From fdb39b58ce6187798bbcd228653fbc8d7321f8e6 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 4 Mar 2024 07:39:08 +0100 Subject: [PATCH] 5.15-stable patches added patches: alsa-firewire-lib-fix-to-check-cycle-continuity.patch tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch --- ...re-lib-fix-to-check-cycle-continuity.patch | 39 +++++++++++++++++ queue-5.15/series | 2 + ...af-write-bug-in-tomoyo_write_control.patch | 43 +++++++++++++++++++ 3 files changed, 84 insertions(+) create mode 100644 queue-5.15/alsa-firewire-lib-fix-to-check-cycle-continuity.patch create mode 100644 queue-5.15/tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch diff --git a/queue-5.15/alsa-firewire-lib-fix-to-check-cycle-continuity.patch b/queue-5.15/alsa-firewire-lib-fix-to-check-cycle-continuity.patch new file mode 100644 index 00000000000..a9c36ef8718 --- /dev/null +++ b/queue-5.15/alsa-firewire-lib-fix-to-check-cycle-continuity.patch @@ -0,0 +1,39 @@ +From 77ce96543b03f437c6b45f286d8110db2b6622a3 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sun, 18 Feb 2024 12:30:26 +0900 +Subject: ALSA: firewire-lib: fix to check cycle continuity + +From: Takashi Sakamoto + +commit 77ce96543b03f437c6b45f286d8110db2b6622a3 upstream. + +The local helper function to compare the given pair of cycle count +evaluates them. If the left value is less than the right value, the +function returns negative value. + +If the safe cycle is less than the current cycle, it is the case of +cycle lost. However, it is not currently handled properly. + +This commit fixes the bug. + +Cc: +Fixes: 705794c53b00 ("ALSA: firewire-lib: check cycle continuity") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20240218033026.72577-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/firewire/amdtp-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -934,7 +934,7 @@ static int generate_device_pkt_descs(str + // to the reason. + unsigned int safe_cycle = increment_ohci_cycle_count(next_cycle, + IR_JUMBO_PAYLOAD_MAX_SKIP_CYCLES); +- lost = (compare_ohci_cycle_count(safe_cycle, cycle) > 0); ++ lost = (compare_ohci_cycle_count(safe_cycle, cycle) < 0); + } + if (lost) { + dev_err(&s->unit->device, "Detect discontinuity of cycle: %d %d\n", diff --git a/queue-5.15/series b/queue-5.15/series index 85fd4674e45..a310ccac5aa 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -44,3 +44,5 @@ alsa-drop-leftover-snd-rtctimer-stuff-from-makefile.patch fbcon-always-restore-the-old-font-data-in-fbcon_do_s.patch afs-fix-endless-loop-in-directory-parsing.patch riscv-sparse-memory-vmemmap-out-of-bounds-fix.patch +tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch +alsa-firewire-lib-fix-to-check-cycle-continuity.patch diff --git a/queue-5.15/tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch b/queue-5.15/tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch new file mode 100644 index 00000000000..1de07827251 --- /dev/null +++ b/queue-5.15/tomoyo-fix-uaf-write-bug-in-tomoyo_write_control.patch @@ -0,0 +1,43 @@ +From 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Fri, 1 Mar 2024 22:04:06 +0900 +Subject: tomoyo: fix UAF write bug in tomoyo_write_control() + +From: Tetsuo Handa + +commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream. + +Since tomoyo_write_control() updates head->write_buf when write() +of long lines is requested, we need to fetch head->write_buf after +head->io_sem is held. Otherwise, concurrent write() requests can +cause use-after-free-write and double-free problems. + +Reported-by: Sam Sun +Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji8g@mail.gmail.com +Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") +Cc: # Linux 3.1+ +Signed-off-by: Tetsuo Handa +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + security/tomoyo/common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/security/tomoyo/common.c ++++ b/security/tomoyo/common.c +@@ -2657,13 +2657,14 @@ ssize_t tomoyo_write_control(struct tomo + { + int error = buffer_len; + size_t avail_len = buffer_len; +- char *cp0 = head->write_buf; ++ char *cp0; + int idx; + + if (!head->write) + return -EINVAL; + if (mutex_lock_interruptible(&head->io_sem)) + return -EINTR; ++ cp0 = head->write_buf; + head->read_user_buf_avail = 0; + idx = tomoyo_read_lock(); + /* Read a line and dispatch it to the policy handler. */ -- 2.47.3