From: Greg Kroah-Hartman Date: Fri, 2 Sep 2022 07:47:58 +0000 (+0200) Subject: 5.19-stable patches X-Git-Tag: v4.9.327~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c24cfeb693237784045d47b6160b5e4d8b651f8c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.19-stable patches added patches: android-binder-fix-lockdep-check-on-clearing-vma.patch net-af_packet-check-len-when-min_header_len-equals-to-0.patch --- diff --git a/queue-5.19/android-binder-fix-lockdep-check-on-clearing-vma.patch b/queue-5.19/android-binder-fix-lockdep-check-on-clearing-vma.patch new file mode 100644 index 00000000000..94c66ed6ba5 --- /dev/null +++ b/queue-5.19/android-binder-fix-lockdep-check-on-clearing-vma.patch @@ -0,0 +1,60 @@ +From b0cab80ecd54ae3b2356bb081af0bffd538c8265 Mon Sep 17 00:00:00 2001 +From: Liam Howlett +Date: Mon, 27 Jun 2022 15:18:59 +0000 +Subject: android: binder: fix lockdep check on clearing vma +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Liam Howlett + +commit b0cab80ecd54ae3b2356bb081af0bffd538c8265 upstream. + +When munmapping a vma, the mmap_lock can be degraded to a write before +calling close() on the file handle. The binder close() function calls +binder_alloc_set_vma() to clear the vma address, which now has a lock dep +check for writing on the mmap_lock. Change the lockdep check to ensure +the reading lock is held while clearing and keep the write check while +writing. + +Link: https://lkml.kernel.org/r/20220627151857.2316964-1-Liam.Howlett@oracle.com +Fixes: 472a68df605b ("android: binder: stop saving a pointer to the VMA") +Signed-off-by: Liam R. Howlett +Reported-by: syzbot+da54fa8d793ca89c741f@syzkaller.appspotmail.com +Acked-by: Todd Kjos +Cc: "Arve Hjønnevåg" +Cc: Christian Brauner (Microsoft) +Cc: Greg Kroah-Hartman +Cc: Hridya Valsaraju +Cc: Joel Fernandes +Cc: Martijn Coenen +Cc: Suren Baghdasaryan +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder_alloc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -315,12 +315,19 @@ static inline void binder_alloc_set_vma( + { + unsigned long vm_start = 0; + ++ /* ++ * Allow clearing the vma with holding just the read lock to allow ++ * munmapping downgrade of the write lock before freeing and closing the ++ * file using binder_alloc_vma_close(). ++ */ + if (vma) { + vm_start = vma->vm_start; + alloc->vma_vm_mm = vma->vm_mm; ++ mmap_assert_write_locked(alloc->vma_vm_mm); ++ } else { ++ mmap_assert_locked(alloc->vma_vm_mm); + } + +- mmap_assert_write_locked(alloc->vma_vm_mm); + alloc->vma_addr = vm_start; + } + diff --git a/queue-5.19/btrfs-tree-checker-check-for-overlapping-extent-item.patch b/queue-5.19/btrfs-tree-checker-check-for-overlapping-extent-item.patch index 84cff7f9a20..4a6c7dd025e 100644 --- a/queue-5.19/btrfs-tree-checker-check-for-overlapping-extent-item.patch +++ b/queue-5.19/btrfs-tree-checker-check-for-overlapping-extent-item.patch @@ -19,14 +19,12 @@ Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin --- - fs/btrfs/tree-checker.c | 25 +++++++++++++++++++++++-- + fs/btrfs/tree-checker.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) -diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c -index 9e0e0ae2288cd..43f905ab0a18d 100644 --- a/fs/btrfs/tree-checker.c +++ b/fs/btrfs/tree-checker.c -@@ -1233,7 +1233,8 @@ static void extent_err(const struct extent_buffer *eb, int slot, +@@ -1233,7 +1233,8 @@ static void extent_err(const struct exte } static int check_extent_item(struct extent_buffer *leaf, @@ -36,7 +34,7 @@ index 9e0e0ae2288cd..43f905ab0a18d 100644 { struct btrfs_fs_info *fs_info = leaf->fs_info; struct btrfs_extent_item *ei; -@@ -1453,6 +1454,26 @@ static int check_extent_item(struct extent_buffer *leaf, +@@ -1453,6 +1454,26 @@ static int check_extent_item(struct exte total_refs, inline_refs); return -EUCLEAN; } @@ -63,7 +61,7 @@ index 9e0e0ae2288cd..43f905ab0a18d 100644 return 0; } -@@ -1621,7 +1642,7 @@ static int check_leaf_item(struct extent_buffer *leaf, +@@ -1621,7 +1642,7 @@ static int check_leaf_item(struct extent break; case BTRFS_EXTENT_ITEM_KEY: case BTRFS_METADATA_ITEM_KEY: @@ -72,6 +70,3 @@ index 9e0e0ae2288cd..43f905ab0a18d 100644 break; case BTRFS_TREE_BLOCK_REF_KEY: case BTRFS_SHARED_DATA_REF_KEY: --- -2.35.1 - diff --git a/queue-5.19/net-af_packet-check-len-when-min_header_len-equals-to-0.patch b/queue-5.19/net-af_packet-check-len-when-min_header_len-equals-to-0.patch new file mode 100644 index 00000000000..1d1b8cbc553 --- /dev/null +++ b/queue-5.19/net-af_packet-check-len-when-min_header_len-equals-to-0.patch @@ -0,0 +1,35 @@ +From dc633700f00f726e027846a318c5ffeb8deaaeda Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Wed, 27 Jul 2022 17:33:12 +0800 +Subject: net/af_packet: check len when min_header_len equals to 0 + +From: Zhengchao Shao + +commit dc633700f00f726e027846a318c5ffeb8deaaeda upstream. + +User can use AF_PACKET socket to send packets with the length of 0. +When min_header_len equals to 0, packet_snd will call __dev_queue_xmit +to send packets, and sock->type can be any type. + +Reported-by: syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com +Fixes: fd1894224407 ("bpf: Don't redirect packets with invalid pkt_len") +Signed-off-by: Zhengchao Shao +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3037,8 +3037,8 @@ static int packet_snd(struct socket *soc + if (err) + goto out_free; + +- if (sock->type == SOCK_RAW && +- !dev_validate_header(dev, skb->data, len)) { ++ if ((sock->type == SOCK_RAW && ++ !dev_validate_header(dev, skb->data, len)) || !skb->len) { + err = -EINVAL; + goto out_free; + } diff --git a/queue-5.19/series b/queue-5.19/series index 4ba36b6a614..cc0af7ad4ce 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -66,3 +66,5 @@ alsa-hda-cs8409-support-new-dolphin-variants.patch btrfs-move-lockdep-class-helpers-to-locking.c.patch btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch btrfs-tree-checker-check-for-overlapping-extent-item.patch +android-binder-fix-lockdep-check-on-clearing-vma.patch +net-af_packet-check-len-when-min_header_len-equals-to-0.patch