4.14-stable patches

added patches:
	media-dvbdev-fix-refcnt-bug.patch

diff --git a/queue-4.14/media-dvbdev-fix-refcnt-bug.patch b/queue-4.14/media-dvbdev-fix-refcnt-bug.patch
new file mode 100644 (file)
index 0000000..5a9effc
--- /dev/null
+++ b/queue-4.14/media-dvbdev-fix-refcnt-bug.patch
@@ -0,0 +1,63 @@
+From 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 Mon Sep 17 00:00:00 2001
+From: Lin Ma <linma@zju.edu.cn>
+Date: Mon, 28 Nov 2022 16:21:59 +0000
+Subject: media: dvbdev: fix refcnt bug
+
+From: Lin Ma <linma@zju.edu.cn>
+
+commit 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 upstream.
+
+Previous commit initialize the dvbdev->ref before the template copy,
+which will overwrite the reference and cause refcnt bug.
+
+refcount_t: addition on 0; use-after-free.
+WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
+Modules linked in:
+CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0
+...
+RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
+RSP: 0000:ffffc900000678d0 EFLAGS: 00010282
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c
+RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000
+R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
+FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __refcount_add include/linux/refcount.h:199 [inline]
+ __refcount_inc include/linux/refcount.h:250 [inline]
+ refcount_inc include/linux/refcount.h:267 [inline]
+ kref_get include/linux/kref.h:45 [inline]
+ dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline]
+ dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517
+...
+
+Just place the kref_init at correct position.
+
+Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com
+Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-core/dvbdev.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -465,8 +465,8 @@ int dvb_register_device(struct dvb_adapt
+               return -ENOMEM;
+       }
+ 
+-      kref_init(&dvbdev->ref);
+       memcpy(dvbdev, template, sizeof(struct dvb_device));
++      kref_init(&dvbdev->ref);
+       dvbdev->type = type;
+       dvbdev->id = id;
+       dvbdev->adapter = adap;

diff --git a/queue-4.14/series b/queue-4.14/series
index 41907618b876261e270ebcd31d4ef1246c33fb5d..98b86aea983e960b0e856b84f011706e5465e8ad 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -261,3 +261,4 @@ hid-wacom-ensure-bootloader-pid-is-usable-in-hidraw-mode.patch
 reiserfs-add-missing-calls-to-reiserfs_security_free.patch
 iio-adc-ad_sigma_delta-do-not-use-internal-iio_dev-lock.patch
 gcov-add-support-for-checksum-field.patch
+media-dvbdev-fix-refcnt-bug.patch