4.19-stable patches

added patches:
	media-dvbdev-fix-build-warning-due-to-comments.patch
	media-dvbdev-fix-refcnt-bug.patch

diff --git a/queue-4.19/media-dvbdev-fix-build-warning-due-to-comments.patch b/queue-4.19/media-dvbdev-fix-build-warning-due-to-comments.patch
new file mode 100644 (file)
index 0000000..7e6a8ea
--- /dev/null
+++ b/queue-4.19/media-dvbdev-fix-build-warning-due-to-comments.patch
@@ -0,0 +1,41 @@
+From 3edfd14bb50fa6f94ed1a37bbb17d9f1c2793b57 Mon Sep 17 00:00:00 2001
+From: Lin Ma <linma@zju.edu.cn>
+Date: Mon, 28 Nov 2022 08:39:03 +0000
+Subject: media: dvbdev: fix build warning due to comments
+
+From: Lin Ma <linma@zju.edu.cn>
+
+commit 3edfd14bb50fa6f94ed1a37bbb17d9f1c2793b57 upstream.
+
+Previous commit that introduces reference counter does not add proper
+comments, which will lead to warning when building htmldocs. Fix them.
+
+Reported-by: "Stephen Rothwell" <sfr@canb.auug.org.au>
+Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/media/dvbdev.h |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/media/dvbdev.h
++++ b/include/media/dvbdev.h
+@@ -126,6 +126,7 @@ struct dvb_adapter {
+  * struct dvb_device - represents a DVB device node
+  *
+  * @list_head:        List head with all DVB devices
++ * @ref:      reference counter
+  * @fops:     pointer to struct file_operations
+  * @adapter:  pointer to the adapter that holds this device node
+  * @type:     type of the device, as defined by &enum dvb_device_type.
+@@ -196,7 +197,7 @@ struct dvb_device {
+ struct dvb_device *dvb_device_get(struct dvb_device *dvbdev);
+ 
+ /**
+- * dvb_device_get - Decrease dvb_device reference
++ * dvb_device_put - Decrease dvb_device reference
+  *
+  * @dvbdev:   pointer to struct dvb_device
+  */

diff --git a/queue-4.19/media-dvbdev-fix-refcnt-bug.patch b/queue-4.19/media-dvbdev-fix-refcnt-bug.patch
new file mode 100644 (file)
index 0000000..a37d977
--- /dev/null
+++ b/queue-4.19/media-dvbdev-fix-refcnt-bug.patch
@@ -0,0 +1,63 @@
+From 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 Mon Sep 17 00:00:00 2001
+From: Lin Ma <linma@zju.edu.cn>
+Date: Mon, 28 Nov 2022 16:21:59 +0000
+Subject: media: dvbdev: fix refcnt bug
+
+From: Lin Ma <linma@zju.edu.cn>
+
+commit 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 upstream.
+
+Previous commit initialize the dvbdev->ref before the template copy,
+which will overwrite the reference and cause refcnt bug.
+
+refcount_t: addition on 0; use-after-free.
+WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
+Modules linked in:
+CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0
+...
+RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
+RSP: 0000:ffffc900000678d0 EFLAGS: 00010282
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c
+RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000
+R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
+FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __refcount_add include/linux/refcount.h:199 [inline]
+ __refcount_inc include/linux/refcount.h:250 [inline]
+ refcount_inc include/linux/refcount.h:267 [inline]
+ kref_get include/linux/kref.h:45 [inline]
+ dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline]
+ dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517
+...
+
+Just place the kref_init at correct position.
+
+Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com
+Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-core/dvbdev.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -490,8 +490,8 @@ int dvb_register_device(struct dvb_adapt
+               return -ENOMEM;
+       }
+ 
+-      kref_init(&dvbdev->ref);
+       memcpy(dvbdev, template, sizeof(struct dvb_device));
++      kref_init(&dvbdev->ref);
+       dvbdev->type = type;
+       dvbdev->id = id;
+       dvbdev->adapter = adap;

diff --git a/queue-4.19/series b/queue-4.19/series
index e3f624886b336b2e6ff461c243f41a6b9bb9e880..e30805010d10eb7e0bd35e1720399c4bce5a0aa9 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -363,3 +363,5 @@ hid-wacom-ensure-bootloader-pid-is-usable-in-hidraw-mode.patch
 reiserfs-add-missing-calls-to-reiserfs_security_free.patch
 iio-adc-ad_sigma_delta-do-not-use-internal-iio_dev-lock.patch
 gcov-add-support-for-checksum-field.patch
+media-dvbdev-fix-build-warning-due-to-comments.patch
+media-dvbdev-fix-refcnt-bug.patch