4.4-stable patches

added patches:
	alsa-rawmidi-initialize-allocated-buffers.patch
	usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch

diff --git a/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch b/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch
index 08e087ceb0e76a05b8eda8fb635e4164c49ad7ef..7a42fd3c4de3c6305261ce3bf2533fa5ea7ee592 100644 (file)
--- a/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch
+++ b/queue-4.4/alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch
@@ -72,7 +72,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
                spin_lock_irq(&runtime->lock);
 +              if (runtime->buffer_ref) {
 +                      spin_unlock_irq(&runtime->lock);
-+                      kvfree(newbuf);
++                      kfree(newbuf);
 +                      return -EBUSY;
 +              }
                oldbuf = runtime->buffer;

diff --git a/queue-4.4/alsa-rawmidi-initialize-allocated-buffers.patch b/queue-4.4/alsa-rawmidi-initialize-allocated-buffers.patch
new file mode 100644 (file)
index 0000000..8a29abb
--- /dev/null
+++ b/queue-4.4/alsa-rawmidi-initialize-allocated-buffers.patch
@@ -0,0 +1,43 @@
+From 5a7b44a8df822e0667fc76ed7130252523993bda Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 3 Sep 2018 15:16:43 +0200
+Subject: ALSA: rawmidi: Initialize allocated buffers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5a7b44a8df822e0667fc76ed7130252523993bda upstream.
+
+syzbot reported the uninitialized value exposure in certain situations
+using virmidi loop.  It's likely a very small race at writing and
+reading, and the influence is almost negligible.  But it's safer to
+paper over this just by replacing the existing kvmalloc() with
+kvzalloc().
+
+Reported-by: syzbot+194dffdb8b22fc5d207a@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/rawmidi.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -136,7 +136,7 @@ static int snd_rawmidi_runtime_create(st
+               runtime->avail = 0;
+       else
+               runtime->avail = runtime->buffer_size;
+-      if ((runtime->buffer = kmalloc(runtime->buffer_size, GFP_KERNEL)) == NULL) {
++      if ((runtime->buffer = kzalloc(runtime->buffer_size, GFP_KERNEL)) == NULL) {
+               kfree(runtime);
+               return -ENOMEM;
+       }
+@@ -661,7 +661,7 @@ int snd_rawmidi_output_params(struct snd
+               return -EINVAL;
+       }
+       if (params->buffer_size != runtime->buffer_size) {
+-              newbuf = kmalloc(params->buffer_size, GFP_KERNEL);
++              newbuf = kzalloc(params->buffer_size, GFP_KERNEL);
+               if (!newbuf)
+                       return -ENOMEM;
+               spin_lock_irq(&runtime->lock);

diff --git a/queue-4.4/series b/queue-4.4/series
index 3f737e3c0059c90efec6456685806417a0694c39..e5e59b7493ee830d12d932e349c73459c1606b07 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -71,3 +71,5 @@ net-ipv4-really-enforce-backoff-for-redirects.patch
 netlabel-cope-with-null-catmap.patch
 alsa-hda-realtek-limit-int-mic-boost-for-thinkpad-t530.patch
 alsa-rawmidi-fix-racy-buffer-resize-under-concurrent-accesses.patch
+alsa-rawmidi-initialize-allocated-buffers.patch
+usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch

diff --git a/queue-4.4/usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch b/queue-4.4/usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch
new file mode 100644 (file)
index 0000000..1973265
--- /dev/null
+++ b/queue-4.4/usb-gadget-fix-illegal-array-access-in-binding-with-udc.patch
@@ -0,0 +1,75 @@
+From 15753588bcd4bbffae1cca33c8ced5722477fe1f Mon Sep 17 00:00:00 2001
+From: Kyungtae Kim <kt0755@gmail.com>
+Date: Sun, 10 May 2020 05:43:34 +0000
+Subject: USB: gadget: fix illegal array access in binding with UDC
+
+From: Kyungtae Kim <kt0755@gmail.com>
+
+commit 15753588bcd4bbffae1cca33c8ced5722477fe1f upstream.
+
+FuzzUSB (a variant of syzkaller) found an illegal array access
+using an incorrect index while binding a gadget with UDC.
+
+Reference: https://www.spinics.net/lists/linux-usb/msg194331.html
+
+This bug occurs when a size variable used for a buffer
+is misused to access its strcpy-ed buffer.
+Given a buffer along with its size variable (taken from user input),
+from which, a new buffer is created using kstrdup().
+Due to the original buffer containing 0 value in the middle,
+the size of the kstrdup-ed buffer becomes smaller than that of the original.
+So accessing the kstrdup-ed buffer with the same size variable
+triggers memory access violation.
+
+The fix makes sure no zero value in the buffer,
+by comparing the strlen() of the orignal buffer with the size variable,
+so that the access to the kstrdup-ed buffer is safe.
+
+BUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200
+drivers/usb/gadget/configfs.c:266
+Read of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208
+
+CPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xce/0x128 lib/dump_stack.c:118
+ print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374
+ __kasan_report+0x131/0x1b0 mm/kasan/report.c:506
+ kasan_report+0x12/0x20 mm/kasan/common.c:641
+ __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132
+ gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266
+ flush_write_buffer fs/configfs/file.c:251 [inline]
+ configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283
+ __vfs_write+0x85/0x110 fs/read_write.c:494
+ vfs_write+0x1cd/0x510 fs/read_write.c:558
+ ksys_write+0x18a/0x220 fs/read_write.c:611
+ __do_sys_write fs/read_write.c:623 [inline]
+ __se_sys_write fs/read_write.c:620 [inline]
+ __x64_sys_write+0x73/0xb0 fs/read_write.c:620
+ do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Signed-off-by: Kyungtae Kim <kt0755@gmail.com>
+Reported-and-tested-by: Kyungtae Kim <kt0755@gmail.com>
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200510054326.GA19198@pizza01
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/configfs.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -260,6 +260,9 @@ static ssize_t gadget_dev_desc_UDC_store
+       char *name;
+       int ret;
+ 
++      if (strlen(page) < len)
++              return -EOVERFLOW;
++
+       name = kstrdup(page, GFP_KERNEL);
+       if (!name)
+               return -ENOMEM;