4.9-stable patches

added patches:
	s390-fix-strrchr-implementation.patch

diff --git a/queue-4.9/s390-fix-strrchr-implementation.patch b/queue-4.9/s390-fix-strrchr-implementation.patch
new file mode 100644 (file)
index 0000000..2cc2f36
--- /dev/null
+++ b/queue-4.9/s390-fix-strrchr-implementation.patch
@@ -0,0 +1,49 @@
+From 8e0ab8e26b72a80e991c66a8abc16e6c856abe3d Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Tue, 5 Oct 2021 14:08:36 +0200
+Subject: s390: fix strrchr() implementation
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+commit 8e0ab8e26b72a80e991c66a8abc16e6c856abe3d upstream.
+
+Fix two problems found in the strrchr() implementation for s390
+architectures: evaluate empty strings (return the string address instead of
+NULL, if '\0' is passed as second argument); evaluate the first character
+of non-empty strings (the current implementation stops at the second).
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Reported-by: Heiko Carstens <hca@linux.ibm.com> (incorrect behavior with empty strings)
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Link: https://lore.kernel.org/r/20211005120836.60630-1-roberto.sassu@huawei.com
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/lib/string.c |   13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/arch/s390/lib/string.c
++++ b/arch/s390/lib/string.c
+@@ -225,14 +225,13 @@ EXPORT_SYMBOL(strcmp);
+  */
+ char * strrchr(const char * s, int c)
+ {
+-       size_t len = __strend(s) - s;
++      ssize_t len = __strend(s) - s;
+ 
+-       if (len)
+-             do {
+-                     if (s[len] == (char) c)
+-                             return (char *) s + len;
+-             } while (--len > 0);
+-       return NULL;
++      do {
++              if (s[len] == (char)c)
++                      return (char *)s + len;
++      } while (--len >= 0);
++      return NULL;
+ }
+ EXPORT_SYMBOL(strrchr);
+ 

diff --git a/queue-4.9/series b/queue-4.9/series
index 8e5147a4f01d004660ffc2c3e265c354e3b03701..9fa5ebe36dc21affb4d9c6833b3be677aa809131 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -1 +1,2 @@
 alsa-seq-fix-a-potential-uaf-by-wrong-private_free-call-order.patch
+s390-fix-strrchr-implementation.patch