1. 21 Sep, 2019 19 commits
    • YueHaibing's avatar
      ieee802154: hwsim: Fix error handle path in hwsim_init_module · c237a050
      YueHaibing authored
      [ Upstream commit 1cbbbf39 ]
      
      KASAN report this:
      
      BUG: unable to handle kernel paging request at fffffbfff834f001
      PGD 237fe8067 P4D 237fe8067 PUD 237e64067 PMD 1c968d067 PTE 0
      Oops: 0000 [#1] SMP KASAN PTI
      CPU: 1 PID: 8871 Comm: syz-executor.0 Tainted: G         C        5.0.0+ #5
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
      RIP: 0010:strcmp+0x31/0xa0 lib/string.c:328
      Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d
      RSP: 0018:ffff8881e0c57800 EFLAGS: 00010246
      RAX: 1ffffffff834f001 RBX: ffffffffc1a78000 RCX: ffffffff827b9503
      RDX: 0000000000000000 RSI: ffffffffc1a40008 RDI: ffffffffc1a78008
      RBP: ffffffffc1a78009 R08: fffffbfff6a92195 R09: fffffbfff6a92195
      R10: ffff8881e0c578b8 R11: fffffbfff6a92194 R12: ffffffffc1a40008
      R13: dffffc0000000000 R14: ffffffffc1a3e470 R15: ffffffffc1a40000
      FS:  00007fdcc02ff700(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: fffffbfff834f001 CR3: 00000001b3134003 CR4: 00000000007606e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      PKRU: 55555554
      Call Trace:
       genl_family_find_byname+0x7f/0xf0 net/netlink/genetlink.c:104
       genl_register_family+0x1e1/0x1070 net/netlink/genetlink.c:333
       ? 0xffffffffc1978000
       hwsim_init_module+0x6a/0x1000 [mac802154_hwsim]
       ? 0xffffffffc1978000
       ? 0xffffffffc1978000
       ? 0xffffffffc1978000
       do_one_initcall+0xbc/0x47d init/main.c:887
       do_init_module+0x1b5/0x547 kernel/module.c:3456
       load_module+0x6405/0x8c10 kernel/module.c:3804
       __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
       do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x462e99
      Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007fdcc02fec58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
      RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
      RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003
      RBP: 00007fdcc02fec70 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdcc02ff6bc
      R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
      Modules linked in: mac802154_hwsim(+) mac802154 ieee802154 speakup(C) rc_proteus_2309 rtc_rk808 streebog_generic rds vboxguest madera_spi madera da9052_wdt mISDN_core ueagle_atm usbatm atm ir_imon_decoder scsi_transport_sas rc_dntv_live_dvb_t panel_samsung_s6d16d0 drm drm_panel_orientation_quirks lib80211 fb_agm1264k_fl(C) gspca_pac7302 gspca_main videobuf2_v4l2 soundwire_intel_init i2c_dln2 dln2 usbcore hid_gaff 88pm8607 nfnetlink axp20x_i2c axp20x uio pata_marvell pmbus_core snd_sonicvibes gameport snd_pcm snd_opl3_lib snd_timer snd_hwdep snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore rtc_ds1511 rtc_ds1742 vsock dwc_xlgmac rtc_rx8010 libphy twofish_x86_64_3way twofish_x86_64 twofish_common ad5696_i2c ad5686 lp8788_charger cxd2880_spi dvb_core videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops fbtft(C) sysimgblt sysfillrect syscopyarea fb_sys_fops janz_ican3 firewire_net firewire_core crc_itu_t spi_slave_system_control i2c_matroxfb i2c_algo_bit
       matroxfb_base fb fbdev matroxfb_DAC1064 matroxfb_accel cfbcopyarea cfbimgblt cfbfillrect matroxfb_Ti3026 matroxfb_g450 g450_pll matroxfb_misc leds_blinkm ti_dac7311 intel_spi_pci intel_spi spi_nor hid_elan hid async_tx rc_cinergy_1400 rc_core intel_ishtp kxcjk_1013 industrialio_triggered_buffer kfifo_buf can_dev intel_th spi_pxa2xx_platform pata_artop vme_ca91cx42 gb_gbphy(C) greybus(C) industrialio mptbase st_drv cmac ttpci_eeprom via_wdt gpio_xra1403 mtd iptable_security iptable_raw iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun joydev mousedev ppdev kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel aes_x86_64 input_leds crypto_simd cryptd glue_helper ide_pci_generic piix psmouse
       ide_core serio_raw ata_generic i2c_piix4 pata_acpi parport_pc parport floppy rtc_cmos intel_agp intel_gtt agpgart sch_fq_codel ip_tables x_tables sha1_ssse3 sha1_generic ipv6 [last unloaded: speakup]
      Dumping ftrace buffer:
         (ftrace buffer empty)
      CR2: fffffbfff834f001
      ---[ end trace 5aa772c793e0e971 ]---
      RIP: 0010:strcmp+0x31/0xa0 lib/string.c:328
      Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d
      RSP: 0018:ffff8881e0c57800 EFLAGS: 00010246
      RAX: 1ffffffff834f001 RBX: ffffffffc1a78000 RCX: ffffffff827b9503
      RDX: 0000000000000000 RSI: ffffffffc1a40008 RDI: ffffffffc1a78008
      RBP: ffffffffc1a78009 R08: fffffbfff6a92195 R09: fffffbfff6a92195
      R10: ffff8881e0c578b8 R11: fffffbfff6a92194 R12: ffffffffc1a40008
      R13: dffffc0000000000 R14: ffffffffc1a3e470 R15: ffffffffc1a40000
      FS:  00007fdcc02ff700(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: fffffbfff834f001 CR3: 00000001b3134003 CR4: 00000000007606e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      PKRU: 55555554
      
      The error handing path misplace the cleanup in hwsim_init_module,
      switch the two cleanup functions to fix above issues.
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Fixes: f25da51f ("ieee802154: hwsim: add replacement for fakelb")
      Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
      Acked-by: default avatarAlexander Aring <aring@mojatatu.com>
      Signed-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      c237a050
    • Masashi Honma's avatar
      nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds · 6a10e87f
      Masashi Honma authored
      commit 4b2c5a14 upstream.
      
      commit 1222a160 ("nl80211: Fix possible Spectre-v1 for CQM
      RSSI thresholds") was incomplete and requires one more fix to
      prevent accessing to rssi_thresholds[n] because user can control
      rssi_thresholds[i] values to make i reach to n. For example,
      rssi_thresholds = {-400, -300, -200, -100} when last is -34.
      
      Cc: stable@vger.kernel.org
      Fixes: 1222a160 ("nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds")
      Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarMasashi Honma <masashi.honma@gmail.com>
      Link: https://lore.kernel.org/r/20190908005653.17433-1-masashi.honma@gmail.comSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6a10e87f
    • Wen Huang's avatar
      mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings · 941431c4
      Wen Huang authored
      commit 7caac62e upstream.
      
      mwifiex_update_vs_ie(),mwifiex_set_uap_rates() and
      mwifiex_set_wmm_params() call memcpy() without checking
      the destination size.Since the source is given from
      user-space, this may trigger a heap buffer overflow.
      
      Fix them by putting the length check before performing memcpy().
      
      This fix addresses CVE-2019-14814,CVE-2019-14815,CVE-2019-14816.
      Signed-off-by: default avatarWen Huang <huangwenabc@gmail.com>
      Acked-by: default avatarGanapathi Bhat <gbhat@marvell.comg>
      Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      941431c4
    • Razvan Stefanescu's avatar
      tty/serial: atmel: reschedule TX after RX was started · 770cee24
      Razvan Stefanescu authored
      commit d2ace81b upstream.
      
      When half-duplex RS485 communication is used, after RX is started, TX
      tasklet still needs to be  scheduled tasklet. This avoids console freezing
      when more data is to be transmitted, if the serial communication is not
      closed.
      
      Fixes: 69646d7a ("tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped")
      Signed-off-by: default avatarRazvan Stefanescu <razvan.stefanescu@microchip.com>
      Cc: stable <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20190813074025.16218-1-razvan.stefanescu@microchip.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      770cee24
    • Chunyan Zhang's avatar
      serial: sprd: correct the wrong sequence of arguments · 4c2f60ed
      Chunyan Zhang authored
      commit 9c801e31 upstream.
      
      The sequence of arguments which was passed to handle_lsr_errors() didn't
      match the parameters defined in that function, &lsr was passed to flag
      and &flag was passed to lsr, this patch fixed that.
      
      Fixes: b7396a38 ("tty/serial: Add Spreadtrum sc9836-uart driver support")
      Signed-off-by: default avatarChunyan Zhang <chunyan.zhang@unisoc.com>
      Signed-off-by: default avatarChunyan Zhang <zhang.lyra@gmail.com>
      Cc: stable <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/20190905074151.5268-1-zhang.lyra@gmail.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4c2f60ed
    • Hung-Te Lin's avatar
      firmware: google: check if size is valid when decoding VPD data · 28716215
      Hung-Te Lin authored
      commit 4b708b7b upstream.
      
      The VPD implementation from Chromium Vital Product Data project used to
      parse data from untrusted input without checking if the meta data is
      invalid or corrupted. For example, the size from decoded content may
      be negative value, or larger than whole input buffer. Such invalid data
      may cause buffer overflow.
      
      To fix that, the size parameters passed to vpd_decode functions should
      be changed to unsigned integer (u32) type, and the parsing of entry
      header should be refactored so every size field is correctly verified
      before starting to decode.
      
      Fixes: ad2ac9d5 ("firmware: Google VPD: import lib_vpd source files")
      Signed-off-by: default avatarHung-Te Lin <hungte@chromium.org>
      Cc: stable <stable@vger.kernel.org>
      Reviewed-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarStephen Boyd <swboyd@chromium.org>
      Link: https://lore.kernel.org/r/20190830022402.214442-1-hungte@chromium.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      28716215
    • Matt Delco's avatar
      KVM: coalesced_mmio: add bounds checking · 232a6462
      Matt Delco authored
      commit b60fe990 upstream.
      
      The first/last indexes are typically shared with a user app.
      The app can change the 'last' index that the kernel uses
      to store the next result.  This change sanity checks the index
      before using it for writing to a potentially arbitrary address.
      
      This fixes CVE-2019-14821.
      
      Cc: stable@vger.kernel.org
      Fixes: 5f94c174 ("KVM: Add coalesced MMIO support (common part)")
      Signed-off-by: default avatarMatt Delco <delco@chromium.org>
      Signed-off-by: default avatarJim Mattson <jmattson@google.com>
      Reported-by: syzbot+983c866c3dd6efa3662a@syzkaller.appspotmail.com
      [Use READ_ONCE. - Paolo]
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      232a6462
    • Cong Wang's avatar
      net_sched: let qdisc_put() accept NULL pointer · 7a1bad56
      Cong Wang authored
      [ Upstream commit 6efb971b ]
      
      When tcf_block_get() fails in sfb_init(), q->qdisc is still a NULL
      pointer which leads to a crash in sfb_destroy(). Similar for
      sch_dsmark.
      
      Instead of fixing each separately, Linus suggested to just accept
      NULL pointer in qdisc_put(), which would make callers easier.
      
      (For sch_dsmark, the bug probably exists long before commit
      6529eaba.)
      
      Fixes: 6529eaba ("net: sched: introduce tcf block infractructure")
      Reported-by: syzbot+d5870a903591faaca4ae@syzkaller.appspotmail.com
      Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Cc: Jiri Pirko <jiri@resnulli.us>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      7a1bad56
    • Dongli Zhang's avatar
      xen-netfront: do not assume sk_buff_head list is empty in error handling · 47288968
      Dongli Zhang authored
      [ Upstream commit 00b36850 ]
      
      When skb_shinfo(skb) is not able to cache extra fragment (that is,
      skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS), xennet_fill_frags() assumes
      the sk_buff_head list is already empty. As a result, cons is increased only
      by 1 and returns to error handling path in xennet_poll().
      
      However, if the sk_buff_head list is not empty, queue->rx.rsp_cons may be
      set incorrectly. That is, queue->rx.rsp_cons would point to the rx ring
      buffer entries whose queue->rx_skbs[i] and queue->grant_rx_ref[i] are
      already cleared to NULL. This leads to NULL pointer access in the next
      iteration to process rx ring buffer entries.
      
      Below is how xennet_poll() does error handling. All remaining entries in
      tmpq are accounted to queue->rx.rsp_cons without assuming how many
      outstanding skbs are remained in the list.
      
       985 static int xennet_poll(struct napi_struct *napi, int budget)
      ... ...
      1032           if (unlikely(xennet_set_skb_gso(skb, gso))) {
      1033                   __skb_queue_head(&tmpq, skb);
      1034                   queue->rx.rsp_cons += skb_queue_len(&tmpq);
      1035                   goto err;
      1036           }
      
      It is better to always have the error handling in the same way.
      
      Fixes: ad4f15dc ("xen/netfront: don't bug in case of too many frags")
      Signed-off-by: default avatarDongli Zhang <dongli.zhang@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      47288968
    • Willem de Bruijn's avatar
      udp: correct reuseport selection with connected sockets · fdd60d80
      Willem de Bruijn authored
      [ Upstream commit acdcecc6 ]
      
      UDP reuseport groups can hold a mix unconnected and connected sockets.
      Ensure that connections only receive all traffic to their 4-tuple.
      
      Fast reuseport returns on the first reuseport match on the assumption
      that all matches are equal. Only if connections are present, return to
      the previous behavior of scoring all sockets.
      
      Record if connections are present and if so (1) treat such connected
      sockets as an independent match from the group, (2) only return
      2-tuple matches from reuseport and (3) do not return on the first
      2-tuple reuseport match to allow for a higher scoring match later.
      
      New field has_conns is set without locks. No other fields in the
      bitmap are modified at runtime and the field is only ever set
      unconditionally, so an RMW cannot miss a change.
      
      Fixes: e32ea7e7 ("soreuseport: fast reuseport UDP socket selection")
      Link: http://lkml.kernel.org/r/CA+FuTSfRP09aJNYRt04SS6qj22ViiOEWaWmLAwX0psk8-PGNxw@mail.gmail.comSigned-off-by: default avatarWillem de Bruijn <willemb@google.com>
      Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Acked-by: default avatarCraig Gallek <kraig@google.com>
      Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      fdd60d80
    • Xin Long's avatar
      ip6_gre: fix a dst leak in ip6erspan_tunnel_xmit · 97b5f8c9
      Xin Long authored
      [ Upstream commit 28e48603 ]
      
      In ip6erspan_tunnel_xmit(), if the skb will not be sent out, it has to
      be freed on the tx_err path. Otherwise when deleting a netns, it would
      cause dst/dev to leak, and dmesg shows:
      
        unregister_netdevice: waiting for lo to become free. Usage count = 1
      
      Fixes: ef7baf5e ("ip6_gre: add ip6 erspan collect_md mode")
      Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
      Acked-by: default avatarWilliam Tu <u9012063@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      97b5f8c9
    • Yoshihiro Shimoda's avatar
      phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current · 4fb95f29
      Yoshihiro Shimoda authored
      commit e6839c31 upstream.
      
      The hardware manual should be revised, but the initial value of
      VBCTRL.OCCLREN is set to 1 actually. If the bit is set, the hardware
      clears VBCTRL.VBOUT and ADPCTRL.DRVVBUS registers automatically
      when the hardware detects over-current signal from a USB power switch.
      However, since the hardware doesn't have any registers which
      indicates over-current, the driver cannot handle it at all. So, if
      "is_otg_channel" hardware detects over-current, since ADPCTRL.DRVVBUS
      register is cleared automatically, the channel cannot be used after
      that.
      
      To resolve this behavior, this patch sets the VBCTRL.OCCLREN to 0
      to keep ADPCTRL.DRVVBUS even if the "is_otg_channel" hardware
      detects over-current. (We assume a USB power switch itself protects
      over-current and turns the VBUS off.)
      
      This patch is inspired by a BSP patch from Kazuya Mizuguchi.
      
      Fixes: 1114e2d3 ("phy: rcar-gen3-usb2: change the mode to OTG on the combined channel")
      Cc: <stable@vger.kernel.org> # v4.5+
      Signed-off-by: default avatarYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
      Signed-off-by: default avatarKishon Vijay Abraham I <kishon@ti.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      4fb95f29
    • Sean Young's avatar
      media: tm6000: double free if usb disconnect while streaming · abf389e0
      Sean Young authored
      commit 699bf941 upstream.
      
      The usb_bulk_urb will kfree'd on disconnect, so ensure the pointer is set
      to NULL after each free.
      
      stop stream
      urb killing
      urb buffer free
      tm6000: got start feed request tm6000_start_feed
      tm6000: got start stream request tm6000_start_stream
      tm6000: pipe reset
      tm6000: got start feed request tm6000_start_feed
      tm6000: got start feed request tm6000_start_feed
      tm6000: got start feed request tm6000_start_feed
      tm6000: got start feed request tm6000_start_feed
      tm6000: IR URB failure: status: -71, length 0
      xhci_hcd 0000:00:14.0: ERROR unknown event type 37
      xhci_hcd 0000:00:14.0: ERROR unknown event type 37
      tm6000:  error tm6000_urb_received
      usb 1-2: USB disconnect, device number 5
      tm6000: disconnecting tm6000 #0
      ==================================================================
      BUG: KASAN: use-after-free in dvb_fini+0x75/0x140 [tm6000_dvb]
      Read of size 8 at addr ffff888241044060 by task kworker/2:0/22
      
      CPU: 2 PID: 22 Comm: kworker/2:0 Tainted: G        W         5.3.0-rc4+ #1
      Hardware name: LENOVO 20KHCTO1WW/20KHCTO1WW, BIOS N23ET65W (1.40 ) 07/02/2019
      Workqueue: usb_hub_wq hub_event
      Call Trace:
       dump_stack+0x9a/0xf0
       print_address_description.cold+0xae/0x34f
       __kasan_report.cold+0x75/0x93
       ? tm6000_fillbuf+0x390/0x3c0 [tm6000_alsa]
       ? dvb_fini+0x75/0x140 [tm6000_dvb]
       kasan_report+0xe/0x12
       dvb_fini+0x75/0x140 [tm6000_dvb]
       tm6000_close_extension+0x51/0x80 [tm6000]
       tm6000_usb_disconnect.cold+0xd4/0x105 [tm6000]
       usb_unbind_interface+0xe4/0x390
       device_release_driver_internal+0x121/0x250
       bus_remove_device+0x197/0x260
       device_del+0x268/0x550
       ? __device_links_no_driver+0xd0/0xd0
       ? usb_remove_ep_devs+0x30/0x3b
       usb_disable_device+0x122/0x400
       usb_disconnect+0x153/0x430
       hub_event+0x800/0x1e40
       ? trace_hardirqs_on_thunk+0x1a/0x20
       ? hub_port_debounce+0x1f0/0x1f0
       ? retint_kernel+0x10/0x10
       ? lock_is_held_type+0xf1/0x130
       ? hub_port_debounce+0x1f0/0x1f0
       ? process_one_work+0x4ae/0xa00
       process_one_work+0x4ba/0xa00
       ? pwq_dec_nr_in_flight+0x160/0x160
       ? do_raw_spin_lock+0x10a/0x1d0
       worker_thread+0x7a/0x5c0
       ? process_one_work+0xa00/0xa00
       kthread+0x1d5/0x200
       ? kthread_create_worker_on_cpu+0xd0/0xd0
       ret_from_fork+0x3a/0x50
      
      Allocated by task 2682:
       save_stack+0x1b/0x80
       __kasan_kmalloc.constprop.0+0xc2/0xd0
       usb_alloc_urb+0x28/0x60
       tm6000_start_feed+0x10a/0x300 [tm6000_dvb]
       dmx_ts_feed_start_filtering+0x86/0x120 [dvb_core]
       dvb_dmxdev_start_feed+0x121/0x180 [dvb_core]
       dvb_dmxdev_filter_start+0xcb/0x540 [dvb_core]
       dvb_demux_do_ioctl+0x7ed/0x890 [dvb_core]
       dvb_usercopy+0x97/0x1f0 [dvb_core]
       dvb_demux_ioctl+0x11/0x20 [dvb_core]
       do_vfs_ioctl+0x5d8/0x9d0
       ksys_ioctl+0x5e/0x90
       __x64_sys_ioctl+0x3d/0x50
       do_syscall_64+0x74/0xe0
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Freed by task 22:
       save_stack+0x1b/0x80
       __kasan_slab_free+0x12c/0x170
       kfree+0xfd/0x3a0
       xhci_giveback_urb_in_irq+0xfe/0x230
       xhci_td_cleanup+0x276/0x340
       xhci_irq+0x1129/0x3720
       __handle_irq_event_percpu+0x6e/0x420
       handle_irq_event_percpu+0x6f/0x100
       handle_irq_event+0x55/0x84
       handle_edge_irq+0x108/0x3b0
       handle_irq+0x2e/0x40
       do_IRQ+0x83/0x1a0
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarSean Young <sean@mess.org>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      abf389e0
    • Alan Stern's avatar
      USB: usbcore: Fix slab-out-of-bounds bug during device reset · 77d4e2a0
      Alan Stern authored
      commit 3dd550a2 upstream.
      
      The syzbot fuzzer provoked a slab-out-of-bounds error in the USB core:
      
      BUG: KASAN: slab-out-of-bounds in memcmp+0xa6/0xb0 lib/string.c:904
      Read of size 1 at addr ffff8881d175bed6 by task kworker/0:3/2746
      
      CPU: 0 PID: 2746 Comm: kworker/0:3 Not tainted 5.3.0-rc5+ #28
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
      Google 01/01/2011
      Workqueue: usb_hub_wq hub_event
      Call Trace:
        __dump_stack lib/dump_stack.c:77 [inline]
        dump_stack+0xca/0x13e lib/dump_stack.c:113
        print_address_description+0x6a/0x32c mm/kasan/report.c:351
        __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
        kasan_report+0xe/0x12 mm/kasan/common.c:612
        memcmp+0xa6/0xb0 lib/string.c:904
        memcmp include/linux/string.h:400 [inline]
        descriptors_changed drivers/usb/core/hub.c:5579 [inline]
        usb_reset_and_verify_device+0x564/0x1300 drivers/usb/core/hub.c:5729
        usb_reset_device+0x4c1/0x920 drivers/usb/core/hub.c:5898
        rt2x00usb_probe+0x53/0x7af
      drivers/net/wireless/ralink/rt2x00/rt2x00usb.c:806
      
      The error occurs when the descriptors_changed() routine (called during
      a device reset) attempts to compare the old and new BOS and capability
      descriptors.  The length it uses for the comparison is the
      wTotalLength value stored in BOS descriptor, but this value is not
      necessarily the same as the length actually allocated for the
      descriptors.  If it is larger the routine will call memcmp() with a
      length that is too big, thus reading beyond the end of the allocated
      region and leading to this fault.
      
      The kernel reads the BOS descriptor twice: first to get the total
      length of all the capability descriptors, and second to read it along
      with all those other descriptors.  A malicious (or very faulty) device
      may send different values for the BOS descriptor fields each time.
      The memory area will be allocated using the wTotalLength value read
      the first time, but stored within it will be the value read the second
      time.
      
      To prevent this possibility from causing any errors, this patch
      modifies the BOS descriptor after it has been read the second time:
      It sets the wTotalLength field to the actual length of the descriptors
      that were read in and validated.  Then the memcpy() call, or any other
      code using these descriptors, will be able to rely on wTotalLength
      being valid.
      
      Reported-and-tested-by: syzbot+35f4d916c623118d576e@syzkaller.appspotmail.com
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      CC: <stable@vger.kernel.org>
      Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1909041154260.1722-100000@iolanthe.rowland.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      77d4e2a0
    • Aneesh Kumar K.V's avatar
      powerpc/mm/radix: Use the right page size for vmemmap mapping · b01b1eb2
      Aneesh Kumar K.V authored
      commit 89a3496e upstream.
      
      We use mmu_vmemmap_psize to find the page size for mapping the vmmemap area.
      With radix translation, we are suboptimally setting this value to PAGE_SIZE.
      
      We do check for 2M page size support and update mmu_vmemap_psize to use
      hugepage size but we suboptimally reset the value to PAGE_SIZE in
      radix__early_init_mmu(). This resulted in always mapping vmemmap area with
      64K page size.
      
      Fixes: 2bfd65e4 ("powerpc/mm/radix: Add radix callbacks for early init routines")
      Signed-off-by: default avatarAneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b01b1eb2
    • Benjamin Tissoires's avatar
      Input: elan_i2c - remove Lenovo Legion Y7000 PnpID · 289f3c82
      Benjamin Tissoires authored
      commit 0c043d70 upstream.
      
      Looks like the Bios of the Lenovo Legion Y7000 is using ELAN061B
      when the actual device is supposed to be used with hid-multitouch.
      
      Remove it from the list of the supported device, hoping that
      no one will complain about the loss in functionality.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=203467
      Fixes: 738c06d0 ("Input: elan_i2c - add hardware ID for multiple Lenovo laptops")
      Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      289f3c82
    • Leon Romanovsky's avatar
      RDMA/restrack: Release task struct which was hold by CM_ID object · 305c3b49
      Leon Romanovsky authored
      commit ed7a01fd upstream.
      
      Tracking CM_ID resource is performed in two stages: creation of cm_id
      and connecting it to the cma_dev. It is needed because rdma-cm protocol
      exports two separate user-visible calls rdma_create_id and rdma_accept.
      
      At the time of CM_ID creation, the real owner of that object is unknown
      yet and we need to grab task_struct. This task_struct is released or
      reassigned in attach phase later on. but call to rdma_destroy_id left
      this task_struct unreleased.
      
      Such separation is unique to CM_ID and other restrack objects initialize
      in one shot. It means that it is safe to use "res->valid" check to catch
      unfinished CM_ID flow and release task_struct for that object.
      
      Fixes: 00313983 ("RDMA/nldev: provide detailed CM_ID information")
      Reported-by: default avatarArtemy Kovalyov <artemyko@mellanox.com>
      Reviewed-by: default avatarArtemy Kovalyov <artemyko@mellanox.com>
      Reviewed-by: default avatarYossi Itigin <yosefe@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
      Reviewed-by: default avatarSteve Wise <swise@opengridcomputing.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      Cc: Håkon Bugge <haakon.bugge@oracle.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      305c3b49
    • Aaron Armstrong Skomra's avatar
      HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report · 8993c673
      Aaron Armstrong Skomra authored
      commit 184eccd4 upstream.
      
      In the generic code path, HID_DG_CONTACTMAX was previously
      only read from the second byte of report 0x23.
      
      Another report (0x82) has the HID_DG_CONTACTMAX in the
      higher nibble of the third byte. We should support reading the
      value of HID_DG_CONTACTMAX no matter what report we are reading
      or which position that value is in.
      
      To do this we submit the feature report as a event report
      using hid_report_raw_event(). Our modified finger event path
      records the value of HID_DG_CONTACTMAX when it sees that usage.
      
      Fixes: 8ffffd52 ("HID: wacom: fix timeout on probe for some wacoms")
      Signed-off-by: default avatarAaron Armstrong Skomra <aaron.skomra@wacom.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8993c673
    • Pablo Neira Ayuso's avatar
      netfilter: nf_flow_table: set default timeout after successful insertion · 2a0aa8a0
      Pablo Neira Ayuso authored
      commit 110e4872 upstream.
      
      Set up the default timeout for this new entry otherwise the garbage
      collector might quickly remove it right after the flowtable insertion.
      
      Fixes: ac2a6666 ("netfilter: add generic flow table infrastructure")
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2a0aa8a0
  2. 19 Sep, 2019 21 commits