From 11f7405e67b1c0e483bf15778de0b4e3da50ed32 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 30 Mar 2019 21:21:10 +0100 Subject: [PATCH] 3.18-stable patches added patches: disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch --- ...-sys-module-kgdboc-parameters-kgdboc.patch | 43 ++++++++ ...ull-pointer-dereference-in-put_links.patch | 99 +++++++++++++++++++ ...g-value-in-adnp_gpio_direction_input.patch | 40 ++++++++ queue-3.18/series | 3 + 4 files changed, 185 insertions(+) create mode 100644 queue-3.18/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch create mode 100644 queue-3.18/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch create mode 100644 queue-3.18/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch diff --git a/queue-3.18/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch b/queue-3.18/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch new file mode 100644 index 0000000000..a61003a75c --- /dev/null +++ b/queue-3.18/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch @@ -0,0 +1,43 @@ +From 3ec8002951ea173e24b466df1ea98c56b7920e63 Mon Sep 17 00:00:00 2001 +From: Wentao Wang +Date: Wed, 20 Mar 2019 15:30:39 +0000 +Subject: Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wentao Wang + +commit 3ec8002951ea173e24b466df1ea98c56b7920e63 upstream. + +Echo "" to /sys/module/kgdboc/parameters/kgdboc will fail with "No such +device” error. + +This is caused by function "configure_kgdboc" who init err to ENODEV +when the config is empty (legal input) the code go out with ENODEV +returned. + +Fixes: 2dd453168643 ("kgdboc: Fix restrict error") +Signed-off-by: Wentao Wang +Cc: stable +Acked-by: Daniel Thompson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/kgdboc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -148,8 +148,10 @@ static int configure_kgdboc(void) + char *cptr = config; + struct console *cons; + +- if (!strlen(config) || isspace(config[0])) ++ if (!strlen(config) || isspace(config[0])) { ++ err = 0; + goto noconfig; ++ } + + kgdboc_io_ops.is_console = 0; + kgdb_tty_driver = NULL; diff --git a/queue-3.18/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch b/queue-3.18/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch new file mode 100644 index 0000000000..34f541e01e --- /dev/null +++ b/queue-3.18/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch @@ -0,0 +1,99 @@ +From 23da9588037ecdd4901db76a5b79a42b529c4ec3 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 28 Mar 2019 20:44:40 -0700 +Subject: fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links + +From: YueHaibing + +commit 23da9588037ecdd4901db76a5b79a42b529c4ec3 upstream. + +Syzkaller reports: + +kasan: GPF could be caused by NULL-ptr deref or user memory access +general protection fault: 0000 [#1] SMP KASAN PTI +CPU: 1 PID: 5373 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +RIP: 0010:put_links+0x101/0x440 fs/proc/proc_sysctl.c:1599 +Code: 00 0f 85 3a 03 00 00 48 8b 43 38 48 89 44 24 20 48 83 c0 38 48 89 c2 48 89 44 24 28 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 fe 02 00 00 48 8b 74 24 20 48 c7 c7 60 2a 9d 91 +RSP: 0018:ffff8881d828f238 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: ffff8881e01b1140 RCX: ffffffff8ee98267 +RDX: 0000000000000007 RSI: ffffc90001479000 RDI: ffff8881e01b1178 +RBP: dffffc0000000000 R08: ffffed103ee27259 R09: ffffed103ee27259 +R10: 0000000000000001 R11: ffffed103ee27258 R12: fffffffffffffff4 +R13: 0000000000000006 R14: ffff8881f59838c0 R15: dffffc0000000000 +FS: 00007f072254f700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fff8b286668 CR3: 00000001f0542002 CR4: 00000000007606e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + drop_sysctl_table+0x152/0x9f0 fs/proc/proc_sysctl.c:1629 + get_subdir fs/proc/proc_sysctl.c:1022 [inline] + __register_sysctl_table+0xd65/0x1090 fs/proc/proc_sysctl.c:1335 + br_netfilter_init+0xbc/0x1000 [br_netfilter] + do_one_initcall+0xfa/0x5ca init/main.c:887 + do_init_module+0x204/0x5f6 kernel/module.c:3460 + load_module+0x66b2/0x8570 kernel/module.c:3808 + __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 + do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x462e99 +Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f072254ec58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 +RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 +RBP: 00007f072254ec70 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f072254f6bc +R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004 +Modules linked in: br_netfilter(+) dvb_usb_dibusb_mc_common dib3000mc dibx000_common dvb_usb_dibusb_common dvb_usb_dw2102 dvb_usb classmate_laptop palmas_regulator cn videobuf2_v4l2 v4l2_common snd_soc_bd28623 mptbase snd_usb_usx2y snd_usbmidi_lib snd_rawmidi wmi libnvdimm lockd sunrpc grace rc_kworld_pc150u rc_core rtc_da9063 sha1_ssse3 i2c_cros_ec_tunnel adxl34x_spi adxl34x nfnetlink lib80211 i5500_temp dvb_as102 dvb_core videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops udc_core lnbp22 leds_lp3952 hid_roccat_ryos s1d13xxxfb mtd vport_geneve openvswitch nf_conncount nf_nat_ipv6 nsh geneve udp_tunnel ip6_udp_tunnel snd_soc_mt6351 sis_agp phylink snd_soc_adau1761_spi snd_soc_adau1761 snd_soc_adau17x1 snd_soc_core snd_pcm_dmaengine ac97_bus snd_compress snd_soc_adau_utils snd_soc_sigmadsp_regmap snd_soc_sigmadsp raid_class hid_roccat_konepure hid_roccat_common hid_roccat c2port_duramar2150 core mdio_bcm_unimac iptable_security iptable_raw iptable_mangle + iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim devlink vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel joydev mousedev ide_pci_generic piix aesni_intel aes_x86_64 ide_core crypto_simd atkbd cryptd glue_helper serio_raw ata_generic pata_acpi i2c_piix4 floppy sch_fq_codel ip_tables x_tables ipv6 [last unloaded: lm73] +Dumping ftrace buffer: + (ftrace buffer empty) +---[ end trace 770020de38961fd0 ]--- + +A new dir entry can be created in get_subdir and its 'header->parent' is +set to NULL. Only after insert_header success, it will be set to 'dir', +otherwise 'header->parent' is set to NULL and drop_sysctl_table is called. +However in err handling path of get_subdir, drop_sysctl_table also be +called on 'new->header' regardless its value of parent pointer. Then +put_links is called, which triggers NULL-ptr deref when access member of +header->parent. + +In fact we have multiple error paths which call drop_sysctl_table() there, +upon failure on insert_links() we also call drop_sysctl_table().And even +in the successful case on __register_sysctl_table() we still always call +drop_sysctl_table().This patch fix it. + +Link: http://lkml.kernel.org/r/20190314085527.13244-1-yuehaibing@huawei.com +Fixes: 0e47c99d7fe25 ("sysctl: Replace root_list with links between sysctl_table_sets") +Signed-off-by: YueHaibing +Reported-by: Hulk Robot +Acked-by: Luis Chamberlain +Cc: Kees Cook +Cc: Alexey Dobriyan +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Al Viro +Cc: Eric W. Biederman +Cc: [3.4+] +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/proc_sysctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -1512,7 +1512,8 @@ static void drop_sysctl_table(struct ctl + if (--header->nreg) + return; + +- put_links(header); ++ if (parent) ++ put_links(header); + start_unregistering(header); + if (!--header->count) + kfree_rcu(header, rcu); diff --git a/queue-3.18/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch b/queue-3.18/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch new file mode 100644 index 0000000000..d700f34961 --- /dev/null +++ b/queue-3.18/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch @@ -0,0 +1,40 @@ +From c5bc6e526d3f217ed2cc3681d256dc4a2af4cc2b Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Mon, 11 Mar 2019 21:29:37 +0800 +Subject: gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input + +From: Axel Lin + +commit c5bc6e526d3f217ed2cc3681d256dc4a2af4cc2b upstream. + +Current code test wrong value so it does not verify if the written +data is correctly read back. Fix it. +Also make it return -EPERM if read value does not match written bit, +just like it done for adnp_gpio_direction_output(). + +Fixes: 5e969a401a01 ("gpio: Add Avionic Design N-bit GPIO expander support") +Cc: +Signed-off-by: Axel Lin +Reviewed-by: Thierry Reding +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-adnp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-adnp.c ++++ b/drivers/gpio/gpio-adnp.c +@@ -137,8 +137,10 @@ static int adnp_gpio_direction_input(str + if (err < 0) + goto out; + +- if (err & BIT(pos)) +- err = -EACCES; ++ if (value & BIT(pos)) { ++ err = -EPERM; ++ goto out; ++ } + + err = 0; + diff --git a/queue-3.18/series b/queue-3.18/series index f3cd7315d7..866a6e5cd7 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -42,3 +42,6 @@ serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch usb-serial-cp210x-add-new-device-id.patch usb-serial-ftdi_sio-add-additional-novatech-products.patch usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch +disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch +fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch +gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch -- 2.39.2