From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 17 Sep 2019 17:43:10 +0000 (+0200)
Subject: 4.19-stable patches
X-Git-Tag: v4.14.145~13
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=43c65cde445320a00398908125844cefce761fcc;p=thirdparty%2Fkernel%2Fstable-queue.git

4.19-stable patches

added patches:
	rsi-fix-a-double-free-bug-in-rsi_91x_deinit.patch
---

diff --git a/queue-4.19/rsi-fix-a-double-free-bug-in-rsi_91x_deinit.patch b/queue-4.19/rsi-fix-a-double-free-bug-in-rsi_91x_deinit.patch
new file mode 100644
index 00000000000..8f80ea228dc
--- /dev/null
+++ b/queue-4.19/rsi-fix-a-double-free-bug-in-rsi_91x_deinit.patch
@@ -0,0 +1,46 @@
+From 8b51dc7291473093c821195c4b6af85fadedbc2f Mon Sep 17 00:00:00 2001
+From: Hui Peng <benquike@gmail.com>
+Date: Mon, 19 Aug 2019 18:02:29 -0400
+Subject: rsi: fix a double free bug in rsi_91x_deinit()
+
+From: Hui Peng <benquike@gmail.com>
+
+commit 8b51dc7291473093c821195c4b6af85fadedbc2f upstream.
+
+`dev` (struct rsi_91x_usbdev *) field of adapter
+(struct rsi_91x_usbdev *) is allocated  and initialized in
+`rsi_init_usb_interface`. If any error is detected in information
+read from the device side,  `rsi_init_usb_interface` will be
+freed. However, in the higher level error handling code in
+`rsi_probe`, if error is detected, `rsi_91x_deinit` is called
+again, in which `dev` will be freed again, resulting double free.
+
+This patch fixes the double free by removing the free operation on
+`dev` in `rsi_init_usb_interface`, because `rsi_91x_deinit` is also
+used in `rsi_disconnect`, in that code path, the `dev` field is not
+ (and thus needs to be) freed.
+
+This bug was found in v4.19, but is also present in the latest version
+of kernel. Fixes CVE-2019-15504.
+
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rsi/rsi_91x_usb.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -643,7 +643,6 @@ fail_rx:
+ 	kfree(rsi_dev->tx_buffer);
+ 
+ fail_eps:
+-	kfree(rsi_dev);
+ 
+ 	return status;
+ }
diff --git a/queue-4.19/series b/queue-4.19/series
index c557b8ae703..e46fb968638 100644
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -45,3 +45,4 @@ iio-adc-stm32-dfsdm-fix-data-type.patch
 modules-fix-bug-when-load-module-with-rodata-n.patch
 modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch
 platform-x86-pmc_atom-add-cb4063-beckhoff-automation-board-to-critclk_systems-dmi-table.patch
+rsi-fix-a-double-free-bug-in-rsi_91x_deinit.patch