From: Greg Kroah-Hartman Date: Thu, 15 Jul 2021 18:16:57 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.4.133~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=19ea8669f5154de247e806e4fcbd3a3f118144eb;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: jfs-fix-gpf-in-difree.patch pinctrl-mcp23s08-fix-missing-unlock-on-error-in-mcp23s08_irq.patch smackfs-restrict-bytes-count-in-smk_set_cipso.patch --- diff --git a/queue-4.19/jfs-fix-gpf-in-difree.patch b/queue-4.19/jfs-fix-gpf-in-difree.patch new file mode 100644 index 00000000000..eb7d0d71cea --- /dev/null +++ b/queue-4.19/jfs-fix-gpf-in-difree.patch @@ -0,0 +1,46 @@ +From 9d574f985fe33efd6911f4d752de6f485a1ea732 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Sun, 6 Jun 2021 17:24:05 +0300 +Subject: jfs: fix GPF in diFree + +From: Pavel Skripkin + +commit 9d574f985fe33efd6911f4d752de6f485a1ea732 upstream. + +Avoid passing inode with +JFS_SBI(inode->i_sb)->ipimap == NULL to +diFree()[1]. GFP will appear: + + struct inode *ipimap = JFS_SBI(ip->i_sb)->ipimap; + struct inomap *imap = JFS_IP(ipimap)->i_imap; + +JFS_IP() will return invalid pointer when ipimap == NULL + +Call Trace: + diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1] + jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154 + evict+0x2ed/0x750 fs/inode.c:578 + iput_final fs/inode.c:1654 [inline] + iput.part.0+0x3fe/0x820 fs/inode.c:1680 + iput+0x58/0x70 fs/inode.c:1670 + +Reported-and-tested-by: syzbot+0a89a7b56db04c21a656@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Dave Kleikamp +Signed-off-by: Greg Kroah-Hartman +--- + fs/jfs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jfs/inode.c ++++ b/fs/jfs/inode.c +@@ -161,7 +161,8 @@ void jfs_evict_inode(struct inode *inode + if (test_cflag(COMMIT_Freewmap, inode)) + jfs_free_zero_link(inode); + +- diFree(inode); ++ if (JFS_SBI(inode->i_sb)->ipimap) ++ diFree(inode); + + /* + * Free the inode from the quota allocation. diff --git a/queue-4.19/pinctrl-mcp23s08-fix-missing-unlock-on-error-in-mcp23s08_irq.patch b/queue-4.19/pinctrl-mcp23s08-fix-missing-unlock-on-error-in-mcp23s08_irq.patch new file mode 100644 index 00000000000..966d61b32f8 --- /dev/null +++ b/queue-4.19/pinctrl-mcp23s08-fix-missing-unlock-on-error-in-mcp23s08_irq.patch @@ -0,0 +1,36 @@ +From 884af72c90016cfccd5717439c86b48702cbf184 Mon Sep 17 00:00:00 2001 +From: Zou Wei +Date: Tue, 8 Jun 2021 14:34:08 +0800 +Subject: pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() + +From: Zou Wei + +commit 884af72c90016cfccd5717439c86b48702cbf184 upstream. + +Add the missing unlock before return from function mcp23s08_irq() +in the error handling case. + +v1-->v2: + remove the "return IRQ_HANDLED" line + +Fixes: 897120d41e7a ("pinctrl: mcp23s08: fix race condition in irq handler") +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Link: https://lore.kernel.org/r/1623134048-56051-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-mcp23s08.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -460,7 +460,7 @@ static irqreturn_t mcp23s08_irq(int irq, + + if (intf == 0) { + /* There is no interrupt pending */ +- return IRQ_HANDLED; ++ goto unlock; + } + + if (mcp_read(mcp, MCP_INTCAP, &intcap)) diff --git a/queue-4.19/series b/queue-4.19/series index 2c9c17922ba..2b77e264e21 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -313,3 +313,6 @@ media-gspca-sq905-fix-control-request-direction.patch media-gspca-sunplus-fix-zero-length-control-requests.patch media-rtl28xxu-fix-zero-length-control-request.patch media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch +pinctrl-mcp23s08-fix-missing-unlock-on-error-in-mcp23s08_irq.patch +jfs-fix-gpf-in-difree.patch +smackfs-restrict-bytes-count-in-smk_set_cipso.patch diff --git a/queue-4.19/smackfs-restrict-bytes-count-in-smk_set_cipso.patch b/queue-4.19/smackfs-restrict-bytes-count-in-smk_set_cipso.patch new file mode 100644 index 00000000000..cb0bcf36d4b --- /dev/null +++ b/queue-4.19/smackfs-restrict-bytes-count-in-smk_set_cipso.patch @@ -0,0 +1,39 @@ +From 49ec114a6e62d8d320037ce71c1aaf9650b3cafd Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 12 Apr 2021 22:45:50 +0900 +Subject: smackfs: restrict bytes count in smk_set_cipso() + +From: Tetsuo Handa + +commit 49ec114a6e62d8d320037ce71c1aaf9650b3cafd upstream. + +Oops, I failed to update subject line. + +From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 12 Apr 2021 22:25:06 +0900 +Subject: smackfs: restrict bytes count in smk_set_cipso() + +Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write +functions") missed that count > SMK_CIPSOMAX check applies to only +format == SMK_FIXED24_FMT case. + +Reported-by: syzbot +Signed-off-by: Tetsuo Handa +Signed-off-by: Casey Schaufler +Signed-off-by: Greg Kroah-Hartman +--- + security/smack/smackfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/security/smack/smackfs.c ++++ b/security/smack/smackfs.c +@@ -883,6 +883,8 @@ static ssize_t smk_set_cipso(struct file + if (format == SMK_FIXED24_FMT && + (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)) + return -EINVAL; ++ if (count > PAGE_SIZE) ++ return -EINVAL; + + data = memdup_user_nul(buf, count); + if (IS_ERR(data))