From f0588f72a1ee2a318ecaf0a4eee2df1b42af76a5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 20 Jun 2019 18:49:50 +0200 Subject: [PATCH] 4.14-stable patches added patches: abort-file_remove_privs-for-non-reg.-files.patch --- ...file_remove_privs-for-non-reg.-files.patch | 51 +++++++++++++++++++ ...-autoneg-state-in-phylink_phy_change.patch | 32 ------------ queue-4.14/series | 2 +- 3 files changed, 52 insertions(+), 33 deletions(-) create mode 100644 queue-4.14/abort-file_remove_privs-for-non-reg.-files.patch delete mode 100644 queue-4.14/net-phylink-set-the-autoneg-state-in-phylink_phy_change.patch diff --git a/queue-4.14/abort-file_remove_privs-for-non-reg.-files.patch b/queue-4.14/abort-file_remove_privs-for-non-reg.-files.patch new file mode 100644 index 00000000000..3bf30065160 --- /dev/null +++ b/queue-4.14/abort-file_remove_privs-for-non-reg.-files.patch @@ -0,0 +1,51 @@ +From f69e749a49353d96af1a293f56b5b56de59c668a Mon Sep 17 00:00:00 2001 +From: Alexander Lochmann +Date: Fri, 14 Dec 2018 11:55:52 +0100 +Subject: Abort file_remove_privs() for non-reg. files + +From: Alexander Lochmann + +commit f69e749a49353d96af1a293f56b5b56de59c668a upstream. + +file_remove_privs() might be called for non-regular files, e.g. +blkdev inode. There is no reason to do its job on things +like blkdev inodes, pipes, or cdevs. Hence, abort if +file does not refer to a regular inode. + +AV: more to the point, for devices there might be any number of +inodes refering to given device. Which one to strip the permissions +from, even if that made any sense in the first place? All of them +will be observed with contents modified, after all. + +Found by LockDoc (Alexander Lochmann, Horst Schirmeier and Olaf +Spinczyk) + +Reviewed-by: Jan Kara +Signed-off-by: Alexander Lochmann +Signed-off-by: Horst Schirmeier +Signed-off-by: Al Viro +Cc: Zubin Mithra +Signed-off-by: Greg Kroah-Hartman + +--- + fs/inode.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -1817,8 +1817,13 @@ int file_remove_privs(struct file *file) + int kill; + int error = 0; + +- /* Fast path for nothing security related */ +- if (IS_NOSEC(inode)) ++ /* ++ * Fast path for nothing security related. ++ * As well for non-regular files, e.g. blkdev inodes. ++ * For example, blkdev_write_iter() might get here ++ * trying to remove privs which it is not allowed to. ++ */ ++ if (IS_NOSEC(inode) || !S_ISREG(inode->i_mode)) + return 0; + + kill = dentry_needs_remove_privs(dentry); diff --git a/queue-4.14/net-phylink-set-the-autoneg-state-in-phylink_phy_change.patch b/queue-4.14/net-phylink-set-the-autoneg-state-in-phylink_phy_change.patch deleted file mode 100644 index dfd71f8c3f5..00000000000 --- a/queue-4.14/net-phylink-set-the-autoneg-state-in-phylink_phy_change.patch +++ /dev/null @@ -1,32 +0,0 @@ -From foo@baz Wed 19 Jun 2019 04:01:16 PM CEST -From: Ioana Ciornei -Date: Thu, 13 Jun 2019 09:37:51 +0300 -Subject: net: phylink: set the autoneg state in phylink_phy_change - -From: Ioana Ciornei - -[ Upstream commit ef7bfa84725d891bbdb88707ed55b2cbf94942bb ] - -The phy_state field of phylink should carry only valid information -especially when this can be passed to the .mac_config callback. -Update the an_enabled field with the autoneg state in the -phylink_phy_change function. - -Fixes: 9525ae83959b ("phylink: add phylink infrastructure") -Signed-off-by: Ioana Ciornei -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/phy/phylink.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/phy/phylink.c -+++ b/drivers/net/phy/phylink.c -@@ -598,6 +598,7 @@ void phylink_phy_change(struct phy_devic - pl->phy_state.pause |= MLO_PAUSE_ASYM; - pl->phy_state.interface = phydev->interface; - pl->phy_state.link = up; -+ pl->phy_state.an_enabled = phydev->autoneg; - mutex_unlock(&pl->state_mutex); - - phylink_run_resolve(pl); diff --git a/queue-4.14/series b/queue-4.14/series index 46fa4e8ab34..e93dbabb691 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -5,7 +5,6 @@ ipv6-flowlabel-fl6_sock_lookup-must-use-atomic_inc_not_zero.patch lapb-fixed-leak-of-control-blocks.patch neigh-fix-use-after-free-read-in-pneigh_get_next.patch net-openvswitch-do-not-free-vport-if-register_netdevice-is-failed.patch -net-phylink-set-the-autoneg-state-in-phylink_phy_change.patch sctp-free-cookie-before-we-memdup-a-new-one.patch sunhv-fix-device-naming-inconsistency-between-sunhv_console-and-sunhv_reg.patch staging-vc04_services-fix-a-couple-error-codes.patch @@ -43,3 +42,4 @@ hid-wacom-don-t-report-anything-prior-to-the-tool-entering-range.patch hid-wacom-send-btn_touch-in-response-to-intuosp2_bt-eraser-contact.patch coredump-fix-race-condition-between-collapse_huge_page-and-core-dumping.patch infiniband-fix-race-condition-between-infiniband-mlx4-mlx5-driver-and-core-dumping.patch +abort-file_remove_privs-for-non-reg.-files.patch -- 2.47.2