From: Greg Kroah-Hartman Date: Mon, 29 Nov 2021 12:17:41 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v5.15.6~36 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a2c9261542be71c850bfa3aecfb524c5be57168c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: ksmbd-fix-an-error-handling-path-in-smb2_sess_setup.patch tracing-check-pid-filtering-when-creating-events.patch --- diff --git a/queue-5.15/ksmbd-fix-an-error-handling-path-in-smb2_sess_setup.patch b/queue-5.15/ksmbd-fix-an-error-handling-path-in-smb2_sess_setup.patch new file mode 100644 index 00000000000..b0c2d28bba2 --- /dev/null +++ b/queue-5.15/ksmbd-fix-an-error-handling-path-in-smb2_sess_setup.patch @@ -0,0 +1,41 @@ +From f8fbfd85f5c95fff477a7c19f576725945891d0c Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 7 Nov 2021 16:22:57 +0100 +Subject: ksmbd: Fix an error handling path in 'smb2_sess_setup()' + +From: Christophe JAILLET + +commit f8fbfd85f5c95fff477a7c19f576725945891d0c upstream. + +All the error handling paths of 'smb2_sess_setup()' end to 'out_err'. + +All but the new error handling path added by the commit given in the Fixes +tag below. + +Fix this error handling path and branch to 'out_err' as well. + +Fixes: 0d994cd482ee ("ksmbd: add buffer validation in session setup") +Cc: stable@vger.kernel.org # v5.15 +Acked-by: Namjae Jeon +Signed-off-by: Christophe JAILLET +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/smb2pdu.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -1700,8 +1700,10 @@ int smb2_sess_setup(struct ksmbd_work *w + negblob_off = le16_to_cpu(req->SecurityBufferOffset); + negblob_len = le16_to_cpu(req->SecurityBufferLength); + if (negblob_off < (offsetof(struct smb2_sess_setup_req, Buffer) - 4) || +- negblob_len < offsetof(struct negotiate_message, NegotiateFlags)) +- return -EINVAL; ++ negblob_len < offsetof(struct negotiate_message, NegotiateFlags)) { ++ rc = -EINVAL; ++ goto out_err; ++ } + + negblob = (struct negotiate_message *)((char *)&req->hdr.ProtocolId + + negblob_off); diff --git a/queue-5.15/series b/queue-5.15/series index 4bc0349070a..ba3507bc7f7 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -166,3 +166,5 @@ ceph-properly-handle-statfs-on-multifs-setups.patch iommu-amd-clarify-amd-iommuv2-initialization-messages.patch vdpa_sim-avoid-putting-an-uninitialized-iova_domain.patch vhost-vsock-fix-incorrect-used-length-reported-to-the-guest.patch +ksmbd-fix-an-error-handling-path-in-smb2_sess_setup.patch +tracing-check-pid-filtering-when-creating-events.patch diff --git a/queue-5.15/tracing-check-pid-filtering-when-creating-events.patch b/queue-5.15/tracing-check-pid-filtering-when-creating-events.patch new file mode 100644 index 00000000000..9eb6bc1e09f --- /dev/null +++ b/queue-5.15/tracing-check-pid-filtering-when-creating-events.patch @@ -0,0 +1,51 @@ +From 6cb206508b621a9a0a2c35b60540e399225c8243 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (VMware)" +Date: Fri, 26 Nov 2021 13:35:26 -0500 +Subject: tracing: Check pid filtering when creating events + +From: Steven Rostedt (VMware) + +commit 6cb206508b621a9a0a2c35b60540e399225c8243 upstream. + +When pid filtering is activated in an instance, all of the events trace +files for that instance has the PID_FILTER flag set. This determines +whether or not pid filtering needs to be done on the event, otherwise the +event is executed as normal. + +If pid filtering is enabled when an event is created (via a dynamic event +or modules), its flag is not updated to reflect the current state, and the +events are not filtered properly. + +Cc: stable@vger.kernel.org +Fixes: 3fdaf80f4a836 ("tracing: Implement event pid filtering") +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -2678,12 +2678,22 @@ static struct trace_event_file * + trace_create_new_event(struct trace_event_call *call, + struct trace_array *tr) + { ++ struct trace_pid_list *no_pid_list; ++ struct trace_pid_list *pid_list; + struct trace_event_file *file; + + file = kmem_cache_alloc(file_cachep, GFP_TRACE); + if (!file) + return NULL; + ++ pid_list = rcu_dereference_protected(tr->filtered_pids, ++ lockdep_is_held(&event_mutex)); ++ no_pid_list = rcu_dereference_protected(tr->filtered_no_pids, ++ lockdep_is_held(&event_mutex)); ++ ++ if (pid_list || no_pid_list) ++ file->flags |= EVENT_FILE_FL_PID_FILTER; ++ + file->event_call = call; + file->tr = tr; + atomic_set(&file->sm_ref, 0);