15b-id-entry.patch scsi-libsas-reset-num_scatter-if-libata-marks-qc-as-nodata.patch diff --git a/queue-4.9/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch b/queue-4.9/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch deleted file mode 100644 index 01da813331e..00000000000 --- a/queue-4.9/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 346e027955df13feb293e8556c35767bd95f8e8a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Apr 2021 19:09:12 -0500 -Subject: net/rds: Avoid potential use after free in rds_send_remove_from_sock - -From: Aditya Pakki - -[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ] - -In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource -is freed and later under spinlock, causing potential use-after-free. -Set the free pointer to NULL to avoid undefined behavior. - -Signed-off-by: Aditya Pakki -Acked-by: Santosh Shilimkar -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/rds/message.c | 1 + - net/rds/send.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rds/message.c b/net/rds/message.c -index 6cb91061556a..bee84584ce34 100644 ---- a/net/rds/message.c -+++ b/net/rds/message.c -@@ -90,6 +90,7 @@ void rds_message_put(struct rds_message *rm) - rds_message_purge(rm); - - kfree(rm); -+ rm = NULL; - } - } - EXPORT_SYMBOL_GPL(rds_message_put); -diff --git a/net/rds/send.c b/net/rds/send.c -index 50241d30e16d..a84198e1b87c 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -640,7 +640,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) - unlock_and_drop: - spin_unlock_irqrestore(&rm->m_rs_lock, flags); - rds_message_put(rm); -- if (was_on_sock) -+ if (was_on_sock && rm) - rds_message_put(rm); - } - --- -2.30.2 - diff --git a/queue-4.9/series b/queue-4.9/series index 1d9f1df189f..e62fabb7453 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -14,7 +14,6 @@ net-ieee802154-forbid-monitor-for-add-llsec-devkey.patch net-ieee802154-stop-dump-llsec-seclevels-for-monitor.patch net-ieee802154-forbid-monitor-for-add-llsec-seclevel.patch pcnet32-use-pci_resource_len-to-validate-pci-resourc.patch -net-rds-avoid-potential-use-after-free-in-rds_send_r.patch net-tipc-fix-spelling-errors-in-net-tipc-module.patch input-i8042-fix-pegatron-c15b-id-entry.patch scsi-libsas-reset-num_scatter-if-libata-marks-qc-as-nodata.patch diff --git a/queue-5.10/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch b/queue-5.10/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch deleted file mode 100644 index 79007bca7a4..00000000000 --- a/queue-5.10/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 0e5885d82bddd73c5de5ddc79a3f765eecb80bf8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Apr 2021 19:09:12 -0500 -Subject: net/rds: Avoid potential use after free in rds_send_remove_from_sock - -From: Aditya Pakki - -[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ] - -In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource -is freed and later under spinlock, causing potential use-after-free. -Set the free pointer to NULL to avoid undefined behavior. - -Signed-off-by: Aditya Pakki -Acked-by: Santosh Shilimkar -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/rds/message.c | 1 + - net/rds/send.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rds/message.c b/net/rds/message.c -index 799034e0f513..4fc66ff0f1ec 100644 ---- a/net/rds/message.c -+++ b/net/rds/message.c -@@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm) - rds_message_purge(rm); - - kfree(rm); -+ rm = NULL; - } - } - EXPORT_SYMBOL_GPL(rds_message_put); -diff --git a/net/rds/send.c b/net/rds/send.c -index 985d0b7713ac..fe5264b9d4b3 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -665,7 +665,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) - unlock_and_drop: - spin_unlock_irqrestore(&rm->m_rs_lock, flags); - rds_message_put(rm); -- if (was_on_sock) -+ if (was_on_sock && rm) - rds_message_put(rm); - } - --- -2.30.2 - diff --git a/queue-5.10/series b/queue-5.10/series index e319e2cb24f..c8515f1969f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -39,7 +39,6 @@ net-ieee802154-forbid-monitor-for-del-llsec-devkey.patch net-ieee802154-stop-dump-llsec-seclevels-for-monitor.patch net-ieee802154-forbid-monitor-for-add-llsec-seclevel.patch pcnet32-use-pci_resource_len-to-validate-pci-resourc.patch -net-rds-avoid-potential-use-after-free-in-rds_send_r.patch net-tipc-fix-spelling-errors-in-net-tipc-module.patch mac80211-clear-sta-fast_rx-when-sta-removed-from-4-a.patch virt_wifi-return-micros-for-bss-tsf-values.patch diff --git a/queue-5.11/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch b/queue-5.11/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch deleted file mode 100644 index aea324d86c5..00000000000 --- a/queue-5.11/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 649dbab00420f7e525a2eb84b7743a32d9ac02cb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Apr 2021 19:09:12 -0500 -Subject: net/rds: Avoid potential use after free in rds_send_remove_from_sock - -From: Aditya Pakki - -[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ] - -In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource -is freed and later under spinlock, causing potential use-after-free. -Set the free pointer to NULL to avoid undefined behavior. - -Signed-off-by: Aditya Pakki -Acked-by: Santosh Shilimkar -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/rds/message.c | 1 + - net/rds/send.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rds/message.c b/net/rds/message.c -index 799034e0f513..4fc66ff0f1ec 100644 ---- a/net/rds/message.c -+++ b/net/rds/message.c -@@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm) - rds_message_purge(rm); - - kfree(rm); -+ rm = NULL; - } - } - EXPORT_SYMBOL_GPL(rds_message_put); -diff --git a/net/rds/send.c b/net/rds/send.c -index 985d0b7713ac..fe5264b9d4b3 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -665,7 +665,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) - unlock_and_drop: - spin_unlock_irqrestore(&rm->m_rs_lock, flags); - rds_message_put(rm); -- if (was_on_sock) -+ if (was_on_sock && rm) - rds_message_put(rm); - } - --- -2.30.2 - diff --git a/queue-5.11/series b/queue-5.11/series index b197e383581..e41b9a2ca1a 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -46,7 +46,6 @@ net-ieee802154-forbid-monitor-for-del-llsec-devkey.patch net-ieee802154-stop-dump-llsec-seclevels-for-monitor.patch net-ieee802154-forbid-monitor-for-add-llsec-seclevel.patch pcnet32-use-pci_resource_len-to-validate-pci-resourc.patch -net-rds-avoid-potential-use-after-free-in-rds_send_r.patch net-tipc-fix-spelling-errors-in-net-tipc-module.patch drm-amd-display-add-missing-mask-for-dcn3.patch mac80211-clear-sta-fast_rx-when-sta-removed-from-4-a.patch diff --git a/queue-5.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch b/queue-5.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch deleted file mode 100644 index 79137929c22..00000000000 --- a/queue-5.4/net-rds-avoid-potential-use-after-free-in-rds_send_r.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 9879523df9063eab9b389b1e7934f0ff23c4bb7a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 6 Apr 2021 19:09:12 -0500 -Subject: net/rds: Avoid potential use after free in rds_send_remove_from_sock - -From: Aditya Pakki - -[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ] - -In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource -is freed and later under spinlock, causing potential use-after-free. -Set the free pointer to NULL to avoid undefined behavior. - -Signed-off-by: Aditya Pakki -Acked-by: Santosh Shilimkar -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - net/rds/message.c | 1 + - net/rds/send.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/net/rds/message.c b/net/rds/message.c -index 92b6b22884d4..ed1d2255ce5a 100644 ---- a/net/rds/message.c -+++ b/net/rds/message.c -@@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm) - rds_message_purge(rm); - - kfree(rm); -+ rm = NULL; - } - } - EXPORT_SYMBOL_GPL(rds_message_put); -diff --git a/net/rds/send.c b/net/rds/send.c -index 68e2bdb08fd0..aa3bc081773f 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -665,7 +665,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status) - unlock_and_drop: - spin_unlock_irqrestore(&rm->m_rs_lock, flags); - rds_message_put(rm); -- if (was_on_sock) -+ if (was_on_sock && rm) - rds_message_put(rm); - } - --- -2.30.2 - diff --git a/queue-5.4/series b/queue-5.4/series index 0aca272568c..f5c5cf72282 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -33,7 +33,6 @@ net-ieee802154-forbid-monitor-for-del-llsec-devkey.patch net-ieee802154-stop-dump-llsec-seclevels-for-monitor.patch net-ieee802154-forbid-monitor-for-add-llsec-seclevel.patch pcnet32-use-pci_resource_len-to-validate-pci-resourc.patch -net-rds-avoid-potential-use-after-free-in-rds_send_r.patch net-tipc-fix-spelling-errors-in-net-tipc-module.patch mac80211-clear-sta-fast_rx-when-sta-removed-from-4-a.patch virt_wifi-return-micros-for-bss-tsf-values.patch -- 2.47.3