From: Greg Kroah-Hartman Date: Mon, 18 May 2020 13:25:36 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.4.224~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b981d1f941945c1d392344491852f428e2a194ca;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-rawmidi-initialize-allocated-buffers.patch usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch --- diff --git a/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch b/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch index 08e087ceb0e..7a42fd3c4de 100644 --- a/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch +++ b/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch @@ -72,7 +72,7 @@ Signed-off-by: Greg Kroah-Hartman spin_lock_irq(&runtime->lock); + if (runtime->buffer_ref) { + spin_unlock_irq(&runtime->lock); -+ kvfree(newbuf); ++ kfree(newbuf); + return -EBUSY; + } oldbuf = runtime->buffer; diff --git a/queue-4.4/alsa-rawmidi-initialize-allocated-buffers.patch b/queue-4.4/alsa-rawmidi-initialize-allocated-buffers.patch new file mode 100644 index 00000000000..8a29abb1017 --- /dev/null +++ b/queue-4.4/alsa-rawmidi-initialize-allocated-buffers.patch @@ -0,0 +1,43 @@ +From 5a7b44a8df822e0667fc76ed7130252523993bda Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 3 Sep 2018 15:16:43 +0200 +Subject: ALSA: rawmidi: Initialize allocated buffers + +From: Takashi Iwai + +commit 5a7b44a8df822e0667fc76ed7130252523993bda upstream. + +syzbot reported the uninitialized value exposure in certain situations +using virmidi loop. It's likely a very small race at writing and +reading, and the influence is almost negligible. But it's safer to +paper over this just by replacing the existing kvmalloc() with +kvzalloc(). + +Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/rawmidi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -136,7 +136,7 @@ static int snd_rawmidi_runtime_create(st + runtime->avail = 0; + else + runtime->avail = runtime->buffer_size; +- if ((runtime->buffer = kmalloc(runtime->buffer_size, GFP_KERNEL)) == NULL) { ++ if ((runtime->buffer = kzalloc(runtime->buffer_size, GFP_KERNEL)) == NULL) { + kfree(runtime); + return -ENOMEM; + } +@@ -661,7 +661,7 @@ int snd_rawmidi_output_params(struct snd + return -EINVAL; + } + if (params->buffer_size != runtime->buffer_size) { +- newbuf = kmalloc(params->buffer_size, GFP_KERNEL); ++ newbuf = kzalloc(params->buffer_size, GFP_KERNEL); + if (!newbuf) + return -ENOMEM; + spin_lock_irq(&runtime->lock); diff --git a/queue-4.4/series b/queue-4.4/series index 3f737e3c005..e5e59b7493e 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -71,3 +71,5 @@ net-ipv4-really-enforce-backoff-for-redirects.patch netlabel-cope-with-null-catmap.patch alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch +alsa-rawmidi-initialize-allocated-buffers.patch +usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch diff --git a/queue-4.4/usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch b/queue-4.4/usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch new file mode 100644 index 00000000000..19732650e7a --- /dev/null +++ b/queue-4.4/usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch @@ -0,0 +1,75 @@ +From 15753588bcd4bbffae1cca33c8ced5722477fe1f Mon Sep 17 00:00:00 2001 +From: Kyungtae Kim +Date: Sun, 10 May 2020 05:43:34 +0000 +Subject: USB: gadget: fix illegal array access in binding with UDC + +From: Kyungtae Kim + +commit 15753588bcd4bbffae1cca33c8ced5722477fe1f upstream. + +FuzzUSB (a variant of syzkaller) found an illegal array access +using an incorrect index while binding a gadget with UDC. + +Reference: https://www.spinics.net/lists/linux-usb/msg194331.html + +This bug occurs when a size variable used for a buffer +is misused to access its strcpy-ed buffer. +Given a buffer along with its size variable (taken from user input), +from which, a new buffer is created using kstrdup(). +Due to the original buffer containing 0 value in the middle, +the size of the kstrdup-ed buffer becomes smaller than that of the original. +So accessing the kstrdup-ed buffer with the same size variable +triggers memory access violation. + +The fix makes sure no zero value in the buffer, +by comparing the strlen() of the orignal buffer with the size variable, +so that the access to the kstrdup-ed buffer is safe. + +BUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200 +drivers/usb/gadget/configfs.c:266 +Read of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208 + +CPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xce/0x128 lib/dump_stack.c:118 + print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 + __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 + kasan_report+0x12/0x20 mm/kasan/common.c:641 + __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132 + gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266 + flush_write_buffer fs/configfs/file.c:251 [inline] + configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283 + __vfs_write+0x85/0x110 fs/read_write.c:494 + vfs_write+0x1cd/0x510 fs/read_write.c:558 + ksys_write+0x18a/0x220 fs/read_write.c:611 + __do_sys_write fs/read_write.c:623 [inline] + __se_sys_write fs/read_write.c:620 [inline] + __x64_sys_write+0x73/0xb0 fs/read_write.c:620 + do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Signed-off-by: Kyungtae Kim +Reported-and-tested-by: Kyungtae Kim +Cc: Felipe Balbi +Cc: stable +Link: https://lore.kernel.org/r/20200510054326.GA19198@pizza01 +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/configfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -260,6 +260,9 @@ static ssize_t gadget_dev_desc_UDC_store + char *name; + int ret; + ++ if (strlen(page) < len) ++ return -EOVERFLOW; ++ + name = kstrdup(page, GFP_KERNEL); + if (!name) + return -ENOMEM;