From: Greg Kroah-Hartman Date: Sun, 30 May 2021 12:31:15 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.4.271~80 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d54f8fd2dc143f9dc4d5cbea076273f42c14b3f2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: net-usb-fix-memory-leak-in-smsc75xx_bind.patch spi-fix-use-after-free-with-devm_spi_alloc_.patch spi-spi-sh-fix-use-after-free-on-unbind.patch --- diff --git a/queue-4.4/net-usb-fix-memory-leak-in-smsc75xx_bind.patch b/queue-4.4/net-usb-fix-memory-leak-in-smsc75xx_bind.patch new file mode 100644 index 00000000000..70a972cf590 --- /dev/null +++ b/queue-4.4/net-usb-fix-memory-leak-in-smsc75xx_bind.patch @@ -0,0 +1,60 @@ +From 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Mon, 24 May 2021 23:02:08 +0300 +Subject: net: usb: fix memory leak in smsc75xx_bind + +From: Pavel Skripkin + +commit 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 upstream. + +Syzbot reported memory leak in smsc75xx_bind(). +The problem was is non-freed memory in case of +errors after memory allocation. + +backtrace: + [] kmalloc include/linux/slab.h:556 [inline] + [] kzalloc include/linux/slab.h:686 [inline] + [] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460 + [] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728 + +Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") +Cc: stable@kernel.vger.org +Reported-and-tested-by: syzbot+b558506ba8165425fee2@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/smsc75xx.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -1485,7 +1485,7 @@ static int smsc75xx_bind(struct usbnet * + ret = smsc75xx_wait_ready(dev, 0); + if (ret < 0) { + netdev_warn(dev->net, "device not ready in smsc75xx_bind\n"); +- return ret; ++ goto err; + } + + smsc75xx_init_mac_address(dev); +@@ -1494,7 +1494,7 @@ static int smsc75xx_bind(struct usbnet * + ret = smsc75xx_reset(dev); + if (ret < 0) { + netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret); +- return ret; ++ goto err; + } + + dev->net->netdev_ops = &smsc75xx_netdev_ops; +@@ -1503,6 +1503,10 @@ static int smsc75xx_bind(struct usbnet * + dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD; + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; + return 0; ++ ++err: ++ kfree(pdata); ++ return ret; + } + + static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) diff --git a/queue-4.4/series b/queue-4.4/series index 6a757e054f3..e6f67781294 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -16,3 +16,6 @@ serial-rp2-use-request_firmware-instead-of-request_firmware_nowait.patch usb-serial-option-add-telit-le910-s1-compositions-0x7010-0x7011.patch usb-serial-ftdi_sio-add-ids-for-ids-gmbh-products.patch usb-serial-pl2303-add-device-id-for-adlink-nd-6530-gc.patch +net-usb-fix-memory-leak-in-smsc75xx_bind.patch +spi-fix-use-after-free-with-devm_spi_alloc_.patch +spi-spi-sh-fix-use-after-free-on-unbind.patch diff --git a/queue-4.4/spi-fix-use-after-free-with-devm_spi_alloc_.patch b/queue-4.4/spi-fix-use-after-free-with-devm_spi_alloc_.patch new file mode 100644 index 00000000000..9a39f541795 --- /dev/null +++ b/queue-4.4/spi-fix-use-after-free-with-devm_spi_alloc_.patch @@ -0,0 +1,91 @@ +From 794aaf01444d4e765e2b067cba01cc69c1c68ed9 Mon Sep 17 00:00:00 2001 +From: "William A. Kennington III" +Date: Wed, 7 Apr 2021 02:55:27 -0700 +Subject: spi: Fix use-after-free with devm_spi_alloc_* + +From: William A. Kennington III + +commit 794aaf01444d4e765e2b067cba01cc69c1c68ed9 upstream. + +We can't rely on the contents of the devres list during +spi_unregister_controller(), as the list is already torn down at the +time we perform devres_find() for devm_spi_release_controller. This +causes devices registered with devm_spi_alloc_{master,slave}() to be +mistakenly identified as legacy, non-devm managed devices and have their +reference counters decremented below 0. + +------------[ cut here ]------------ +WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174 +[] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98) +[] (kobject_put) from [] (put_device+0x20/0x24) + r4:b6700140 +[] (put_device) from [] (devm_spi_release_controller+0x3c/0x40) +[] (devm_spi_release_controller) from [] (release_nodes+0x84/0xc4) + r5:b6700180 r4:b6700100 +[] (release_nodes) from [] (devres_release_all+0x5c/0x60) + r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10 +[] (devres_release_all) from [] (__device_release_driver+0x144/0x1ec) + r5:b117ad94 r4:b163dc10 +[] (__device_release_driver) from [] (device_driver_detach+0x84/0xa0) + r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10 +[] (device_driver_detach) from [] (unbind_store+0xe4/0xf8) + +Instead, determine the devm allocation state as a flag on the +controller which is guaranteed to be stable during cleanup. + +Fixes: 5e844cc37a5c ("spi: Introduce device-managed SPI controller allocation") +Signed-off-by: William A. Kennington III +Link: https://lore.kernel.org/r/20210407095527.2771582-1-wak@google.com +Signed-off-by: Mark Brown +[lukas: backport to v4.4.270] +Signed-off-by: Lukas Wunner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi.c | 9 ++------- + include/linux/spi/spi.h | 3 +++ + 2 files changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1762,6 +1762,7 @@ struct spi_master *devm_spi_alloc_master + + master = spi_alloc_master(dev, size); + if (master) { ++ master->devm_allocated = true; + *ptr = master; + devres_add(dev, ptr); + } else { +@@ -1951,11 +1952,6 @@ int devm_spi_register_master(struct devi + } + EXPORT_SYMBOL_GPL(devm_spi_register_master); + +-static int devm_spi_match_master(struct device *dev, void *res, void *master) +-{ +- return *(struct spi_master **)res == master; +-} +- + static int __unregister(struct device *dev, void *null) + { + spi_unregister_device(to_spi_device(dev)); +@@ -1994,8 +1990,7 @@ void spi_unregister_master(struct spi_ma + /* Release the last reference on the master if its driver + * has not yet been converted to devm_spi_alloc_master(). + */ +- if (!devres_find(master->dev.parent, devm_spi_release_master, +- devm_spi_match_master, master)) ++ if (!master->devm_allocated) + put_device(&master->dev); + + if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) +--- a/include/linux/spi/spi.h ++++ b/include/linux/spi/spi.h +@@ -425,6 +425,9 @@ struct spi_master { + #define SPI_MASTER_MUST_RX BIT(3) /* requires rx */ + #define SPI_MASTER_MUST_TX BIT(4) /* requires tx */ + ++ /* flag indicating this is a non-devres managed controller */ ++ bool devm_allocated; ++ + /* lock and mutex for SPI bus locking */ + spinlock_t bus_lock_spinlock; + struct mutex bus_lock_mutex; diff --git a/queue-4.4/spi-spi-sh-fix-use-after-free-on-unbind.patch b/queue-4.4/spi-spi-sh-fix-use-after-free-on-unbind.patch new file mode 100644 index 00000000000..98d6a61b57f --- /dev/null +++ b/queue-4.4/spi-spi-sh-fix-use-after-free-on-unbind.patch @@ -0,0 +1,80 @@ +From e77df3eca12be4b17f13cf9f215cff248c57d98f Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Mon, 7 Dec 2020 09:17:04 +0100 +Subject: spi: spi-sh: Fix use-after-free on unbind + +From: Lukas Wunner + +commit e77df3eca12be4b17f13cf9f215cff248c57d98f upstream. + +spi_sh_remove() accesses the driver's private data after calling +spi_unregister_master() even though that function releases the last +reference on the spi_master and thereby frees the private data. + +Fix by switching over to the new devm_spi_alloc_master() helper which +keeps the private data accessible until the driver has unbound. + +Fixes: 680c1305e259 ("spi/spi_sh: use spi_unregister_master instead of spi_master_put in remove path") +Signed-off-by: Lukas Wunner +Cc: # v3.0+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation +Cc: # v3.0+ +Cc: Axel Lin +Link: https://lore.kernel.org/r/6d97628b536baf01d5e3e39db61108f84d44c8b2.1607286887.git.lukas@wunner.de +Signed-off-by: Mark Brown +[lukas: backport to v4.4.270] +Signed-off-by: Lukas Wunner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-sh.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +--- a/drivers/spi/spi-sh.c ++++ b/drivers/spi/spi-sh.c +@@ -451,7 +451,7 @@ static int spi_sh_probe(struct platform_ + return -ENODEV; + } + +- master = spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data)); ++ master = devm_spi_alloc_master(&pdev->dev, sizeof(struct spi_sh_data)); + if (master == NULL) { + dev_err(&pdev->dev, "spi_alloc_master error.\n"); + return -ENOMEM; +@@ -469,16 +469,14 @@ static int spi_sh_probe(struct platform_ + break; + default: + dev_err(&pdev->dev, "No support width\n"); +- ret = -ENODEV; +- goto error1; ++ return -ENODEV; + } + ss->irq = irq; + ss->master = master; + ss->addr = devm_ioremap(&pdev->dev, res->start, resource_size(res)); + if (ss->addr == NULL) { + dev_err(&pdev->dev, "ioremap error.\n"); +- ret = -ENOMEM; +- goto error1; ++ return -ENOMEM; + } + INIT_LIST_HEAD(&ss->queue); + spin_lock_init(&ss->lock); +@@ -488,8 +486,7 @@ static int spi_sh_probe(struct platform_ + dev_name(master->dev.parent)); + if (ss->workqueue == NULL) { + dev_err(&pdev->dev, "create workqueue error\n"); +- ret = -EBUSY; +- goto error1; ++ return -EBUSY; + } + + ret = request_irq(irq, spi_sh_irq, 0, "spi_sh", ss); +@@ -516,9 +513,6 @@ static int spi_sh_probe(struct platform_ + free_irq(irq, ss); + error2: + destroy_workqueue(ss->workqueue); +- error1: +- spi_master_put(master); +- + return ret; + } +