From: Greg Kroah-Hartman Date: Sat, 23 May 2020 12:21:40 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.4.225~48 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=24cd7e1eb5b3acbb3240a83134085b0104cd5e38;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: apparmor-fix-aa_label-refcnt-leak-in-policy_update.patch dmaengine-tegra210-adma-fix-an-error-handling-path-in-tegra_adma_probe.patch --- diff --git a/queue-4.14/apparmor-fix-aa_label-refcnt-leak-in-policy_update.patch b/queue-4.14/apparmor-fix-aa_label-refcnt-leak-in-policy_update.patch new file mode 100644 index 00000000000..ae6a89424b3 --- /dev/null +++ b/queue-4.14/apparmor-fix-aa_label-refcnt-leak-in-policy_update.patch @@ -0,0 +1,53 @@ +From c6b39f070722ea9963ffe756bfe94e89218c5e63 Mon Sep 17 00:00:00 2001 +From: Xiyu Yang +Date: Mon, 20 Apr 2020 13:35:28 +0800 +Subject: apparmor: Fix aa_label refcnt leak in policy_update + +From: Xiyu Yang + +commit c6b39f070722ea9963ffe756bfe94e89218c5e63 upstream. + +policy_update() invokes begin_current_label_crit_section(), which +returns a reference of the updated aa_label object to "label" with +increased refcount. + +When policy_update() returns, "label" becomes invalid, so the refcount +should be decreased to keep refcount balanced. + +The reference counting issue happens in one exception handling path of +policy_update(). When aa_may_manage_policy() returns not NULL, the +refcnt increased by begin_current_label_crit_section() is not decreased, +causing a refcnt leak. + +Fix this issue by jumping to "end_section" label when +aa_may_manage_policy() returns not NULL. + +Fixes: 5ac8c355ae00 ("apparmor: allow introspecting the loaded policy pre internal transform") +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: John Johansen +Signed-off-by: Greg Kroah-Hartman + +--- + security/apparmor/apparmorfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -426,7 +426,7 @@ static ssize_t policy_update(u32 mask, c + */ + error = aa_may_manage_policy(label, ns, mask); + if (error) +- return error; ++ goto end_section; + + data = aa_simple_write_to_buffer(buf, size, size, pos); + error = PTR_ERR(data); +@@ -434,6 +434,7 @@ static ssize_t policy_update(u32 mask, c + error = aa_replace_profiles(ns, label, mask, data); + aa_put_loaddata(data); + } ++end_section: + end_current_label_crit_section(label); + + return error; diff --git a/queue-4.14/dmaengine-tegra210-adma-fix-an-error-handling-path-in-tegra_adma_probe.patch b/queue-4.14/dmaengine-tegra210-adma-fix-an-error-handling-path-in-tegra_adma_probe.patch new file mode 100644 index 00000000000..5caa106c53a --- /dev/null +++ b/queue-4.14/dmaengine-tegra210-adma-fix-an-error-handling-path-in-tegra_adma_probe.patch @@ -0,0 +1,40 @@ +From 3a5fd0dbd87853f8bd2ea275a5b3b41d6686e761 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 16 May 2020 23:42:05 +0200 +Subject: dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()' + +From: Christophe JAILLET + +commit 3a5fd0dbd87853f8bd2ea275a5b3b41d6686e761 upstream. + +Commit b53611fb1ce9 ("dmaengine: tegra210-adma: Fix crash during probe") +has moved some code in the probe function and reordered the error handling +path accordingly. +However, a goto has been missed. + +Fix it and goto the right label if 'dma_async_device_register()' fails, so +that all resources are released. + +Fixes: b53611fb1ce9 ("dmaengine: tegra210-adma: Fix crash during probe") +Signed-off-by: Christophe JAILLET +Reviewed-by: Jon Hunter +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20200516214205.276266-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/tegra210-adma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -793,7 +793,7 @@ static int tegra_adma_probe(struct platf + ret = dma_async_device_register(&tdma->dma_dev); + if (ret < 0) { + dev_err(&pdev->dev, "ADMA registration failed: %d\n", ret); +- goto irq_dispose; ++ goto rpm_put; + } + + ret = of_dma_controller_register(pdev->dev.of_node, diff --git a/queue-4.14/series b/queue-4.14/series index b27a3d660b6..755332abba1 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -34,3 +34,5 @@ l2tp-protect-sock-pointer-of-struct-pppol2tp_session-with-rcu.patch l2tp-initialise-ppp-sessions-before-registering-them.patch alsa-iec1712-initialize-stdsp24-properly-when-using-the-model-staudio-option.patch alsa-pcm-fix-incorrect-hw_base-increase.patch +apparmor-fix-aa_label-refcnt-leak-in-policy_update.patch +dmaengine-tegra210-adma-fix-an-error-handling-path-in-tegra_adma_probe.patch