Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1648678 > unrolled thread

[PATCH 3.18 00/59] 3.18.55-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.18 00/59] 3.18.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 31/59] USB: serial: io_ti: fix div-by-zero in set_termios Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 18/59] USB: serial: ftdi_sio: fix setting latency for unprivileged users Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 52/59] stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 44/59] ARM: dts: at91: sama5d3_xplained: fix ADC vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 58/59] drivers: char: mem: Check for address space wraparound with mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 27/59] USB: iowarrior: fix info ioctl on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 48/59] xc2028: Fix use-after-free bug properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 55/59] tracing/kprobes: Enforce kprobes teardown after testing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 20/59] usb: host: xhci-plat: propagate return value of platform_get_irq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 05/59] dm btree: fix for dm_btree_find_lowest_key() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 40/59] [media] zr364xx: enforce minimum size when reading header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 24/59] [media] mceusb: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 42/59] [media] cx231xx-audio: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 09/59] mwifiex: pcie: fix cmd_buf use-after-free in remove/reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 16/59] iio: dac: ad7303: fix channel description Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 11/59] regulator: tps65023: Fix inverted core enable logic. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
      Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using  stale tty fields Alan Cox <gnomes@lxorguk.ukuu.org.uk> - 2017-05-24 15:50 +0200
        Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using  stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 17:10 +0200
    [PATCH 3.18 46/59] arm64: uaccess: ensure extension of access_ok() addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 30/59] USB: serial: mct_u232: fix big-endian baud-rate handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 32/59] USB: hub: fix SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 41/59] [media] cx231xx-cards: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 47/59] arm64: documentation: document tagged pointer stack constraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 13/59] cdc-acm: fix possible invalid access when processing notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 50/59] metag/uaccess: Fix access_ok() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 54/59] osf_wait4(): fix infoleak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 49/59] mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 51/59] metag/uaccess: Check access_ok in strncpy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 33/59] USB: hub: fix non-SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 45/59] ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 28/59] usb: serial: option: add Telit ME910 support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 15/59] of: fdt: add missing allocation-failure check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 26/59] usb: musb: tusb6010_omap: Do not reset the other directions packet size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 23/59] [media] usbvision: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 53/59] uwb: fix device quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 56/59] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 36/59] iio: proximity: as3935: fix as3935_write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 3.18 17/59] pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 06/59] dm bufio: avoid a possible ABBA deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 19/59] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 12/59] ath9k_htc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 22/59] net: irda: irda-usb: fix firmware name on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 25/59] [media] ttusb2: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 14/59] of: fix sparse warning in of_pci_range_parser_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 04/59] USB: core: replace %p with %pK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 08/59] dm space map disk: fix some book keeping in the disk space map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 07/59] dm thin metadata: call precommit before saving the roots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 39/59] [media] dib0700: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 38/59] [media] s5p-mfc: Fix unbalanced call to clock management Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 43/59] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 37/59] [media] gspca: konica: add missing endpoint sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 03/59] char: lp: fix possible integer overflow in lp_setup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 02/59] watchdog: pcwd_usb: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    [PATCH 3.18 01/59] USB: ene_usb6250: fix DMA to the stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
    Re: [PATCH 3.18 00/59] 3.18.55-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 17:50 +0200

Page 1 of 3  [1] 2 3  Next page →

#1648678 — [PATCH 3.18 00/59] 3.18.55-stable review

This is the start of the stable review cycle for the 3.18.55 release.
There are 59 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu May 25 20:08:28 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.55-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 3.18.55-rc1

Maksim Salau <maksim.salau@gmail.com>
    usb: misc: legousbtower: Fix memory leak

Julius Werner <jwerner@chromium.org>
    drivers: char: mem: Check for address space wraparound with mmap()

Lukas Wunner <lukas@wunner.de>
    PCI: Freeze PME scan before suspending devices

David Woodhouse <dwmw@amazon.co.uk>
    PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms

Thomas Gleixner <tglx@linutronix.de>
    tracing/kprobes: Enforce kprobes teardown after testing

Al Viro <viro@zeniv.linux.org.uk>
    osf_wait4(): fix infoleak

Johan Hovold <johan@kernel.org>
    uwb: fix device quirk on big-endian hosts

Daniel Micay <danielmicay@gmail.com>
    stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms

James Hogan <james.hogan@imgtec.com>
    metag/uaccess: Check access_ok in strncpy_from_user

James Hogan <james.hogan@imgtec.com>
    metag/uaccess: Fix access_ok()

Keno Fischer <keno@juliacomputing.com>
    mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp

Takashi Iwai <tiwai@suse.de>
    xc2028: Fix use-after-free bug properly

Kristina Martsenko <kristina.martsenko@arm.com>
    arm64: documentation: document tagged pointer stack constraints

Mark Rutland <mark.rutland@arm.com>
    arm64: uaccess: ensure extension of access_ok() addr

Ludovic Desroches <ludovic.desroches@microchip.com>
    ARM: dts: at91: sama5d3_xplained: not all ADC channels are available

Ludovic Desroches <ludovic.desroches@microchip.com>
    ARM: dts: at91: sama5d3_xplained: fix ADC vref

Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
    powerpc/pseries: Fix of_node_put() underflow during DLPAR remove

Johan Hovold <johan@kernel.org>
    cx231xx-audio: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    cx231xx-cards: fix NULL-deref at probe

Alyssa Milburn <amilburn@zall.org>
    zr364xx: enforce minimum size when reading header

Johan Hovold <johan@kernel.org>
    dib0700: fix NULL-deref at probe

Marek Szyprowski <m.szyprowski@samsung.com>
    s5p-mfc: Fix unbalanced call to clock management

Johan Hovold <johan@kernel.org>
    gspca: konica: add missing endpoint sanity check

Matt Ranostay <matt.ranostay@konsulko.com>
    iio: proximity: as3935: fix as3935_write

Dan Carpenter <dan.carpenter@oracle.com>
    ipx: call ipxitf_put() in ioctl error path

Peter Hurley <peter@hurleysoftware.com>
    tty: Prevent ldisc drivers from re-using stale tty fields

Johan Hovold <johan@kernel.org>
    USB: hub: fix non-SS hub-descriptor handling

Johan Hovold <johan@kernel.org>
    USB: hub: fix SS hub-descriptor handling

Johan Hovold <johan@kernel.org>
    USB: serial: io_ti: fix div-by-zero in set_termios

Johan Hovold <johan@kernel.org>
    USB: serial: mct_u232: fix big-endian baud-rate handling

Bjørn Mork <bjorn@mork.no>
    USB: serial: qcserial: add more Lenovo EM74xx device IDs

Daniele Palmas <dnlplm@gmail.com>
    usb: serial: option: add Telit ME910 support

Johan Hovold <johan@kernel.org>
    USB: iowarrior: fix info ioctl on big-endian hosts

Peter Ujfalusi <peter.ujfalusi@ti.com>
    usb: musb: tusb6010_omap: Do not reset the other direction's packet size

Alyssa Milburn <amilburn@zall.org>
    ttusb2: limit messages to buffer size

Johan Hovold <johan@kernel.org>
    mceusb: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    usbvision: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    net: irda: irda-usb: fix firmware name on big-endian hosts

Peter Chen <peter.chen@nxp.com>
    usb: host: xhci-mem: allocate zeroed Scratchpad Buffer

Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
    usb: host: xhci-plat: propagate return value of platform_get_irq()

Andrey Korolyov <andrey@xdel.ru>
    USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs

Anthony Mallet <anthony.mallet@laas.fr>
    USB: serial: ftdi_sio: fix setting latency for unprivileged users

Eric W. Biederman <ebiederm@xmission.com>
    pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes

Pavel Roskin <plroskin@gmail.com>
    iio: dac: ad7303: fix channel description

Johan Hovold <johan@kernel.org>
    of: fdt: add missing allocation-failure check

Rob Herring <robh@kernel.org>
    of: fix sparse warning in of_pci_range_parser_one

Tobias Herzog <t-herzog@gmx.de>
    cdc-acm: fix possible invalid access when processing notification

Johan Hovold <johan@kernel.org>
    ath9k_htc: fix NULL-deref at probe

Richard Cochran <rcochran@linutronix.de>
    regulator: tps65023: Fix inverted core enable logic.

Daniel Glöckner <dg@emlix.com>
    ima: accept previously set IMA_NEW_FILE

Brian Norris <briannorris@chromium.org>
    mwifiex: pcie: fix cmd_buf use-after-free in remove/reset

Joe Thornber <ejt@redhat.com>
    dm space map disk: fix some book keeping in the disk space map

Joe Thornber <ejt@redhat.com>
    dm thin metadata: call precommit before saving the roots

Mikulas Patocka <mpatocka@redhat.com>
    dm bufio: avoid a possible ABBA deadlock

Vinothkumar Raja <vinraja@cs.stonybrook.edu>
    dm btree: fix for dm_btree_find_lowest_key()

Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
    USB: core: replace %p with %pK

Willy Tarreau <w@1wt.eu>
    char: lp: fix possible integer overflow in lp_setup()

Johan Hovold <johan@kernel.org>
    watchdog: pcwd_usb: fix NULL-deref at probe

Alan Stern <stern@rowland.harvard.edu>
    USB: ene_usb6250: fix DMA to the stack


-------------

Diffstat:

 Documentation/arm64/tagged-pointers.txt        | 62 +++++++++++++-----
 Makefile                                       |  4 +-
 arch/alpha/kernel/osf_sys.c                    |  6 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts    |  5 +-
 arch/arm64/include/asm/uaccess.h               |  3 +-
 arch/metag/include/asm/uaccess.h               | 49 ++++++++------
 arch/powerpc/platforms/pseries/dlpar.c         |  1 -
 drivers/char/lp.c                              |  6 +-
 drivers/char/mem.c                             |  5 ++
 drivers/iio/dac/ad7303.c                       |  6 +-
 drivers/iio/proximity/as3935.c                 |  3 +-
 drivers/md/dm-bufio.c                          |  9 +--
 drivers/md/dm-thin-metadata.c                  |  4 +-
 drivers/md/persistent-data/dm-btree.c          |  8 ++-
 drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++-
 drivers/media/platform/s5p-mfc/s5p_mfc.c       |  1 +
 drivers/media/rc/mceusb.c                      |  4 +-
 drivers/media/tuners/tuner-xc2028.c            | 37 +++++------
 drivers/media/usb/cx231xx/cx231xx-audio.c      | 15 ++++-
 drivers/media/usb/cx231xx/cx231xx-cards.c      | 45 +++++++++++--
 drivers/media/usb/dvb-usb/dib0700_core.c       |  3 +
 drivers/media/usb/dvb-usb/ttusb2.c             | 19 ++++++
 drivers/media/usb/gspca/konica.c               |  3 +
 drivers/media/usb/usbvision/usbvision-video.c  |  9 ++-
 drivers/media/usb/zr364xx/zr364xx.c            |  8 +++
 drivers/net/irda/irda-usb.c                    |  2 +-
 drivers/net/wireless/ath/ath9k/hif_usb.c       |  3 +
 drivers/net/wireless/mwifiex/pcie.c            |  7 ++
 drivers/of/address.c                           |  2 +-
 drivers/of/fdt.c                               |  3 +
 drivers/pci/pci-sysfs.c                        | 10 ++-
 drivers/pci/pci.c                              |  9 +--
 drivers/regulator/tps65023-regulator.c         |  3 +-
 drivers/tty/tty_ldisc.c                        |  7 ++
 drivers/usb/class/cdc-acm.c                    | 13 ++--
 drivers/usb/core/devio.c                       |  4 +-
 drivers/usb/core/hcd.c                         |  4 +-
 drivers/usb/core/hub.c                         | 19 ++++--
 drivers/usb/core/urb.c                         |  2 +-
 drivers/usb/host/xhci-mem.c                    |  2 +-
 drivers/usb/host/xhci-plat.c                   |  2 +-
 drivers/usb/misc/iowarrior.c                   |  2 +-
 drivers/usb/misc/legousbtower.c                |  1 +
 drivers/usb/musb/tusb6010_omap.c               | 13 ++--
 drivers/usb/serial/ftdi_sio.c                  | 10 +--
 drivers/usb/serial/ftdi_sio_ids.h              |  2 +
 drivers/usb/serial/io_ti.c                     |  5 +-
 drivers/usb/serial/mct_u232.c                  |  2 +-
 drivers/usb/serial/option.c                    |  8 +++
 drivers/usb/serial/qcserial.c                  |  2 +
 drivers/usb/storage/ene_ub6250.c               | 90 ++++++++++++++++----------
 drivers/uwb/i1480/dfu/usb.c                    |  5 +-
 drivers/watchdog/pcwd_usb.c                    |  3 +
 include/linux/kprobes.h                        |  4 +-
 kernel/fork.c                                  |  2 +-
 kernel/kprobes.c                               |  2 +-
 kernel/pid_namespace.c                         |  2 +-
 kernel/trace/trace_kprobe.c                    |  5 ++
 mm/huge_memory.c                               | 12 +++-
 net/ipx/af_ipx.c                               |  5 +-
 security/integrity/ima/ima_appraise.c          |  5 +-
 61 files changed, 428 insertions(+), 174 deletions(-)

[toc] | [next] | [standalone]

#1648679 — [PATCH 3.18 31/59] USB: serial: io_ti: fix div-by-zero in set_termios

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 6aeb75e6adfaed16e58780309613a578fe1ee90b upstream.

Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.

Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/io_ti.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2210,8 +2210,11 @@ static void change_port_settings(struct
 	if (!baud) {
 		/* pick a default, any default... */
 		baud = 9600;
-	} else
+	} else {
+		/* Avoid a zero divisor. */
+		baud = min(baud, 461550);
 		tty_encode_baud_rate(tty, baud, baud);
+	}
 
 	edge_port->baud_rate = baud;
 	config->wBaudRate = (__u16)((461550L + baud/2) / baud);

[toc] | [prev] | [next] | [standalone]

#1648680 — [PATCH 3.18 18/59] USB: serial: ftdi_sio: fix setting latency for unprivileged users

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anthony Mallet <anthony.mallet@laas.fr>

commit bb246681b3ed0967489a7401ad528c1aaa1a4c2e upstream.

Commit 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY
flag") enables unprivileged users to set the FTDI latency timer,
but there was a logic flaw that skipped sending the corresponding
USB control message to the device.

Specifically, the device latency timer would not be updated until next
open, something which was later also inadvertently broken by commit
c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port
probe").

A recent commit c6dce2626606 ("USB: serial: ftdi_sio: fix extreme
low-latency setting") disabled the low-latency mode by default so we now
need this fix to allow unprivileged users to again enable it.

Signed-off-by: Anthony Mallet <anthony.mallet@laas.fr>
[johan: amend commit message]
Fixes: 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag")
Fixes: c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port probe").
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/ftdi_sio.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1506,9 +1506,9 @@ static int set_serial_info(struct tty_st
 					(new_serial.flags & ASYNC_FLAGS));
 	priv->custom_divisor = new_serial.custom_divisor;
 
+check_and_exit:
 	write_latency_timer(port);
 
-check_and_exit:
 	if ((old_priv.flags & ASYNC_SPD_MASK) !=
 	     (priv->flags & ASYNC_SPD_MASK)) {
 		if ((priv->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)

[toc] | [prev] | [next] | [standalone]

#1648681 — [PATCH 3.18 52/59] stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Micay <danielmicay@gmail.com>

commit 5ea30e4e58040cfd6434c2f33dc3ea76e2c15b05 upstream.

The stack canary is an 'unsigned long' and should be fully initialized to
random data rather than only 32 bits of random data.

Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Acked-by: Arjan van de Ven <arjan@linux.intel.com>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Arjan van Ven <arjan@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: kernel-hardening@lists.openwall.com
Link: http://lkml.kernel.org/r/20170504133209.3053-1-danielmicay@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/fork.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -338,7 +338,7 @@ static struct task_struct *dup_task_stru
 	set_task_stack_end_magic(tsk);
 
 #ifdef CONFIG_CC_STACKPROTECTOR
-	tsk->stack_canary = get_random_int();
+	tsk->stack_canary = get_random_long();
 #endif
 
 	/*

[toc] | [prev] | [next] | [standalone]

#1648682 — [PATCH 3.18 44/59] ARM: dts: at91: sama5d3_xplained: fix ADC vref

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ludovic Desroches <ludovic.desroches@microchip.com>

commit 9cdd31e5913c1f86dce7e201b086155b3f24896b upstream.

The voltage reference for the ADC is not 3V but 3.3V since it is connected to
VDDANA.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/at91-sama5d3_xplained.dts |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -143,6 +143,7 @@
 			};
 
 			adc0: adc@f8018000 {
+				atmel,adc-vref = <3300>;
 				pinctrl-0 = <
 					&pinctrl_adc0_adtrg
 					&pinctrl_adc0_ad0

[toc] | [prev] | [next] | [standalone]

#1648683 — [PATCH 3.18 58/59] drivers: char: mem: Check for address space wraparound with mmap()

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Julius Werner <jwerner@chromium.org>

commit b299cde245b0b76c977f4291162cf668e087b408 upstream.

/dev/mem currently allows mmap() mappings that wrap around the end of
the physical address space, which should probably be illegal. It
circumvents the existing STRICT_DEVMEM permission check because the loop
immediately terminates (as the start address is already higher than the
end address). On the x86_64 architecture it will then cause a panic
(from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()).

This patch adds an explicit check to make sure offset + size will not
wrap around in the physical address type.

Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/mem.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -329,6 +329,11 @@ static const struct vm_operations_struct
 static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 {
 	size_t size = vma->vm_end - vma->vm_start;
+	phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+	/* It's illegal to wrap around the end of the physical address space. */
+	if (offset + (phys_addr_t)size < offset)
+		return -EINVAL;
 
 	if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
 		return -EINVAL;

[toc] | [prev] | [next] | [standalone]

#1648687 — [PATCH 3.18 27/59] USB: iowarrior: fix info ioctl on big-endian hosts

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit dd5ca753fa92fb736b1395db892bd29f78e6d408 upstream.

Drop erroneous le16_to_cpu when returning the USB device speed which is
already in host byte order.

Found using sparse:

	warning: cast to restricted __le16

Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/iowarrior.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -557,7 +557,7 @@ static long iowarrior_ioctl(struct file
 			info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
 
 			/* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
-			info.speed = le16_to_cpu(dev->udev->speed);
+			info.speed = dev->udev->speed;
 			info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
 			info.report_size = dev->report_size;
 

[toc] | [prev] | [next] | [standalone]

#1648688 — [PATCH 3.18 48/59] xc2028: Fix use-after-free bug properly

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 22a1e7783e173ab3d86018eb590107d68df46c11 upstream.

The commit 8dfbcc4351a0 ("[media] xc2028: avoid use after free") tried
to address the reported use-after-free by clearing the reference.

However, it's clearing the wrong pointer; it sets NULL to
priv->ctrl.fname, but it's anyway overwritten by the next line
memcpy(&priv->ctrl, p, sizeof(priv->ctrl)).

OTOH, the actual code accessing the freed string is the strcmp() call
with priv->fname:
	if (!firmware_name[0] && p->fname &&
	    priv->fname && strcmp(p->fname, priv->fname))
		free_firmware(priv);

where priv->fname points to the previous file name, and this was
already freed by kfree().

For fixing the bug properly, this patch does the following:

- Keep the copy of firmware file name in only priv->fname,
  priv->ctrl.fname isn't changed;
- The allocation is done only when the firmware gets loaded;
- The kfree() is called in free_firmware() commonly

Fixes: commit 8dfbcc4351a0 ('[media] xc2028: avoid use after free')
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/tuners/tuner-xc2028.c |   37 +++++++++++++++---------------------
 1 file changed, 16 insertions(+), 21 deletions(-)

--- a/drivers/media/tuners/tuner-xc2028.c
+++ b/drivers/media/tuners/tuner-xc2028.c
@@ -281,6 +281,14 @@ static void free_firmware(struct xc2028_
 	int i;
 	tuner_dbg("%s called\n", __func__);
 
+	/* free allocated f/w string */
+	if (priv->fname != firmware_name)
+		kfree(priv->fname);
+	priv->fname = NULL;
+
+	priv->state = XC2028_NO_FIRMWARE;
+	memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
+
 	if (!priv->firm)
 		return;
 
@@ -291,9 +299,6 @@ static void free_firmware(struct xc2028_
 
 	priv->firm = NULL;
 	priv->firm_size = 0;
-	priv->state = XC2028_NO_FIRMWARE;
-
-	memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
 }
 
 static int load_all_firmwares(struct dvb_frontend *fe,
@@ -884,9 +889,8 @@ read_not_reliable:
 	return 0;
 
 fail:
-	priv->state = XC2028_NO_FIRMWARE;
+	free_firmware(priv);
 
-	memset(&priv->cur_fw, 0, sizeof(priv->cur_fw));
 	if (retry_count < 8) {
 		msleep(50);
 		retry_count++;
@@ -1332,11 +1336,8 @@ static int xc2028_dvb_release(struct dvb
 	mutex_lock(&xc2028_list_mutex);
 
 	/* only perform final cleanup if this is the last instance */
-	if (hybrid_tuner_report_instance_count(priv) == 1) {
+	if (hybrid_tuner_report_instance_count(priv) == 1)
 		free_firmware(priv);
-		kfree(priv->ctrl.fname);
-		priv->ctrl.fname = NULL;
-	}
 
 	if (priv)
 		hybrid_tuner_release_state(priv);
@@ -1399,19 +1400,8 @@ static int xc2028_set_config(struct dvb_
 
 	/*
 	 * Copy the config data.
-	 * For the firmware name, keep a local copy of the string,
-	 * in order to avoid troubles during device release.
 	 */
-	kfree(priv->ctrl.fname);
-	priv->ctrl.fname = NULL;
 	memcpy(&priv->ctrl, p, sizeof(priv->ctrl));
-	if (p->fname) {
-		priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL);
-		if (priv->ctrl.fname == NULL) {
-			rc = -ENOMEM;
-			goto unlock;
-		}
-	}
 
 	/*
 	 * If firmware name changed, frees firmware. As free_firmware will
@@ -1426,10 +1416,15 @@ static int xc2028_set_config(struct dvb_
 
 	if (priv->state == XC2028_NO_FIRMWARE) {
 		if (!firmware_name[0])
-			priv->fname = priv->ctrl.fname;
+			priv->fname = kstrdup(p->fname, GFP_KERNEL);
 		else
 			priv->fname = firmware_name;
 
+		if (!priv->fname) {
+			rc = -ENOMEM;
+			goto unlock;
+		}
+
 		rc = request_firmware_nowait(THIS_MODULE, 1,
 					     priv->fname,
 					     priv->i2c_props.adap->dev.parent,

[toc] | [prev] | [next] | [standalone]

#1648689 — [PATCH 3.18 55/59] tracing/kprobes: Enforce kprobes teardown after testing

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd upstream.

Enabling the tracer selftest triggers occasionally the warning in
text_poke(), which warns when the to be modified page is not marked
reserved.

The reason is that the tracer selftest installs kprobes on functions marked
__init for testing. These probes are removed after the tests, but that
removal schedules the delayed kprobes_optimizer work, which will do the
actual text poke. If the work is executed after the init text is freed,
then the warning triggers. The bug can be reproduced reliably when the work
delay is increased.

Flush the optimizer work and wait for the optimizing/unoptimizing lists to
become empty before returning from the kprobes tracer selftest. That
ensures that all operations which were queued due to the probes removal
have completed.

Link: http://lkml.kernel.org/r/20170516094802.76a468bb@gandalf.local.home

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 6274de498 ("kprobes: Support delayed unoptimizing")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/kprobes.h     |    4 +++-
 kernel/kprobes.c            |    2 +-
 kernel/trace/trace_kprobe.c |    5 +++++
 3 files changed, 9 insertions(+), 2 deletions(-)

--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -327,7 +327,9 @@ extern int proc_kprobes_optimization_han
 					     int write, void __user *buffer,
 					     size_t *length, loff_t *ppos);
 #endif
-
+extern void wait_for_kprobe_optimizer(void);
+#else
+static inline void wait_for_kprobe_optimizer(void) { }
 #endif /* CONFIG_OPTPROBES */
 #ifdef CONFIG_KPROBES_ON_FTRACE
 extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -563,7 +563,7 @@ static void kprobe_optimizer(struct work
 }
 
 /* Wait for completing optimization and unoptimization */
-static void wait_for_kprobe_optimizer(void)
+void wait_for_kprobe_optimizer(void)
 {
 	mutex_lock(&kprobe_mutex);
 
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1484,6 +1484,11 @@ static __init int kprobe_trace_self_test
 
 end:
 	release_all_trace_kprobes();
+	/*
+	 * Wait for the optimizer work to finish. Otherwise it might fiddle
+	 * with probes in already freed __init text.
+	 */
+	wait_for_kprobe_optimizer();
 	if (warn)
 		pr_cont("NG: Some tests are failed. Please check them.\n");
 	else

[toc] | [prev] | [next] | [standalone]

#1648690 — [PATCH 3.18 20/59] usb: host: xhci-plat: propagate return value of platform_get_irq()

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.

platform_get_irq() returns an error code, but the xhci-plat driver
ignores it and always returns -ENODEV. This is not correct, and
prevents -EPROBE_DEFER from being propagated properly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-plat.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -81,7 +81,7 @@ static int xhci_plat_probe(struct platfo
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0)
-		return -ENODEV;
+		return irq;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res)

[toc] | [prev] | [next] | [standalone]

#1648692 — [PATCH 3.18 05/59] dm btree: fix for dm_btree_find_lowest_key()

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vinothkumar Raja <vinraja@cs.stonybrook.edu>

commit 7d1fedb6e96a960aa91e4ff70714c3fb09195a5a upstream.

dm_btree_find_lowest_key() is giving incorrect results.  find_key()
traverses the btree correctly for finding the highest key, but there is
an error in the way it traverses the btree for retrieving the lowest
key.  dm_btree_find_lowest_key() fetches the first key of the rightmost
block of the btree instead of fetching the first key from the leftmost
block.

Fix this by conditionally passing the correct parameter to value64()
based on the @find_highest flag.

Signed-off-by: Erez Zadok <ezk@fsl.cs.sunysb.edu>
Signed-off-by: Vinothkumar Raja <vinraja@cs.stonybrook.edu>
Signed-off-by: Nidhi Panpalia <npanpalia@cs.stonybrook.edu>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/persistent-data/dm-btree.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -788,8 +788,12 @@ static int find_key(struct ro_spine *s,
 		else
 			*result_key = le64_to_cpu(ro_node(s)->keys[0]);
 
-		if (next_block || flags & INTERNAL_NODE)
-			block = value64(ro_node(s), i);
+		if (next_block || flags & INTERNAL_NODE) {
+			if (find_highest)
+				block = value64(ro_node(s), i);
+			else
+				block = value64(ro_node(s), 0);
+		}
 
 	} while (flags & INTERNAL_NODE);
 

[toc] | [prev] | [next] | [standalone]

#1648693 — [PATCH 3.18 40/59] [media] zr364xx: enforce minimum size when reading header

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alyssa Milburn <amilburn@zall.org>

commit ee0fe833d96793853335844b6d99fb76bd12cbeb upstream.

This code copies actual_length-128 bytes from the header, which will
underflow if the received buffer is too small.

Signed-off-by: Alyssa Milburn <amilburn@zall.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/zr364xx/zr364xx.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/media/usb/zr364xx/zr364xx.c
+++ b/drivers/media/usb/zr364xx/zr364xx.c
@@ -605,6 +605,14 @@ static int zr364xx_read_video_callback(s
 	ptr = pdest = frm->lpvbits;
 
 	if (frm->ulState == ZR364XX_READ_IDLE) {
+		if (purb->actual_length < 128) {
+			/* header incomplete */
+			dev_info(&cam->udev->dev,
+				 "%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n",
+				 __func__, purb->actual_length);
+			return -EINVAL;
+		}
+
 		frm->ulState = ZR364XX_READ_FRAME;
 		frm->cur_size = 0;
 

[toc] | [prev] | [next] | [standalone]

#1648694 — [PATCH 3.18 24/59] [media] mceusb: fix NULL-deref at probe

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 03eb2a557ed552e920a0942b774aaf931596eec1 upstream.

Make sure to check for the required out endpoint to avoid dereferencing
a NULL-pointer in mce_request_packet should a malicious device lack such
an endpoint. Note that this path is hit during probe.

Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver")

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/rc/mceusb.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1321,8 +1321,8 @@ static int mceusb_dev_probe(struct usb_i
 			}
 		}
 	}
-	if (ep_in == NULL) {
-		dev_dbg(&intf->dev, "inbound and/or endpoint not found");
+	if (!ep_in || !ep_out) {
+		dev_dbg(&intf->dev, "required endpoints not found\n");
 		return -ENODEV;
 	}
 

[toc] | [prev] | [next] | [standalone]

#1648696 — [PATCH 3.18 42/59] [media] cx231xx-audio: fix NULL-deref at probe

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")

Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/cx231xx/cx231xx-audio.c |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -702,6 +702,11 @@ static int cx231xx_audio_init(struct cx2
 					    hs_config_info[0].interface_info.
 					    audio_index + 1];
 
+	if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
+		snd_card_free(card);
+		return -ENODEV;
+	}
+
 	adev->end_point_addr =
 	    uif->altsetting[0].endpoint[isoc_pipe].desc.
 			bEndpointAddress;
@@ -717,8 +722,14 @@ static int cx231xx_audio_init(struct cx2
 	}
 
 	for (i = 0; i < adev->num_alt; i++) {
-		u16 tmp =
-		    le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
+		u16 tmp;
+
+		if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
+			snd_card_free(card);
+			return -ENODEV;
+		}
+
+		tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
 				wMaxPacketSize);
 		adev->alt_max_pkt_size[i] =
 		    (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);

[toc] | [prev] | [next] | [standalone]

#1648697 — [PATCH 3.18 09/59] mwifiex: pcie: fix cmd_buf use-after-free in remove/reset

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian Norris <briannorris@chromium.org>

commit 3c8cb9ad032d737b874e402c59eb51e3c991a144 upstream.

Command buffers (skb's) are allocated by the main driver, and freed upon
the last use. That last use is often in mwifiex_free_cmd_buffer(). In
the meantime, if the command buffer gets used by the PCI driver, we map
it as DMA-able, and store the mapping information in the 'cb' memory.

However, if a command was in-flight when resetting the device (and
therefore was still mapped), we don't get a chance to unmap this memory
until after the core has cleaned up its command handling.

Let's keep a refcount within the PCI driver, so we ensure the memory
only gets freed after we've finished unmapping it.

Noticed by KASAN when forcing a reset via:

  echo 1 > /sys/bus/pci/.../reset

The same code path can presumably be exercised in remove() and
shutdown().

[  205.390377] mwifiex_pcie 0000:01:00.0: info: shutdown mwifiex...
[  205.400393] ==================================================================
[  205.407719] BUG: KASAN: use-after-free in mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie] at addr ffffffc0ad471b28
[  205.419040] Read of size 16 by task bash/1913
[  205.423421] =============================================================================
[  205.431625] BUG skbuff_head_cache (Tainted: G    B          ): kasan: bad access detected
[  205.439815] -----------------------------------------------------------------------------
[  205.439815]
[  205.449534] INFO: Allocated in __build_skb+0x48/0x114 age=1311 cpu=4 pid=1913
[  205.456709] 	alloc_debug_processing+0x124/0x178
[  205.461282] 	___slab_alloc.constprop.58+0x528/0x608
[  205.466196] 	__slab_alloc.isra.54.constprop.57+0x44/0x54
[  205.471542] 	kmem_cache_alloc+0xcc/0x278
[  205.475497] 	__build_skb+0x48/0x114
[  205.479019] 	__netdev_alloc_skb+0xe0/0x170
[  205.483244] 	mwifiex_alloc_cmd_buffer+0x68/0xdc [mwifiex]
[  205.488759] 	mwifiex_init_fw+0x40/0x6cc [mwifiex]
[  205.493584] 	_mwifiex_fw_dpc+0x158/0x520 [mwifiex]
[  205.498491] 	mwifiex_reinit_sw+0x2c4/0x398 [mwifiex]
[  205.503510] 	mwifiex_pcie_reset_notify+0x114/0x15c [mwifiex_pcie]
[  205.509643] 	pci_reset_notify+0x5c/0x6c
[  205.513519] 	pci_reset_function+0x6c/0x7c
[  205.517567] 	reset_store+0x68/0x98
[  205.521003] 	dev_attr_store+0x54/0x60
[  205.524705] 	sysfs_kf_write+0x9c/0xb0
[  205.528413] INFO: Freed in __kfree_skb+0xb0/0xbc age=131 cpu=4 pid=1913
[  205.535064] 	free_debug_processing+0x264/0x370
[  205.539550] 	__slab_free+0x84/0x40c
[  205.543075] 	kmem_cache_free+0x1c8/0x2a0
[  205.547030] 	__kfree_skb+0xb0/0xbc
[  205.550465] 	consume_skb+0x164/0x178
[  205.554079] 	__dev_kfree_skb_any+0x58/0x64
[  205.558304] 	mwifiex_free_cmd_buffer+0xa0/0x158 [mwifiex]
[  205.563817] 	mwifiex_shutdown_drv+0x578/0x5c4 [mwifiex]
[  205.569164] 	mwifiex_shutdown_sw+0x178/0x310 [mwifiex]
[  205.574353] 	mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie]
[  205.580398] 	pci_reset_notify+0x5c/0x6c
[  205.584274] 	pci_dev_save_and_disable+0x24/0x6c
[  205.588837] 	pci_reset_function+0x30/0x7c
[  205.592885] 	reset_store+0x68/0x98
[  205.596324] 	dev_attr_store+0x54/0x60
[  205.600017] 	sysfs_kf_write+0x9c/0xb0
...
[  205.800488] Call trace:
[  205.802980] [<ffffffc00020a69c>] dump_backtrace+0x0/0x190
[  205.808415] [<ffffffc00020a96c>] show_stack+0x20/0x28
[  205.813506] [<ffffffc0005d020c>] dump_stack+0xa4/0xcc
[  205.818598] [<ffffffc0003be44c>] print_trailer+0x158/0x168
[  205.824120] [<ffffffc0003be5f0>] object_err+0x4c/0x5c
[  205.829210] [<ffffffc0003c45bc>] kasan_report+0x334/0x500
[  205.834641] [<ffffffc0003c3994>] check_memory_region+0x20/0x14c
[  205.840593] [<ffffffc0003c3b14>] __asan_loadN+0x14/0x1c
[  205.845879] [<ffffffbffc46171c>] mwifiex_unmap_pci_memory.isra.14+0x4c/0x100 [mwifiex_pcie]
[  205.854282] [<ffffffbffc461864>] mwifiex_pcie_delete_cmdrsp_buf+0x94/0xa8 [mwifiex_pcie]
[  205.862421] [<ffffffbffc462028>] mwifiex_pcie_free_buffers+0x11c/0x158 [mwifiex_pcie]
[  205.870302] [<ffffffbffc4620d4>] mwifiex_pcie_down_dev+0x70/0x80 [mwifiex_pcie]
[  205.877736] [<ffffffbffc1397a8>] mwifiex_shutdown_sw+0x190/0x310 [mwifiex]
[  205.884658] [<ffffffbffc4606b4>] mwifiex_pcie_reset_notify+0xd4/0x15c [mwifiex_pcie]
[  205.892446] [<ffffffc000635f54>] pci_reset_notify+0x5c/0x6c
[  205.898048] [<ffffffc00063a044>] pci_dev_save_and_disable+0x24/0x6c
[  205.904350] [<ffffffc00063cf0c>] pci_reset_function+0x30/0x7c
[  205.910134] [<ffffffc000641118>] reset_store+0x68/0x98
[  205.915312] [<ffffffc000771588>] dev_attr_store+0x54/0x60
[  205.920750] [<ffffffc00046f53c>] sysfs_kf_write+0x9c/0xb0
[  205.926182] [<ffffffc00046dfb0>] kernfs_fop_write+0x184/0x1f8
[  205.931963] [<ffffffc0003d64f4>] __vfs_write+0x6c/0x17c
[  205.937221] [<ffffffc0003d7164>] vfs_write+0xf0/0x1c4
[  205.942310] [<ffffffc0003d7da0>] SyS_write+0x78/0xd8
[  205.947312] [<ffffffc000204634>] el0_svc_naked+0x24/0x28
...
[  205.998268] ==================================================================

This bug has been around in different forms for a while. It was sort of
noticed in commit 955ab095c51a ("mwifiex: Do not kfree cmd buf while
unregistering PCIe"), but it just fixed the double-free, without
acknowledging the potential for use-after-free.

Fixes: fc3314609047 ("mwifiex: use pci_alloc/free_consistent APIs for PCIe")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mwifiex/pcie.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -930,6 +930,7 @@ static int mwifiex_pcie_delete_cmdrsp_bu
 	if (card && card->cmd_buf) {
 		mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
 					 PCI_DMA_TODEVICE);
+		dev_kfree_skb_any(card->cmd_buf);
 	}
 	return 0;
 }
@@ -1485,6 +1486,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_ada
 		return -1;
 
 	card->cmd_buf = skb;
+	/*
+	 * Need to keep a reference, since core driver might free up this
+	 * buffer before we've unmapped it.
+	 */
+	skb_get(skb);
 
 	/* To send a command, the driver will:
 		1. Write the 64bit physical address of the data buffer to
@@ -1581,6 +1587,7 @@ static int mwifiex_pcie_process_cmd_comp
 	if (card->cmd_buf) {
 		mwifiex_unmap_pci_memory(adapter, card->cmd_buf,
 					 PCI_DMA_TODEVICE);
+		dev_kfree_skb_any(card->cmd_buf);
 		card->cmd_buf = NULL;
 	}
 

[toc] | [prev] | [next] | [standalone]

#1648699 — [PATCH 3.18 16/59] iio: dac: ad7303: fix channel description

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pavel Roskin <plroskin@gmail.com>

commit ce420fd4251809b4c3119b3b20c8b13bd8eba150 upstream.

realbits, storagebits and shift should be numbers, not ASCII characters.

Signed-off-by: Pavel Roskin <plroskin@gmail.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/dac/ad7303.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/iio/dac/ad7303.c
+++ b/drivers/iio/dac/ad7303.c
@@ -184,9 +184,9 @@ static const struct iio_chan_spec_ext_in
 	.address = (chan),					\
 	.scan_type = {						\
 		.sign = 'u',					\
-		.realbits = '8',				\
-		.storagebits = '8',				\
-		.shift = '0',					\
+		.realbits = 8,					\
+		.storagebits = 8,				\
+		.shift = 0,					\
 	},							\
 	.ext_info = ad7303_ext_info,				\
 }

[toc] | [prev] | [next] | [standalone]

#1648700 — [PATCH 3.18 11/59] regulator: tps65023: Fix inverted core enable logic.

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Cochran <rcochran@linutronix.de>

commit c90722b54a4f5e21ac59301ed9a6dbaa439bdb16 upstream.

Commit 43530b69d758328d3ffe6ab98fd640463e8e3667 ("regulator: Use
regmap_read/write(), regmap_update_bits functions directly") intended
to replace working inline helper functions with standard regmap
calls.  However, it also inverted the set/clear logic of the "CORE ADJ
Allowed" bit.  That patch was clearly never tested, since without that
bit cleared, the core VDCDC1 voltage output does not react to I2C
configuration changes.

This patch fixes the issue by clearing the bit as in the original,
correct implementation.  Note for stable back porting that, due to
subsequent driver churn, this patch will not apply on every kernel
version.

Fixes: 43530b69d758 ("regulator: Use regmap_read/write(), regmap_update_bits functions directly")
Signed-off-by: Richard Cochran <rcochran@linutronix.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/tps65023-regulator.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/regulator/tps65023-regulator.c
+++ b/drivers/regulator/tps65023-regulator.c
@@ -290,8 +290,7 @@ static int tps_65023_probe(struct i2c_cl
 
 	/* Enable setting output voltage by I2C */
 	regmap_update_bits(tps->regmap, TPS65023_REG_CON_CTRL2,
-					TPS65023_REG_CTRL2_CORE_ADJ,
-					TPS65023_REG_CTRL2_CORE_ADJ);
+			   TPS65023_REG_CTRL2_CORE_ADJ, 0);
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1648701 — [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Hurley <peter@hurleysoftware.com>

commit dd42bf1197144ede075a9d4793123f7689e164bc upstream.

Line discipline drivers may mistakenly misuse ldisc-related fields
when initializing. For example, a failure to initialize tty->receive_room
in the N_GIGASET_M101 line discipline was recently found and fixed [1].
Now, the N_X25 line discipline has been discovered accessing the previous
line discipline's already-freed private data [2].

Harden the ldisc interface against misuse by initializing revelant
tty fields before instancing the new line discipline.

[1]
    commit fd98e9419d8d622a4de91f76b306af6aa627aa9c
    Author: Tilman Schmidt <tilman@imap.cc>
    Date:   Tue Jul 14 00:37:13 2015 +0200

    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset

[2] Report from Sasha Levin <sasha.levin@oracle.com>
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Cc: Tilman Schmidt <tilman@imap.cc>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/tty_ldisc.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -414,6 +414,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
  *	they are not on hot paths so a little discipline won't do
  *	any harm.
  *
+ *	The line discipline-related tty_struct fields are reset to
+ *	prevent the ldisc driver from re-using stale information for
+ *	the new ldisc instance.
+ *
  *	Locking: takes termios_rwsem
  */
 
@@ -422,6 +426,9 @@ static void tty_set_termios_ldisc(struct
 	down_write(&tty->termios_rwsem);
 	tty->termios.c_line = num;
 	up_write(&tty->termios_rwsem);
+
+	tty->disc_data = NULL;
+	tty->receive_room = 0;
 }
 
 /**

[toc] | [prev] | [next] | [standalone]

#1649630 — Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields

On Tue, 23 May 2017 22:10:02 +0200
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:

> 3.18-stable review patch.  If anyone has any objections, please let me know.
> 

Thiis is a patch designed to cause a crash in order to stop future errors
occurring. It seems less than ideal as a stable candidate.

> ------------------
> 
> From: Peter Hurley <peter@hurleysoftware.com>
> 
> commit dd42bf1197144ede075a9d4793123f7689e164bc upstream.
> 
> Line discipline drivers may mistakenly misuse ldisc-related fields
> when initializing. For example, a failure to initialize tty->receive_room
> in the N_GIGASET_M101 line discipline was recently found and fixed [1].
> Now, the N_X25 line discipline has been discovered accessing the previous
> line discipline's already-freed private data [2].
> 
> Harden the ldisc interface against misuse by initializing revelant
> tty fields before instancing the new line discipline.
> 
> [1]
>     commit fd98e9419d8d622a4de91f76b306af6aa627aa9c
>     Author: Tilman Schmidt <tilman@imap.cc>
>     Date:   Tue Jul 14 00:37:13 2015 +0200
> 
>     isdn/gigaset: reset tty->receive_room when attaching ser_gigaset
> 
> [2] Report from Sasha Levin <sasha.levin@oracle.com>
>     [  634.336761] ==================================================================
>     [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
>     [  634.339558] Read of size 4 by task syzkaller_execu/8981
>     [  634.340359] =============================================================================
>     [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
>     ...
>     [  634.405018] Call Trace:
>     [  634.405277] dump_stack (lib/dump_stack.c:52)
>     [  634.405775] print_trailer (mm/slub.c:655)
>     [  634.406361] object_err (mm/slub.c:662)
>     [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
>     [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
>     [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
>     [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
>     [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
>     [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
>     [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
>     [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
>     [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
> 
> Cc: Tilman Schmidt <tilman@imap.cc>
> Cc: Sasha Levin <sasha.levin@oracle.com>
> Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
> Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> ---
>  drivers/tty/tty_ldisc.c |    7 +++++++
>  1 file changed, 7 insertions(+)
> 
> --- a/drivers/tty/tty_ldisc.c
> +++ b/drivers/tty/tty_ldisc.c
> @@ -414,6 +414,10 @@ EXPORT_SYMBOL_GPL(tty_ldisc_flush);
>   *	they are not on hot paths so a little discipline won't do
>   *	any harm.
>   *
> + *	The line discipline-related tty_struct fields are reset to
> + *	prevent the ldisc driver from re-using stale information for
> + *	the new ldisc instance.
> + *
>   *	Locking: takes termios_rwsem
>   */
>  
> @@ -422,6 +426,9 @@ static void tty_set_termios_ldisc(struct
>  	down_write(&tty->termios_rwsem);
>  	tty->termios.c_line = num;
>  	up_write(&tty->termios_rwsem);
> +
> +	tty->disc_data = NULL;
> +	tty->receive_room = 0;
>  }
>  
>  /**
> 

[toc] | [prev] | [next] | [standalone]

#1649694 — Re: [PATCH 3.18 34/59] tty: Prevent ldisc drivers from re-using stale tty fields

On Wed, May 24, 2017 at 02:44:33PM +0100, Alan Cox wrote:
> On Tue, 23 May 2017 22:10:02 +0200
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 
> > 3.18-stable review patch.  If anyone has any objections, please let me know.
> > 
> 
> Thiis is a patch designed to cause a crash in order to stop future errors
> occurring. It seems less than ideal as a stable candidate.

It has been in the 4.4-stable tree since 4.4.34, which was released last
November, and now it seems the Google "security" team thought it was
worthwhile to backport to 3.18 for their Android devices as well.  So
I'll take it, it can't hurt, and crashing is usually better than odd
errors.

thanks,

greg k-h

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | linux.kernel

csiph-web