Author	SHA1	Message	Date
Paul Moore	26d0b8dd3a	UPSTREAM: selinux: ensure the policy has been loaded before reading the sidtab stats ... Check to make sure we have loaded a policy before we query the sidtab's hash stats. Failure to do so could result in a kernel panic/oops due to a dereferenced NULL pointer. Fixes: 66f8e2f03c02 ("selinux: sidtab reverse lookup hash table") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Paul Moore <paul@paul-moore.com> (cherry picked from commit 15b590a81fcdd44ddcb4810f2a6334df8b6ca512) Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I9c9309341634ba0bdc6d151ec1ae4040a71dcd40	2020-11-14 16:56:33 +01:00
glider@google.com	1b6a6a2efe	UPSTREAM: security: allow using Clang's zero initialization for stack variables ... Upstream commit f0fe00d4972a8cd4b98cc2c29758615e4d51cdfe. In addition to -ftrivial-auto-var-init=pattern (used by CONFIG_INIT_STACK_ALL now) Clang also supports zero initialization for locals enabled by -ftrivial-auto-var-init=zero. The future of this flag is still being debated (see https://bugs.llvm.org/show_bug.cgi?id=45497). Right now it is guarded by another flag, -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang, which means it may not be supported by future Clang releases. Another possible resolution is that -ftrivial-auto-var-init=zero will persist (as certain users have already started depending on it), but the name of the guard flag will change. In the meantime, zero initialization has proven itself as a good production mitigation measure against uninitialized locals. Unlike pattern initialization, which has a higher chance of triggering existing bugs, zero initialization provides safe defaults for strings, pointers, indexes, and sizes. On the other hand, pattern initialization remains safer for return values. Chrome OS and Android are moving to using zero initialization for production builds. Performance-wise, the difference between pattern and zero initialization is usually negligible, although the generated code for zero initialization is more compact. This patch renames CONFIG_INIT_STACK_ALL to CONFIG_INIT_STACK_ALL_PATTERN and introduces another config option, CONFIG_INIT_STACK_ALL_ZERO, that enables zero initialization for locals if the corresponding flags are supported by Clang. Cc: Kees Cook <keescook@chromium.org> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Alexander Potapenko <glider@google.com> Link: https://lore.kernel.org/r/20200616083435.223038-1-glider@google.com Reviewed-by: Maciej Żenczykowski <maze@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I3c69570e7e3d3bbb666709de6feb531000bce2bf	2020-09-08 15:12:44 +00:00
Greg Kroah-Hartman	c0b1779755	This is the 5.4.59 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl88xTwACgkQONu9yGCS aT60Lw/9HV3JZ0KDYKHRRS/n4UWh2w7jHe5hwFTfX8/KibexzGzgV3gTaXsyQx75 Bj2ruJTGZKDvy+a9/IsjTe1v1/HPwPydDyfABNl/Rn8vQuyHzyyGzQo2owqGb57w 4wVuoqhPASn0n2QAMG05caAx1uqPlXcT/I4H8vpzieNEHbB/2TbwFiWvrDC2d+nw mw1PkRmaFp2GSMOHSb68n2oYUv19EBHDtxF9WkwyftdKALQYz5x4O/n4lhpzMSmO OeiUg/dpLi0bptL1SQAfaY/Lxa1gFb62YvP47WbWp/P6zespOInk2n8kmpoHxol3 MMZelRCdl9NtIKVXMEOFEv/asXPlF2wARGmNejGCYLaRqal1bH67yG4eja7biIJe gr5OBOFVPol83sPAnb6V4P2SEs650WR95hshYpRL9lbmcHY4q5zoXVm9ul/Hp49R qjjfxHDNQQoQgX4ZhEJLp2a5AEJUM4Kz28pZXHyczKYc2R6/AZWqHfnbQVURf+au 0xJ/tOFxn3yqRtTkmuuifkZcUTJ5iRnzxUUYiGyhTqZOTNZTD0FgiI+S7gckI//K idoWGTszHZb6YkNBEwz4WJFtxCGpO95xgD95jOpJVxFcJ5f5PpfZE7RkXUDLR5UO XzJopB3nOT1h3EoI3xq7aPDF1hKbkp+VRMWcVrBeP9KgcpLisS4= =Tk2c -----END PGP SIGNATURE----- Merge 5.4.59 into android11-5.4 Changes in 5.4.59 tracepoint: Mark __tracepoint_string's __used HID: input: Fix devices that return multiple bytes in battery report nvme: add a Identify Namespace Identification Descriptor list quirk fs/io_uring.c: Fix uninitialized variable is referenced in io_submit_sqe clk: qcom: clk-rpmh: Wait for completion when enabling clocks x86/mce/inject: Fix a wrong assignment of i_mce.status sched/fair: Fix NOHZ next idle balance sched: correct SD_flags returned by tl->sd_flags() arm64: dts: rockchip: fix rk3368-lion gmac reset gpio arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio arm64: dts: rockchip: fix rk3399-puma gmac reset gpio EDAC: Fix reference count leaks crc-t10dif: Fix potential crypto notify dead-lock arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property blktrace: fix debugfs use after free crypto: ccree - fix resource leak on error path ARM: exynos: MCPM: Restore big.LITTLE cpuidle support firmware: arm_scmi: Fix SCMI genpd domain probing arm64: dts: exynos: Fix silent hang after boot on Espresso sched/uclamp: Fix initialization of struct uclamp_rq clk: scmi: Fix min and max rate when registering clocks with discrete rates m68k: mac: Don't send IOP message until channel is idle m68k: mac: Fix IOP status/control register writes platform/x86: intel-hid: Fix return value check in check_acpi_dev() platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() ARM: dts: gose: Fix ports node name for adv7180 ARM: dts: gose: Fix ports node name for adv7612 ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() ARM: dts: sunxi: bananapi-m2-plus-v1.2: Add regulator supply to all CPU cores ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages spi: lantiq: fix: Rx overflow error in full duplex mode tpm: Require that all digests are present in TCG_PCR_EVENT2 structures recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64. regulator: fix memory leak on error path of regulator_register() io_uring: fix sq array offset calculation spi: rockchip: Fix error in SPI slave pio read ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() iocost: Fix check condition of iocg abs_vdebt irqchip/ti-sci-inta: Fix return value about devm_ioremap_resource() seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID md: raid0/linear: fix dereference before null check on pointer mddev nvme-tcp: fix controller reset hang during traffic nvme-rdma: fix controller reset hang during traffic nvme-multipath: fix logic for non-optimized paths nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths drm/tilcdc: fix leak & null ref in panel_connector_get_modes soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag Bluetooth: add a mutex lock to avoid UAF in do_enale_set loop: be paranoid on exit and prevent new additions / removals fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls drm/amdgpu: avoid dereferencing a NULL pointer drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync crypto: aesni - Fix build with LLVM_IAS=1 video: fbdev: savage: fix memory leak on error handling path in probe video: fbdev: neofb: fix memory leak in neo_scan_monitor() bus: ti-sysc: Add missing quirk flags for usb_host_hs md-cluster: fix wild pointer of unlock_all_bitmaps() drm/nouveau/kms/nv50-: Fix disabling dithering arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding drm/etnaviv: fix ref count leak via pm_runtime_get_sync drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek drm/nouveau: fix multiple instances of reference count leaks mmc: sdhci-cadence: do not use hardware tuning for SD mode btrfs: fix lockdep splat from btrfs_dump_space_info usb: mtu3: clear dual mode of u3port when disable device drm: msm: a6xx: fix gpu failure after system resume drm/msm: Fix a null pointer access in msm_gem_shrinker_count() drm/debugfs: fix plain echo to connector "force" attribute drm/radeon: disable AGP by default irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls drm/amdgpu/display bail early in dm_pp_get_static_clocks drm/amd/powerplay: fix compile error with ARCH=arc bpf: Fix fds_example SIGSEGV error brcmfmac: keep SDIO watchdog running when console_interval is non-zero brcmfmac: To fix Bss Info flag definition Bug brcmfmac: set state of hanger slot to FREE when flushing PSQ platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and G15 iwlegacy: Check the return value of pcie_capability_read_*() gpu: host1x: debug: Fix multiple channels emitting messages simultaneously ionic: update eid test for overflow mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1 usb: gadget: net2280: fix memory leak on probe error handling paths bdc: Fix bug causing crash after multiple disconnects usb: bdc: Halt controller on suspend dyndbg: fix a BUG_ON in ddebug_describe_flags bcache: fix super block seq numbers comparision in register_cache_set() ACPICA: Do not increment operation_region reference counts for field units drm/msm: ratelimit crtc event overflow error drm/gem: Fix a leak in drm_gem_objects_lookup() drm/bridge: ti-sn65dsi86: Clear old error bits before AUX transfers agp/intel: Fix a memory leak on module initialisation failure mwifiex: Fix firmware filename for sd8977 chipset mwifiex: Fix firmware filename for sd8997 chipset btmrvl: Fix firmware filename for sd8977 chipset btmrvl: Fix firmware filename for sd8997 chipset video: fbdev: sm712fb: fix an issue about iounmap for a wrong address console: newport_con: fix an issue about leak related system resources video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call ath10k: Acquire tx_lock in tx error paths iio: improve IIO_CONCENTRATION channel type description drm/etnaviv: Fix error path on failure to enable bus clk drm/arm: fix unintentional integer overflow on left shift clk: bcm63xx-gate: fix last clock availability leds: lm355x: avoid enum conversion warning Bluetooth: btusb: fix up firmware download sequence Bluetooth: btmtksdio: fix up firmware download sequence media: cxusb-analog: fix V4L2 dependency media: marvell-ccic: Add missed v4l2_async_notifier_cleanup() media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() ASoC: SOF: nocodec: add missing .owner field ASoC: Intel: bxt_rt298: add missing .owner field scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline cxl: Fix kobject memleak drm/radeon: fix array out-of-bounds read and write issues staging: vchiq_arm: Add a matching unregister call iavf: fix error return code in iavf_init_get_resources() iavf: Fix updating statistics RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() scsi: powertec: Fix different dev_id between request_irq() and free_irq() scsi: eesox: Fix different dev_id between request_irq() and free_irq() ipvs: allow connection reuse for unconfirmed conntrack media: firewire: Using uninitialized values in node_probe() media: exynos4-is: Add missed check for pinctrl_lookup_state() media: cros-ec-cec: do not bail on device_init_wakeup failure xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork xfs: fix reflink quota reservation accounting error RDMA/rxe: Skip dgid check in loopback mode PCI: Fix pci_cfg_wait queue locking problem drm/stm: repair runtime power management kobject: Avoid premature parent object freeing in kobject_cleanup() leds: core: Flush scheduled work for system suspend drm: panel: simple: Fix bpc for LG LB070WV8 panel phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY drm/bridge: sil_sii8620: initialize return of sii8620_readb scsi: scsi_debug: Add check for sdebug_max_queue during module init mwifiex: Prevent memory corruption handling keys kernfs: do not call fsnotify() with name without a parent powerpc/rtas: don't online CPUs for partition suspend powerpc/vdso: Fix vdso cpu truncation RDMA/qedr: SRQ's bug fixes RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue ima: Have the LSM free its audit rule staging: rtl8192u: fix a dubious looking mask before a shift ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback PCI/ASPM: Add missing newline in sysfs 'policy' phy: renesas: rcar-gen3-usb2: move irq registration to init powerpc/book3s64/pkeys: Use PVR check instead of cpu feature drm/imx: fix use after free drm/imx: tve: fix regulator_disable error path gpu: ipu-v3: Restore RGB32, BGR32 spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM USB: serial: iuu_phoenix: fix led-activity helpers usb: core: fix quirks_param_set() writing to a const pointer thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor() coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb() powerpc/perf: Fix missing is_sier_aviable() during build mt76: mt7615: fix potential memory leak in mcu message handler phy: armada-38x: fix NETA lockup when repeatedly switching speeds MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init() usb: dwc2: Fix error path in gadget registration usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength scsi: megaraid_sas: Clear affinity hint scsi: mesh: Fix panic after host or bus reset net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration macintosh/via-macii: Access autopoll_devs when inside lock PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register RDMA/core: Fix return error value in _ib_modify_qp() to negative Smack: fix another vsscanf out of bounds Smack: prevent underflow in smk_set_cipso() power: supply: check if calc_soc succeeded in pm860x_init_battery Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags Bluetooth: hci_serdev: Only unregister device if it was registered net: dsa: rtl8366: Fix VLAN semantics net: dsa: rtl8366: Fix VLAN set-up xfs: fix inode allocation block res calculation precedence selftests/powerpc: Squash spurious errors due to device removal powerpc/32s: Fix CONFIG_BOOK3S_601 uses powerpc/boot: Fix CONFIG_PPC_MPC52XX references selftests/powerpc: Fix CPU affinity for child process RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP PCI: Release IVRS table in AMD ACS quirk cpufreq: ap806: fix cpufreq driver needs ap cpu clk selftests/powerpc: Fix online CPU selection ASoC: meson: axg-tdm-interface: fix link fmt setup ASoC: meson: axg-tdmin: fix g12a skew ASoC: meson: axg-tdm-formatters: fix sclk inversion ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK s390/qeth: don't process empty bridge port events ice: Graceful error handling in HW table calloc failure rtw88: fix LDPC field for RA info rtw88: fix short GI capability based on current bandwidth rtw88: coex: only skip coex triggered by BT info wl1251: fix always return 0 error tools, build: Propagate build failures from tools/build/Makefile.build tools, bpftool: Fix wrong return value in do_dump() net/mlx5: DR, Change push vlan action sequence net/mlx5: Delete extra dump stack that gives nothing net: ethernet: aquantia: Fix wrong return value liquidio: Fix wrong return value in cn23xx_get_pf_num() net: spider_net: Fix the size used in a 'dma_free_coherent()' call fsl/fman: use 32-bit unsigned integer fsl/fman: fix dereference null return value fsl/fman: fix unreachable code fsl/fman: check dereferencing null pointer fsl/fman: fix eth hash table allocation net: thunderx: initialize VF's mailbox mutex before first usage dlm: Fix kobject memleak ocfs2: fix unbalanced locking pinctrl-single: fix pcs_parse_pinconf() return value svcrdma: Fix page leak in svc_rdma_recv_read_chunk() SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task crypto: aesni - add compatibility with IAS af_packet: TPACKET_V3: fix fill status rwlock imbalance drivers/net/wan/lapbether: Added needed_headroom and a skb->len check net: Fix potential memory leak in proto_register() net/nfc/rawsock.c: add CAP_NET_RAW check. net: phy: fix memory leak in device-create error path net: Set fput_needed iff FDPUT_FPUT is set net/tls: Fix kmap usage tcp: correct read of TFO keys on big endian systems vmxnet3: use correct tcp hdr length when packet is encapsulated net: refactor bind_bucket fastreuse into helper net: initialize fastreuse on inet_inherit_port USB: serial: cp210x: re-enable auto-RTS on open USB: serial: cp210x: enable usb generic throttle/unthrottle ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 9p: Fix memory leak in v9fs_mount media: media-request: Fix crash if memory allocation fails drm/ttm/nouveau: don't call tt destroy callback on alloc failure. io_uring: set ctx sq/cq entry count earlier NFS: Don't move layouts to plh_return_segs list while in use NFS: Don't return layout segments that are in use cpufreq: Fix locking issues with governors cpufreq: dt: fix oops on armada37xx include/asm-generic/vmlinux.lds.h: align ro_after_init spi: spidev: Align buffers for DMA mtd: rawnand: qcom: avoid write to unavailable register erofs: fix extended inode could cross boundary Revert "parisc: Drop LDCW barrier in CAS code when running UP" Revert "parisc: Use ldcw instruction for SMP spinlock release barrier" Revert "parisc: Revert "Release spinlocks using ordered store"" parisc: Do not use an ordered store in pa_tlb_lock() parisc: Implement __smp_store_release and __smp_load_acquire barriers parisc: mask out enable and reserved bits from sba imask ARM: 8992/1: Fix unwind_frame for clang-built kernels irqdomain/treewide: Free firmware node after domain removal ALSA: usb-audio: add quirk for Pioneer DDJ-RB tpm: Unify the mismatching TPM space buffer sizes pstore: Fix linking when crypto API disabled crypto: hisilicon - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified crypto: qat - fix double free in qat_uclo_create_batch_init_list crypto: ccp - Fix use of merged scatterlists crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified bitfield.h: don't compile-time validate _val in FIELD_FIT fs/minix: check return value of sb_getblk() fs/minix: don't allow getting deleted inodes fs/minix: reject too-large maximum file size xen/balloon: fix accounting in alloc_xenballooned_pages error path xen/balloon: make the balloon wait interruptible xen/gntdev: Fix dmabuf import with non-zero sgt offset s390/dasd: fix inability to use DASD with DIAG driver s390/gmap: improve THP splitting io_uring: Fix NULL pointer dereference in loop_rw_iter() Linux 5.4.59 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4bc685ec9234d8f72a9c66ee2d509a2975f6d711	2020-08-19 08:40:57 +02:00
Dan Carpenter	b2b8438ed8	Smack: prevent underflow in smk_set_cipso() ... [ Upstream commit 42a2df3e829f3c5562090391b33714b2e2e5ad4a ] We have an upper bound on "maplevel" but forgot to check for negative values. Fixes: e114e47377 ("Smack: Simplified Mandatory Access Control Kernel") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-08-19 08:16:16 +02:00
Dan Carpenter	674992659a	Smack: fix another vsscanf out of bounds ... [ Upstream commit a6bd4f6d9b07452b0b19842044a6c3ea384b0b88 ] This is similar to commit 84e99e58e8d1 ("Smack: slab-out-of-bounds in vsscanf") where we added a bounds check on "rule". Reported-by: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com Fixes: f7112e6c9a ("Smack: allow for significantly longer Smack labels v4") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-08-19 08:16:16 +02:00
Tyler Hicks	2092075629	ima: Have the LSM free its audit rule ... [ Upstream commit 9ff8a616dfab96a4fa0ddd36190907dc68886d9b ] Ask the LSM to free its audit rule rather than directly calling kfree(). Both AppArmor and SELinux do additional work in their audit_rule_free() hooks. Fix memory leaks by allowing the LSMs to perform necessary work. Fixes: b169424551 ("ima: use the lsm policy update notifier") Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com> Cc: Janne Karhunen <janne.karhunen@gmail.com> Cc: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-08-19 08:16:12 +02:00
Greg Kroah-Hartman	3a9b53bc89	This is the 5.4.58 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8ynngACgkQONu9yGCS aT5cPw/9GiiNZCLyjB3jVyalmN9uDYKQ+eS8H97GG7IBVYyg9whOKIrOCZHcLINH DV5s/qnhRWJPzmQ47410ySuPb6QMvkhWTK7i5Xf+K7BOvoz/snfFGcmdu1CA4KxR CuuH449Y4l3sH+5fPv7+EToovBqA2cfeiz/i5d5Di/N4yODWBCbHHAsZIt0oGvuK sI1aI1K//R7vKZQvQo85tvENbWJWQwDN7eYVQj3aSbvnq8JqVpwTKTBpKfshzgzB RmMSOVpQoQYNivW9oleG0NTQeHqj7alG8anFs3Drgu1hs5dzQhqAFlKddhtRS69j mtrSJuf0GgJEYA6n+PfacoM4l7kHUZcQH9+bglbCXTA3nH24DLT7h0Lybm+ETPXc ZAYo7cHqrS1BWv8VHZggSbqPr6YNKvgeflgS394wAgNEFcaJmaPfS6+elmc0qf2t VPSas7QQruRS1Bqwb6CF2tHsl4N+VdvxX1a2JjHHcF5N3z5aqDm1qaVVQHxAg2rE gXepFNGkEIBhWRxPz+5quxN1XBcUDiQYrzdoaKHxwY+OcdCf635P5Ob+1WK3w1oa qhl/2scs44D67wZSgXHo5N4vMi9HhPOSV77jklgFcg75IzM9YWwYnJADQRHxo7nT 25XEgUlMfxm0ngw+CZWR0ssaP6rB9V1rRLDqb1W5HbqA7lp2YE8= =Fe6H -----END PGP SIGNATURE----- Merge 5.4.58 into android11-5.4 Changes in 5.4.58 USB: serial: qcserial: add EM7305 QDL product ID perf/core: Fix endless multiplex timer USB: iowarrior: fix up report size handling for some devices usb: xhci: define IDs for various ASMedia host controllers usb: xhci: Fix ASMedia ASM1142 DMA addressing io_uring: prevent re-read of sqe->opcode io_uring: Fix use-after-free in io_sq_wq_submit_work() Revert "ALSA: hda: call runtime_allow() for all hda controllers" ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops ALSA: hda/ca0132 - Add new quirk ID for Recon3D. ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value. ALSA: hda/ca0132 - Fix AE-5 microphone selection commands. ALSA: seq: oss: Serialize ioctls staging: android: ashmem: Fix lockdep warning for write operation staging: rtl8712: handle firmware load failure Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() omapfb: dss: Fix max fclk divider for omap36xx binder: Prevent context manager from incrementing ref 0 Smack: fix use-after-free in smk_write_relabel_self() scripts: add dummy report mode to add_namespace.cocci vgacon: Fix for missing check in scrollback handling mtd: properly check all write ioctls for permissions leds: wm831x-status: fix use-after-free on unbind leds: lm36274: fix use-after-free on unbind leds: da903x: fix use-after-free on unbind leds: lm3533: fix use-after-free on unbind leds: 88pm860x: fix use-after-free on unbind net/9p: validate fds in p9_fd_open drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure nvme-pci: prevent SK hynix PC400 from using Write Zeroes command drm/drm_fb_helper: fix fbdev with sparc64 i2c: slave: improve sanity check when registering i2c: slave: add sanity check when unregistering usb: hso: check for return value in hso_serial_common_create() net: ethernet: mtk_eth_soc: Always call mtk_gmac0_rgmii_adjust() for mt7623 ALSA: hda: fix NULL pointer dereference during suspend firmware: Fix a reference count leak. cfg80211: check vendor command doit pointer before use igb: reinit_locked() should be called with rtnl_lock atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent tools lib traceevent: Fix memory leak in process_dynamic_array_len Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) xattr: break delegations in {set,remove}xattr Revert "powerpc/kasan: Fix shadow pages allocation failure" PCI: tegra: Revert tegra124 raw_violation_fixup ipv4: Silence suspicious RCU usage warning ipv6: fix memory leaks on IPV6_ADDRFORM path ipv6: Fix nexthop refcnt leak when creating ipv6 route info net: ethernet: mtk_eth_soc: fix MTU warnings rxrpc: Fix race between recvmsg and sendmsg on immediate call failure vxlan: Ensure FDB dump is performed under RCU net: lan78xx: replace bogus endpoint lookup appletalk: Fix atalk_proc_init() return path dpaa2-eth: Fix passing zero to 'PTR_ERR' warning hv_netvsc: do not use VF device if link is down net: gre: recompute gre csum for sctp over gre tunnels net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() openvswitch: Prevent kernel-infoleak in ovs_ct_put_key() Revert "vxlan: fix tos value before xmit" selftests/net: relax cpu affinity requirement in msg_zerocopy test tcp: apply a floor of 1 for RTT samples from TCP timestamps ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime nfsd: Fix NFSv4 READ on RDMA when using readv Linux 5.4.58 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0e89e2c0faf90bdf1f6ac37f9a2c2395cacab054	2020-08-11 18:37:58 +02:00
Bruno Meneguele	df6aeb5235	ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime ... commit 311aa6aafea446c2f954cc19d66425bfed8c4b0b upstream. The IMA_APPRAISE_BOOTPARAM config allows enabling different "ima_appraise=" modes - log, fix, enforce - at run time, but not when IMA architecture specific policies are enabled.  This prevents properly labeling the filesystem on systems where secure boot is supported, but not enabled on the platform.  Only when secure boot is actually enabled should these IMA appraise modes be disabled. This patch removes the compile time dependency and makes it a runtime decision, based on the secure boot state of that platform. Test results as follows: -> x86-64 with secure boot enabled [ 0.015637] Kernel command line: <...> ima_policy=appraise_tcb ima_appraise=fix [ 0.015668] ima: Secure boot enabled: ignoring ima_appraise=fix boot parameter option -> powerpc with secure boot disabled [ 0.000000] Kernel command line: <...> ima_policy=appraise_tcb ima_appraise=fix [ 0.000000] Secure boot mode disabled -> Running the system without secure boot and with both options set: CONFIG_IMA_APPRAISE_BOOTPARAM=y CONFIG_IMA_ARCH_POLICY=y Audit prompts "missing-hash" but still allow execution and, consequently, filesystem labeling: type=INTEGRITY_DATA msg=audit(07/09/2020 12:30:27.778:1691) : pid=4976 uid=root auid=root ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=appraise_data cause=missing-hash comm=bash name=/usr/bin/evmctl dev="dm-0" ino=493150 res=no Cc: stable@vger.kernel.org Fixes: d958083a8f ("x86/ima: define arch_get_ima_policy() for x86") Signed-off-by: Bruno Meneguele <bmeneg@redhat.com> Cc: stable@vger.kernel.org # 5.0 Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-08-11 15:33:41 +02:00
Eric Biggers	5f5fb7cea8	Smack: fix use-after-free in smk_write_relabel_self() ... commit beb4ee6770a89646659e6a2178538d2b13e2654e upstream. smk_write_relabel_self() frees memory from the task's credentials with no locking, which can easily cause a use-after-free because multiple tasks can share the same credentials structure. Fix this by using prepare_creds() and commit_creds() to correctly modify the task's credentials. Reproducer for "BUG: KASAN: use-after-free in smk_write_relabel_self": #include <fcntl.h> #include <pthread.h> #include <unistd.h> static void *thrproc(void *arg) { int fd = open("/sys/fs/smackfs/relabel-self", O_WRONLY); for (;;) write(fd, "foo", 3); } int main() { pthread_t t; pthread_create(&t, NULL, thrproc, NULL); thrproc(NULL); } Reported-by: syzbot+e6416dabb497a650da40@syzkaller.appspotmail.com Fixes: 38416e5393 ("Smack: limited capability for changing process label") Cc: <stable@vger.kernel.org> # v4.4+ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-08-11 15:33:35 +02:00
Greg Kroah-Hartman	171202d5b0	This is the 5.4.53 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8X674ACgkQONu9yGCS aT5F9g/+PdG5XSPhoGEhO2FW43cQKuGp5vWJ3IhVFyEXFdboWIa5laWNBh1ZC/Kg Ua0vxBGGJDTGZNTJAQd6Re1RfAbptEstrNlwC3BaxUQn5Qn4YQMCNbAeFEj7D2nw Tez3r3gjpGc9uo0EqfeJStqhFZfh+D3apHz1/RFZ/12T5d4dIEtCXDUAP89zib0w lHBOH37Mc0WqXSUPLdabIbemlbZv4prYn7gnzIeoxl3h+TKzdjM4pGjrjzKJwy2D 9XDB3Dw9BA225uoextJl3GCOm7IF+TGaR10YxuHCtxJAkdPSt2BUUAFC0XrV7KPw fGMy8/a8EZj5PoNNjKHzDD2IJf9PhLZgcn7AjOW6x9XXu7lJls4Wx4/k5TpIO1I1 paO8kGex8jk751X4U1Bu8LowLPjiL3fKp0lSeysSw9IIzTBW1DlhSR9Mf/CEihib xbS6k8/uF9HGtYJKIW4o/iL/3D0MGKTuOX18tlhnZ92Hp5WcAEZKrUKgYTY/exvF WDYDRSFv17tw6XT7Jfey3veP1z+3kVMZ3KD0CnpJ7poS/f8H730yyEgIDO0dRO3I Rd1r/uCmgr0GkeNDp46eoTYCgvhCQruxWul0/6/pw4VdzIBSRlPjsZBR+2Frnmuw dRim972ocnvVzxKe1N2fD+whfjok85h30Xg7uvFgZGEZ7/wOUL8= =mqst -----END PGP SIGNATURE----- Merge 5.4.53 into android11-5.4 Changes in 5.4.53 crypto: atmel - Fix selection of CRYPTO_AUTHENC crypto: atmel - Fix build error of CRYPTO_AUTHENC net: atlantic: fix ip dst and ipv6 address filters net: rmnet: fix lower interface leak bridge: mcast: Fix MLD2 Report IPv6 payload length check genetlink: remove genl_bind ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg ipv6: fib6_select_path can not use out path for nexthop objects ipv6: Fix use of anycast address with loopback l2tp: remove skb_dst_set() from l2tp_xmit_skb() llc: make sure applications use ARPHRD_ETHER net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb net: dsa: microchip: set the correct number of ports net_sched: fix a memory leak in atm_tc_init() net: usb: qmi_wwan: add support for Quectel EG95 LTE modem sched: consistently handle layer3 header accesses in the presence of VLANs tcp: fix SO_RCVLOWAT possible hangs under high mem pressure tcp: make sure listeners don't initialize congestion-control state tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key() tcp: md5: do not send silly options in SYNCOOKIES vlan: consolidate VLAN parsing code and limit max parsing depth tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers tcp: md5: allow changing MD5 keys in all socket states cgroup: fix cgroup_sk_alloc() for sk_clone_lock() cgroup: Fix sock_cgroup_data on big-endian. ip: Fix SO_MARK in RST, ACK and ICMP packets arm64: Introduce a way to disable the 32bit vdso arm64: arch_timer: Allow an workaround descriptor to disable compat vdso arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040 drm/msm: fix potential memleak in error branch drm/msm/dpu: allow initialization of encoder locks during encoder init drm/exynos: Properly propagate return value in drm_iommu_attach_device() drm/exynos: fix ref count leak in mic_pre_enable x86/fpu: Reset MXCSR to default in kernel_fpu_begin() thermal/drivers: imx: Fix missing of_node_put() at probe time blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags m68k: nommu: register start of the memory with memblock m68k: mm: fix node memblock init dt-bindings: mailbox: zynqmp_ipi: fix unit address cifs: prevent truncation from long to int in wait_for_free_credits arm64/alternatives: use subsections for replacement sequences tpm_tis: extra chip->ops check on error path in tpm_tis_core_init gfs2: read-only mounts should grab the sd_freeze_gl glock i2c: eg20t: Load module automatically if ID matches arm64/alternatives: don't patch up internal branches iio:magnetometer:ak8974: Fix alignment and data leak issues iio:humidity:hdc100x Fix alignment and data leak issues iio: magnetometer: ak8974: Fix runtime PM imbalance on error iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe() iio: pressure: zpa2326: handle pm_runtime_get_sync failure iio:humidity:hts221 Fix alignment and data leak issues iio:pressure:ms5611 Fix buffer element alignment iio:health:afe4403 Fix timestamp alignment and prevent data leak. spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer net: dsa: bcm_sf2: Fix node reference count of: of_mdio: Correct loop scanning logic net: macb: call pm_runtime_put_sync on failure path net: ethernet: mvneta: Do not error out in non serdes modes net: ethernet: mvneta: Add back interface mode validation Revert "usb/ohci-platform: Fix a warning when hibernating" Revert "usb/ehci-platform: Set PM runtime as active on resume" Revert "usb/xhci-plat: Set PM runtime as active on resume" net: sfp: add support for module quirks net: sfp: add some quirks for GPON modules ARM: OMAP4+: remove pdata quirks for omap4+ iommus ARM: OMAP2+: Add workaround for DRA7 DSP MStandby errata i879 ARM: OMAP2+: use separate IOMMU pdata to fix DRA7 IPU1 boot mmc: mmci: Support any block sizes for ux500v2 and qcom variant HID: quirks: Remove ITE 8595 entry from hid_have_special_driver ARM: at91: pm: add quirk for sam9x60's ulp1 drm/sun4i: tcon: Separate quirks for tcon0 and tcon1 on A20 scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled bus: ti-sysc: Rename clk related quirks to pre_reset and post_reset quirks bus: ti-sysc: Consider non-existing registers too when matching quirks bus: ti-sysc: Handle module unlock quirk needed for some RTC bus: ti-sysc: Detect display subsystem related devices arm64: dts: g12-common: add parkmode_disable_ss_quirk on DWC3 controller bus: ti-sysc: Detect EDMA and set quirk flags for tptc ALSA: usb-audio: Add support for MOTU MicroBook IIc Input: goodix - fix touch coordinates on Cube I15-TC ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp (0951:16d8) doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in park mode mmc: sdhci: do not enable card detect interrupt for gpio cd type ALSA: usb-audio: Rewrite registration quirk handling ACPI: video: Use native backlight on Acer Aspire 5783z ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha S ALSA: usb-audio: Add quirk for Focusrite Scarlett 2i2 Input: mms114 - add extra compatible for mms345l ACPI: video: Use native backlight on Acer TravelMate 5735Z bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S iio:health:afe4404 Fix timestamp alignment and prevent data leak. soundwire: intel: fix memory leak with devm_kasprintf dmaengine: sh: usb-dmac: set tx_result parameters phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked arm64: dts: meson: add missing gxl rng clock arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency bus: ti-sysc: Fix wakeirq sleeping function called from invalid context bus: ti-sysc: Fix sleeping function called from invalid context for RTC quirk bus: ti-sysc: Do not disable on suspend for no-idle iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()' dmaengine: dw: Initialize channel before each transfer dmaengine: dmatest: stop completed threads when running without set channel spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate usb: gadget: udc: atmel: fix uninitialized read in debug printk staging: comedi: verify array index is correct before using it clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER clk: AST2600: Add mux for EMMC clock NFS: Fix interrupted slots by sending a solo SEQUENCE operation fuse: don't ignore errors from fuse_writepages_fill() ARM: dts: Fix dcan driver probe failed on am437x platform Revert "thermal: mediatek: fix register index error" xprtrdma: fix incorrect header size calculations ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema arm64: dts: spcfpga: Align GIC, NAND and UART nodenames with dtschema keys: asymmetric: fix error return code in software_key_query() regmap: debugfs: Don't sleep while atomic for fast_io regmaps copy_xstate_to_kernel: Fix typo which caused GDB regression arm: dts: mt7623: add phy-mode property for gmac2 soc: qcom: socinfo: add missing soc_id sysfs entry apparmor: ensure that dfa state tables have entries habanalabs: Align protection bits configuration of all TPCs PCI/PM: Call .bridge_d3() hook only if non-NULL perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode soc: qcom: rpmh: Update dirty flag only when data changes soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request RDMA/mlx5: Verify that QP is created with RQ or SQ mtd: rawnand: marvell: Fix the condition on a return code mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered mtd: rawnand: marvell: Fix probe error path mtd: rawnand: timings: Fix default tR_max and tCCS_min timings mtd: rawnand: brcmnand: correctly verify erased pages mtd: rawnand: brcmnand: fix CS0 layout mtd: rawnand: oxnas: Keep track of registered devices mtd: rawnand: oxnas: Unregister all devices on error mtd: rawnand: oxnas: Release all devices in the _remove() path clk: qcom: gcc: Add GPU and NPU clocks for SM8150 clk: qcom: gcc: Add missing UFS clocks for SM8150 slimbus: core: Fix mismatch in of_node_get/put HID: logitech-hidpp: avoid repeated "multiplier = " log messages HID: magicmouse: do not set up autorepeat HID: quirks: Always poll Obins Anne Pro 2 keyboard HID: quirks: Ignore Simply Automated UPB PIM ALSA: line6: Perform sanity check for each URB creation ALSA: line6: Sync the pending work cancel at disconnection ALSA: usb-audio: Fix race against the error recovery URB submission ALSA: hda/realtek - change to suitable link model for ASUS platform ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534 ALSA: hda/realtek - Enable Speaker for ASUS UX563 USB: c67x00: fix use after free in c67x00_giveback_urb usb: dwc2: Fix shutdown callback in platform usb: chipidea: core: add wakeup support for extcon usb: gadget: function: fix missing spinlock in f_uac1_legacy USB: serial: iuu_phoenix: fix memory corruption USB: serial: cypress_m8: enable Simply Automated UPB PIM USB: serial: ch341: add new Product ID for CH340 USB: serial: option: add GosunCn GM500 series USB: serial: option: add Quectel EG95 LTE modem virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream virt: vbox: Fix guest capabilities mask check Revert "tty: xilinx_uartps: Fix missing id assignment to the console" virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial serial: mxs-auart: add missed iounmap() in probe failure and remove ovl: fix regression with re-formatted lower squashfs ovl: inode reference leak in ovl_is_inuse true case. ovl: relax WARN_ON() when decoding lower directory file handle ovl: fix unneeded call to ovl_change_flags() fuse: ignore 'data' argument of mount(..., MS_REMOUNT) fuse: use ->reconfigure() instead of ->remount_fs() fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()" mei: bus: don't clean driver pointer Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list Input: elan_i2c - add more hardware ID for Lenovo laptops uio_pdrv_genirq: Remove warning when irq is not specified uio_pdrv_genirq: fix use without device tree and no interrupt scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro timer: Prevent base->clk from moving backward timer: Fix wheel index calculation on last level riscv: use 16KB kernel stack on 64-bit hwmon: (emc2103) fix unable to change fan pwm1_enable attribute powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey powerpc/pseries/svm: Fix incorrect check for shared_lppaca_size intel_th: pci: Add Jasper Lake CPU support intel_th: pci: Add Tiger Lake PCH-H support intel_th: pci: Add Emmitsburg PCH support intel_th: Fix a NULL dereference when hub driver is not loaded dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler dmaengine: mcf-edma: Fix NULL pointer exception in mcf_edma_tx_handler dmaengine: fsl-edma-common: correct DSIZE_32BYTE misc: atmel-ssc: lock with mutex instead of spinlock thermal: int3403_thermal: Downgrade error message thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power arm64: ptrace: Override SPSR.SS when single-stepping is enabled arm64: ptrace: Consistently use pseudo-singlestep exceptions arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return sched: Fix unreliable rseq cpu_id for new tasks sched/fair: handle case of task_h_load() returning 0 genirq/affinity: Handle affinity setting on inactive interrupts correctly drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr() drm/i915/gt: Ignore irq enabling on the virtual engines block: fix splitting segments on boundary masks block: fix get_max_segment_size() overflow on 32bit arch libceph: don't omit recovery_deletes in target_copy() rxrpc: Fix trace string spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH ionic: export features for vlans to use iommu/vt-d: Make Intel SVM code 64-bit only drm/i915/gvt: Fix two CFL MMIO handling caused by regression. gpio: pca953x: disable regmap locking for automatic address incrementing Linux 5.4.53 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2347f0f12d1e95a90cff2f3999940e1f82231df2	2020-07-23 12:36:54 +02:00
John Johansen	d79e57db45	apparmor: ensure that dfa state tables have entries ... commit c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c upstream. Currently it is possible to specify a state machine table with 0 length, this is not valid as optional tables are specified by not defining the table as present. Further this allows by-passing the base tables range check against the next/check tables. Fixes: d901d6a298 ("apparmor: dfa split verification of table headers") Reported-by: Mike Salvatore <mike.salvatore@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-07-22 09:33:05 +02:00
Greg Kroah-Hartman	90dbaed65a	This is the 5.4.49 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7zdl0ACgkQONu9yGCS aT4fAg/7Bg+JHOdJpdSb4FLMjpWHnjOMJ4ICMEfEPS9vJR41HpAaC8LdI3PBZdOZ ujEdX3ia1p3N/bnnHwVPFaycWQ6Z9TItoj6gzCLqjzVzdKJKXEx8uQFY0KWt+w4R 0orn1acd+bqMLhnRrJqMEhmRG3Y6IrkWXYr/qDC6OuZDgigtHC46mX0IdQiUomFd As9x1cr6+j27zOf8iwyNNXWo5AL2VFR7zDhlfR+sllN6Tn90AhumFoES8GL+ylfu OybF5LH4l9gOiFwvI7gTeihJoJOyh/cKP0glnDzRIZVIFv96At3cDt5GiRxkqbYw u1bo5X5xPxJogN9SLUi4O6pnrmQmuK27zJcI43TDfdRguSzXWzZclyNQ9d3zqmvJ QCmCsQkZst4K4SGg4UE2Wb6Gi51lsmV4OKll7eh61I87e8J7t7r8I5HRDdNCLzuf 3biqYn8f6307ME59fniVlQSynMt8B9lxyTS6hkYN/iCf753jHKdJRy97JcXugiCo DUoMCNchLDg5LH9TWq6k96rCklaVGPkp8HO/davMAc5Xn+YgPqE/ZpO7hH0nCLBE Fc0bvddiebXI5NrxIXu20vajQWi5YuVw5JWUBvcK6aONluwRomCvTIPRT1SZZiaK 5Cm5lyDGK3yYC0Dz++QzATVtNEOAkUOWgLpgOenrUVPtCtgDOrk= =cQWB -----END PGP SIGNATURE----- Merge 5.4.49 into android-5.4-stable Changes in 5.4.49 power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select clk: sunxi: Fix incorrect usage of round_down() ASoC: tegra: tegra_wm8903: Support nvidia, headset property i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets ASoC: SOF: imx8: Fix randbuild error iio: pressure: bmp280: Tolerate IRQ before registering remoteproc: Fix IDR initialisation in rproc_alloc() clk: qcom: msm8916: Fix the address location of pll->config_reg ASoC: fsl_esai: Disable exception interrupt before scheduling tasklet backlight: lp855x: Ensure regulators are disabled on probe failure ARM: dts: renesas: Fix IOMMU device node names ASoC: davinci-mcasp: Fix dma_chan refcnt leak when getting dma type ARM: integrator: Add some Kconfig selections ARM: dts: stm32: Add missing ethernet PHY reset on AV96 scsi: core: free sgtables in case command setup fails scsi: qedi: Check for buffer overflow in qedi_set_path() arm64: dts: meson: fixup SCP sram nodes ALSA: hda/realtek - Introduce polarity for micmute LED GPIO ALSA: isa/wavefront: prevent out of bounds write in ioctl PCI: Allow pci_resize_resource() for devices on root bus scsi: qla2xxx: Fix issue with adapter's stopping state Input: edt-ft5x06 - fix get_default register write access powerpc/kasan: Fix stack overflow by increasing THREAD_SHIFT rtc: mc13xxx: fix a double-unlock issue iio: bmp280: fix compensation of humidity f2fs: report delalloc reserve as non-free in statfs for project quota i2c: pxa: clear all master action bits in i2c_pxa_stop_message() remoteproc: qcom_q6v5_mss: map/unmap mpss segments before/after use clk: samsung: Mark top ISP and CAM clocks on Exynos542x as critical usblp: poison URBs upon disconnect serial: 8250: Fix max baud limit in generic 8250 port misc: fastrpc: Fix an incomplete memory release in fastrpc_rpmsg_probe() misc: fastrpc: fix potential fastrpc_invoke_ctx leak dm mpath: switch paths in dm_blk_ioctl() code path arm64: dts: armada-3720-turris-mox: forbid SDR104 on SDIO for FCC purposes arm64: dts: armada-3720-turris-mox: fix SFP binding arm64: dts: juno: Fix GIC child nodes pinctrl: ocelot: Fix GPIO interrupt decoding on Jaguar2 clk: renesas: cpg-mssr: Fix STBCR suspend/resume handling ASoC: SOF: Do nothing when DSP PM callbacks are not set arm64: dts: fvp: Fix GIC child nodes PCI: aardvark: Don't blindly enable ASPM L0s and don't write to read-only register ps3disk: use the default segment boundary arm64: dts: fvp/juno: Fix node address fields vfio/pci: fix memory leaks in alloc_perm_bits() coresight: tmc: Fix TMC mode read in tmc_read_prepare_etb() RDMA/mlx5: Add init2init as a modify command scsi: hisi_sas: Do not reset phy timer to wait for stray phy up PCI: pci-bridge-emul: Fix PCIe bit conflicts m68k/PCI: Fix a memory leak in an error handling path gpio: dwapb: Call acpi_gpiochip_free_interrupts() on GPIO chip de-registration usb: gadget: core: sync interrupt before unbind the udc powerpc/ptdump: Add _PAGE_COHERENT flag mfd: wm8994: Fix driver operation if loaded as modules scsi: cxgb3i: Fix some leaks in init_act_open() clk: zynqmp: fix memory leak in zynqmp_register_clocks scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event scsi: vhost: Notify TCM about the maximum sg entries supported per command clk: clk-flexgen: fix clock-critical handling IB/mlx5: Fix DEVX support for MLX5_CMD_OP_INIT2INIT_QP command powerpc/perf/hv-24x7: Fix inconsistent output values incase multiple hv-24x7 events run nfsd: Fix svc_xprt refcnt leak when setup callback client failed PCI: vmd: Filter resource type bits from shadow register RDMA/core: Fix several reference count leaks. cifs: set up next DFS target before generic_ip_connect() ASoC: qcom: q6asm-dai: kCFI fix powerpc/crashkernel: Take "mem=" option into account pwm: img: Call pm_runtime_put() in pm_runtime_get_sync() failed case sparc32: mm: Don't try to free page-table pages if ctor() fails yam: fix possible memory leak in yam_init_driver NTB: ntb_pingpong: Choose doorbells based on port number NTB: Fix the default port and peer numbers for legacy drivers mksysmap: Fix the mismatch of '.L' symbols in System.map apparmor: fix introspection of of task mode for unconfined tasks net: dsa: lantiq_gswip: fix and improve the unsupported interface error apparmor: check/put label on apparmor_sk_clone_security() f2fs: handle readonly filesystem in f2fs_ioc_shutdown() ASoC: meson: add missing free_irq() in error path bpf, sockhash: Fix memory leak when unlinking sockets in sock_hash_free scsi: sr: Fix sr_probe() missing deallocate of device minor scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM apparmor: fix nnp subset test for unconfined x86/purgatory: Disable various profiling and sanitizing options staging: greybus: fix a missing-check bug in gb_lights_light_config() arm64: dts: mt8173: fix unit name warnings scsi: qedi: Do not flush offload work if ARP not resolved arm64: dts: qcom: msm8916: remove unit name for thermal trip points ARM: dts: sun8i-h2-plus-bananapi-m2-zero: Fix led polarity RDMA/mlx5: Fix udata response upon SRQ creation gpio: dwapb: Append MODULE_ALIAS for platform driver scsi: qedf: Fix crash when MFW calls for protocol stats while function is still probing pinctrl: rza1: Fix wrong array assignment of rza1l_swio_entries virtiofs: schedule blocking async replies in separate worker arm64: dts: qcom: fix pm8150 gpio interrupts firmware: qcom_scm: fix bogous abuse of dma-direct internals staging: gasket: Fix mapping refcnt leak when put attribute fails staging: gasket: Fix mapping refcnt leak when register/store fails ALSA: usb-audio: Improve frames size computation ALSA: usb-audio: Fix racy list management in output queue s390/qdio: put thinint indicator after early error tty: hvc: Fix data abort due to race in hvc_open slimbus: ngd: get drvdata from correct device clk: meson: meson8b: Fix the first parent of vid_pll_in_sel clk: meson: meson8b: Fix the polarity of the RESET_N lines clk: meson: meson8b: Fix the vclk_div{1, 2, 4, 6, 12}_en gate bits gpio: pca953x: fix handling of automatic address incrementing thermal/drivers/ti-soc-thermal: Avoid dereferencing ERR_PTR clk: meson: meson8b: Don't rely on u-boot to init all GP_PLL registers ASoC: max98373: reorder max98373_reset() in resume soundwire: slave: don't init debugfs on device registration error HID: intel-ish-hid: avoid bogus uninitialized-variable warning usb: dwc3: gadget: Properly handle ClearFeature(halt) usb: dwc3: gadget: Properly handle failed kick_transfer staging: wilc1000: Increase the size of wid_list array staging: sm750fb: add missing case while setting FB_VISUAL PCI: v3-semi: Fix a memory leak in v3_pci_probe() error handling paths i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output serial: amba-pl011: Make sure we initialize the port.lock spinlock drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish PCI: rcar: Fix incorrect programming of OB windows PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges scsi: qla2xxx: Fix warning after FC target reset ALSA: firewire-lib: fix invalid assignment to union data for directional parameter power: supply: lp8788: Fix an error handling path in 'lp8788_charger_probe()' power: supply: smb347-charger: IRQSTAT_D is volatile ASoC: SOF: core: fix error return code in sof_probe_continue() arm64: dts: msm8996: Fix CSI IRQ types scsi: target: loopback: Fix READ with data and sensebytes scsi: mpt3sas: Fix double free warnings SoC: rsnd: add interrupt support for SSI BUSIF buffer ASoC: ux500: mop500: Fix some refcounted resources issues ASoC: ti: omap-mcbsp: Fix an error handling path in 'asoc_mcbsp_probe()' pinctrl: rockchip: fix memleak in rockchip_dt_node_to_map dlm: remove BUG() before panic() USB: ohci-sm501: fix error return code in ohci_hcd_sm501_drv_probe() clk: ti: composite: fix memory leak PCI: Fix pci_register_host_bridge() device_register() error handling powerpc/64: Don't initialise init_task->thread.regs tty: n_gsm: Fix SOF skipping tty: n_gsm: Fix waking up upper tty layer when room available ALSA: usb-audio: Add duplex sound support for USB devices using implicit feedback HID: Add quirks for Trust Panora Graphic Tablet PCI/PM: Assume ports without DLL Link Active train links in 100 ms habanalabs: increase timeout during reset ipmi: use vzalloc instead of kmalloc for user creation powerpc/64s/exception: Fix machine check no-loss idle wakeup powerpc/pseries/ras: Fix FWNMI_VALID off by one drivers: phy: sr-usb: do not use internal fsm for USB2 phy init powerpc/ps3: Fix kexec shutdown hang vfio-pci: Mask cap zero usb/ohci-platform: Fix a warning when hibernating drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation ASoC: Intel: bytcr_rt5640: Add quirk for Toshiba Encore WT8-A tablet USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe() tty: n_gsm: Fix bogus i++ in gsm_data_kick fpga: dfl: afu: Corrected error handling levels clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1 RDMA/hns: Bugfix for querying qkey RDMA/hns: Fix cmdq parameter of querying pf timer resource scsi: target: tcmu: Userspace must not complete queued commands firmware: imx: scu: Fix possible memory leak in imx_scu_probe() fuse: fix copy_file_range cache issues fuse: copy_file_range should truncate cache arm64: tegra: Fix ethernet phy-mode for Jetson Xavier arm64: tegra: Fix flag for 64-bit resources in 'ranges' property powerpc/64s/pgtable: fix an undefined behaviour dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone PCI/PTM: Inherit Switch Downstream Port PTM settings from Upstream Port PCI: dwc: Fix inner MSI IRQ domain registration PCI: amlogic: meson: Don't use FAST_LINK_MODE to set up link IB/cma: Fix ports memory leak in cma_configfs watchdog: da9062: No need to ping manually before setting timeout usb: dwc2: gadget: move gadget resume after the core is in L0 state USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check usb: gadget: fix potential double-free in m66592_probe. usb: gadget: Fix issue with config_ep_by_speed function scripts: headers_install: Exit with error on config leak RDMA/iw_cxgb4: cleanup device debugfs entries on ULD remove x86/apic: Make TSC deadline timer detection message visible mfd: stmfx: Reset chip on resume as supply was disabled mfd: stmfx: Fix stmfx_irq_init error path mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt powerpc/32s: Don't warn when mapping RO data ROX. ASoC: fix incomplete error-handling in img_i2s_in_probe. scsi: target: tcmu: Fix a use after free in tcmu_check_expired_queue_cmd() clk: bcm2835: Fix return type of bcm2835_register_gate scsi: ufs-qcom: Fix scheduling while atomic issue KVM: PPC: Book3S HV: Ignore kmemleak false positives KVM: PPC: Book3S: Fix some RCU-list locks clk: sprd: return correct type of value for _sprd_pll_recalc_rate clk: ast2600: Fix AHB clock divider for A1 misc: xilinx-sdfec: improve get_user_pages_fast() error handling /dev/mem: Revoke mappings when a driver claims the region net: sunrpc: Fix off-by-one issues in 'rpc_ntop6' NFSv4.1 fix rpc_call_done assignment for BIND_CONN_TO_SESSION of: Fix a refcounting bug in __of_attach_node_sysfs() input: i8042 - Remove special PowerPC handling powerpc/4xx: Don't unmap NULL mbase extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()' ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed vfio/mdev: Fix reference count leak in add_mdev_supported_type rtc: rv3028: Add missed check for devm_regmap_init_i2c() mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe() rxrpc: Adjust /proc/net/rxrpc/calls to display call->debug_id not user_ID openrisc: Fix issue with argument clobbering for clone/fork drm/nouveau/disp/gm200-: fix NV_PDISP_SOR_HDMI2_CTRL(n) selection ceph: don't return -ESTALE if there's still an open file nfsd4: make drc_slab global, not per-net gfs2: Allow lock_nolock mount to specify jid=X scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj scsi: ufs: Don't update urgent bkops level when toggling auto bkops pinctrl: imxl: Fix an error handling path in 'imx1_pinctrl_core_probe()' pinctrl: freescale: imx: Fix an error handling path in 'imx_pinctrl_probe()' nfsd: safer handling of corrupted c_type drm/amd/display: Revalidate bandwidth before commiting DC updates crypto: omap-sham - add proper load balancing support for multicore geneve: change from tx_error to tx_dropped on missing metadata lib/zlib: remove outdated and incorrect pre-increment optimization include/linux/bitops.h: avoid clang shift-count-overflow warnings selftests/vm/pkeys: fix alloc_random_pkey() to make it really random blktrace: use errno instead of bi_status blktrace: fix endianness in get_pdu_int() blktrace: fix endianness for blk_log_remap() gfs2: fix use-after-free on transaction ail lists net: marvell: Fix OF_MDIO config check ntb_perf: pass correct struct device to dma_alloc_coherent ntb_tool: pass correct struct device to dma_alloc_coherent NTB: ntb_tool: reading the link file should not end in a NULL byte NTB: Revert the change to use the NTB device dev for DMA allocations NTB: perf: Don't require one more memory window than number of peers NTB: perf: Fix support for hardware that doesn't have port numbers NTB: perf: Fix race condition when run with ntb_test NTB: ntb_test: Fix bug when counting remote files i2c: icy: Fix build with CONFIG_AMIGA_PCMCIA=n drivers/perf: hisi: Fix wrong value for all counters enable selftests/net: in timestamping, strncpy needs to preserve null byte f2fs: don't return vmalloc() memory from f2fs_kmalloc() afs: Fix memory leak in afs_put_sysnames() ASoC: core: only convert non DPCM link to DPCM link ASoC: SOF: nocodec: conditionally set dpcm_capture/dpcm_playback flags ASoC: Intel: bytcr_rt5640: Add quirk for Toshiba Encore WT10-A tablet ASoC: rt5645: Add platform-data for Asus T101HA bpf/sockmap: Fix kernel panic at __tcp_bpf_recvmsg bpf, sockhash: Synchronize delete from bucket list on map free tracing/probe: Fix bpf_task_fd_query() for kprobes and uprobes drm/sun4i: hdmi ddc clk: Fix size of m divider libbpf: Handle GCC noreturn-turned-volatile quirk scsi: acornscsi: Fix an error handling path in acornscsi_probe() x86/idt: Keep spurious entries unset in system_vectors net/filter: Permit reading NET in load_bytes_relative when MAC not set nvme-pci: use simple suspend when a HMB is enabled nfs: set invalid blocks after NFSv4 writes xdp: Fix xsk_generic_xmit errno iavf: fix speed reporting over virtchnl bpf: Fix memlock accounting for sock_hash usb/xhci-plat: Set PM runtime as active on resume usb: host: ehci-platform: add a quirk to avoid stuck usb/ehci-platform: Set PM runtime as active on resume perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events() perf stat: Fix NULL pointer dereference ext4: stop overwrite the errcode in ext4_setup_super bcache: fix potential deadlock problem in btree_gc_coalesce powerpc: Fix kernel crash in show_instructions() w/DEBUG_VIRTUAL afs: Fix non-setting of mtime when writing into mmap afs: afs_write_end() should change i_size under the right lock afs: Fix EOF corruption afs: Always include dir in bulk status fetch from afs_do_lookup() afs: Set error flag rather than return error from file status decode afs: Fix the mapping of the UAEOVERFLOW abort code bnxt_en: Return from timer if interface is not in open state. scsi: ufs-bsg: Fix runtime PM imbalance on error block: Fix use-after-free in blkdev_get() mvpp2: remove module bugfix arm64: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints libata: Use per port sync for detach drm: encoder_slave: fix refcouting error for modules ext4: fix partial cluster initialization when splitting extent ext4: avoid utf8_strncasecmp() with unstable name drm/dp_mst: Reformat drm_dp_check_act_status() a bit drm/qxl: Use correct notify port address when creating cursor ring drm/amdgpu: Replace invalid device ID with a valid device ID selinux: fix double free jbd2: clean __jbd2_journal_abort_hard() and __journal_abort_soft() ext4: avoid race conditions when remounting with options that change dax drm/dp_mst: Increase ACT retry timeout to 3s drm/amd/display: Use swap() where appropriate x86/boot/compressed: Relax sed symbol type regex for LLVM ld.lld block: nr_sects_write(): Disable preemption on seqcount write net/mlx5: DR, Fix freeing in dr_create_rc_qp() f2fs: split f2fs_d_compare() from f2fs_match_name() f2fs: avoid utf8_strncasecmp() with unstable name s390: fix syscall_get_error for compat processes drm/i915: Fix AUX power domain toggling across TypeC mode resets drm/msm: Check for powered down HW in the devfreq callbacks drm/i915/gem: Avoid iterating an empty list drm/i915: Whitelist context-local timestamp in the gen9 cmdparser drm/connector: notify userspace on hotplug after register complete drm/amd/display: Use kvfree() to free coeff in build_regamma() drm/i915/icl+: Fix hotplug interrupt disabling after storm detection Revert "drm/amd/display: disable dcn20 abm feature for bring up" crypto: algif_skcipher - Cap recv SG list at ctx->used crypto: algboss - don't wait during notifier callback tracing/probe: Fix memleak in fetch_op_data operations kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex kretprobe: Prevent triggering kretprobe from within kprobe_flush_task e1000e: Do not wake up the system via WOL if device wakeup is disabled net: octeon: mgmt: Repair filling of RX ring pwm: jz4740: Enhance precision in calculation of duty cycle sched/rt, net: Use CONFIG_PREEMPTION.patch net: core: device_rename: Use rwsem instead of a seqcount Linux 5.4.49 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I93723d3c14b5de06aafb4e59a9e35a1d74389757	2020-06-25 07:49:21 +02:00
Tom Rix	ae3c09e346	selinux: fix double free ... commit 65de50969a77509452ae590e9449b70a22b923bb upstream. Clang's static analysis tool reports these double free memory errors. security/selinux/ss/services.c:2987:4: warning: Attempt to free released memory [unix.Malloc] kfree(bnames[i]); ^~~~~~~~~~~~~~~~ security/selinux/ss/services.c:2990:2: warning: Attempt to free released memory [unix.Malloc] kfree(bvalues); ^~~~~~~~~~~~~~ So improve the security_get_bools error handling by freeing these variables and setting their return pointers to NULL and the return len to 0 Cc: stable@vger.kernel.org Signed-off-by: Tom Rix <trix@redhat.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-24 17:50:48 +02:00
John Johansen	a78c65cb4b	apparmor: fix nnp subset test for unconfined ... [ Upstream commit 3ed4aaa94fc07db3cd0c91be95e3e1b9782a2710 ] The subset test is not taking into account the unconfined exception which will cause profile transitions in the stacked confinement case to fail when no_new_privs is applied. This fixes a regression introduced in the fix for https://bugs.launchpad.net/bugs/1839037 BugLink: https://bugs.launchpad.net/bugs/1844186 Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-24 17:50:20 +02:00
Mauricio Faria de Oliveira	039a79ef0b	apparmor: check/put label on apparmor_sk_clone_security() ... [ Upstream commit 3b646abc5bc6c0df649daea4c2c976bd4d47e4c8 ] Currently apparmor_sk_clone_security() does not check for existing label/peer in the 'new' struct sock; it just overwrites it, if any (with another reference to the label of the source sock.) static void apparmor_sk_clone_security(const struct sock *sk, struct sock *newsk) { struct aa_sk_ctx *ctx = SK_CTX(sk); struct aa_sk_ctx *new = SK_CTX(newsk); new->label = aa_get_label(ctx->label); new->peer = aa_get_label(ctx->peer); } This might leak label references, which might overflow under load. Thus, check for and put labels, to prevent such errors. Note this is similarly done on: static int apparmor_socket_post_create(struct socket *sock, ...) ... if (sock->sk) { struct aa_sk_ctx *ctx = SK_CTX(sock->sk); aa_put_label(ctx->label); ctx->label = aa_get_label(label); } ... Context: ------- The label reference count leak is observed if apparmor_sock_graft() is called previously: this sets the 'ctx->label' field by getting a reference to the current label (later overwritten, without put.) static void apparmor_sock_graft(struct sock *sk, ...) { struct aa_sk_ctx *ctx = SK_CTX(sk); if (!ctx->label) ctx->label = aa_get_current_label(); } And that is the case on crypto/af_alg.c:af_alg_accept(): int af_alg_accept(struct sock *sk, struct socket *newsock, ...) ... struct sock *sk2; ... sk2 = sk_alloc(...); ... security_sock_graft(sk2, newsock); security_sk_clone(sk, sk2); ... Apparently both calls are done on their own right, especially for other LSMs, being introduced in 2010/2014, before apparmor socket mediation in 2017 (see commits [1,2,3,4]). So, it looks OK there! Let's fix the reference leak in apparmor. Test-case: --------- Exercise that code path enough to overflow label reference count. $ cat aa-refcnt-af_alg.c #include <stdio.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_alg.h> int main() { int sockfd; struct sockaddr_alg sa; /* Setup the crypto API socket */ sockfd = socket(AF_ALG, SOCK_SEQPACKET, 0); if (sockfd < 0) { perror("socket"); return 1; } memset(&sa, 0, sizeof(sa)); sa.salg_family = AF_ALG; strcpy((char *) sa.salg_type, "rng"); strcpy((char *) sa.salg_name, "stdrng"); if (bind(sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) { perror("bind"); return 1; } /* Accept a "connection" and close it; repeat. */ while (!close(accept(sockfd, NULL, 0))); return 0; } $ gcc -o aa-refcnt-af_alg aa-refcnt-af_alg.c $ ./aa-refcnt-af_alg <a few hours later> [ 9928.475953] refcount_t overflow at apparmor_sk_clone_security+0x37/0x70 in aa-refcnt-af_alg[1322], uid/euid: 1000/1000 ... [ 9928.507443] RIP: 0010:apparmor_sk_clone_security+0x37/0x70 ... [ 9928.514286] security_sk_clone+0x33/0x50 [ 9928.514807] af_alg_accept+0x81/0x1c0 [af_alg] [ 9928.516091] alg_accept+0x15/0x20 [af_alg] [ 9928.516682] SYSC_accept4+0xff/0x210 [ 9928.519609] SyS_accept+0x10/0x20 [ 9928.520190] do_syscall_64+0x73/0x130 [ 9928.520808] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Note that other messages may be seen, not just overflow, depending on the value being incremented by kref_get(); on another run: [ 7273.182666] refcount_t: saturated; leaking memory. ... [ 7273.185789] refcount_t: underflow; use-after-free. Kprobes: ------- Using kprobe events to monitor sk -> sk_security -> label -> count (kref): Original v5.7 (one reference leak every iteration) ... (af_alg_accept+0x0/0x1c0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd2 ... (af_alg_release_parent+0x0/0xd0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd4 ... (af_alg_accept+0x0/0x1c0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd3 ... (af_alg_release_parent+0x0/0xd0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd5 ... (af_alg_accept+0x0/0x1c0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd4 ... (af_alg_release_parent+0x0/0xd0) label=0xffff8a0f36c25eb0 label_refcnt=0x11fd6 Patched v5.7 (zero reference leak per iteration) ... (af_alg_accept+0x0/0x1c0) label=0xffff9ff376c25eb0 label_refcnt=0x593 ... (af_alg_release_parent+0x0/0xd0) label=0xffff9ff376c25eb0 label_refcnt=0x594 ... (af_alg_accept+0x0/0x1c0) label=0xffff9ff376c25eb0 label_refcnt=0x593 ... (af_alg_release_parent+0x0/0xd0) label=0xffff9ff376c25eb0 label_refcnt=0x594 ... (af_alg_accept+0x0/0x1c0) label=0xffff9ff376c25eb0 label_refcnt=0x593 ... (af_alg_release_parent+0x0/0xd0) label=0xffff9ff376c25eb0 label_refcnt=0x594 Commits: ------- [1] commit 507cad355f ("crypto: af_alg - Make sure sk_security is initialized on accept()ed sockets") [2] commit 4c63f83c2c ("crypto: af_alg - properly label AF_ALG socket") [3] commit 2acce6aa9f ("Networking") a.k.a ("crypto: af_alg - Avoid sock_graft call warning) [4] commit 56974a6fcf ("apparmor: add base infastructure for socket mediation") Fixes: 56974a6fcf ("apparmor: add base infastructure for socket mediation") Reported-by: Brian Moyles <bmoyles@netflix.com> Signed-off-by: Mauricio Faria de Oliveira <mfo@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-24 17:50:19 +02:00
John Johansen	88bc3e0603	apparmor: fix introspection of of task mode for unconfined tasks ... [ Upstream commit dd2569fbb053719f7df7ef8fdbb45cf47156a701 ] Fix two issues with introspecting the task mode. 1. If a task is attached to a unconfined profile that is not the ns->unconfined profile then. Mode the mode is always reported as - $ ps -Z LABEL PID TTY TIME CMD unconfined 1287 pts/0 00:00:01 bash test (-) 1892 pts/0 00:00:00 ps instead of the correct value of (unconfined) as shown below $ ps -Z LABEL PID TTY TIME CMD unconfined 2483 pts/0 00:00:01 bash test (unconfined) 3591 pts/0 00:00:00 ps 2. if a task is confined by a stack of profiles that are unconfined the output of label mode is again the incorrect value of (-) like above, instead of (unconfined). This is because the visibile profile count increment is skipped by the special casing of unconfined. Fixes: f1bd904175 ("apparmor: add the base fns() for domain labels") Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-24 17:50:19 +02:00
Greg Kroah-Hartman	fa46997961	This is the 5.4.48 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7wXk8ACgkQONu9yGCS aT5uyhAA1EoV9ROPRt8Vw1fzlDIrRA5X2T+FCGXskg2kKWehVHAvge4U76nZ16+i aYcBX3lAmN7GGVw+/GiRHf9QpiwOUF5f3ZUQZ0KuLS1gcuaXx+VC1h5yyunx3tm1 CI01B2p+GQ3jABWopnhsujMVAeWjbD18NqY+a+xOzTn8CCyLAli+LiviWCR/apQp p4r6++eevWo1yMDlJGNGoMYsFcxChWhtlnDQKWCsIDCN3I1cinGz8wopiv93WqRH Sz3wb1YMuhXb10usNZcZFaSvDGf5XSaMxpRkyNSxN7CLv8LzbovXQOE+fFDGAYxd lUCjRK0wFBMzRSeZ2iGYqqQf5xyYKb6hNmViGprdqwR2c3MBHN/Xs5aDLqJEgHkr OXzZLyHUngRfp3GpagFGV6q06S6fgb9ca/7FuT4Hn8Z3tb5Xt7b/KlPcW3VymiSt I37itASNA/Qs6Njl4tDd9GjwbcOAs+s/XabasU+pXscOkf3o8fYMy2krisy176D/ AXtRTLq4pc42I8c3tv5uCNz7Zje/qytKSPErNRBAedvOu5JX7ab6hgULPH4N7r0N Di/LyKqYw+ZBa4AfzcsvlR3wJLWqni+aFj5yppSrNkH7kNzZGLmlw8xIo8v1CFYw T86b13WmHPqvyFWQLpX5WCEYu0OCw5YCUyQXSsLZN5oC7gAwC7U= =FSdI -----END PGP SIGNATURE----- Merge 5.4.48 into android-5.4-stable Changes in 5.4.48 ACPI: GED: use correct trigger type field in _Exx / _Lxx handling drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4 ath10k: Fix the race condition in firmware dump work queue drm: bridge: adv7511: Extend list of audio sample rates media: staging: imgu: do not hold spinlock during freeing mmu page table media: imx: imx7-mipi-csis: Cleanup and fix subdev pad format handling crypto: ccp -- don't "select" CONFIG_DMADEVICES media: vicodec: Fix error codes in probe function media: si2157: Better check for running tuner in init objtool: Ignore empty alternatives spi: spi-mem: Fix Dual/Quad modes on Octal-capable devices drm/amdgpu: Init data to avoid oops while reading pp_num_states. arm64/kernel: Fix range on invalidating dcache for boot page tables libbpf: Fix memory leak and possible double-free in hashmap__clear spi: pxa2xx: Apply CS clk quirk to BXT x86,smap: Fix smap_{save,restore}() alternatives sched/fair: Refill bandwidth before scaling net: atlantic: make hw_get_regs optional net: ena: fix error returning in ena_com_get_hash_function() efi/libstub/x86: Work around LLVM ELF quirk build regression ath10k: remove the max_sched_scan_reqs value arm64: cacheflush: Fix KGDB trap detection media: staging: ipu3: Fix stale list entries on parameter queue failure rtw88: fix an issue about leak system resources spi: dw: Zero DMA Tx and Rx configurations on stack ACPICA: Dispatcher: add status checks block: alloc map and request for new hardware queue arm64: insn: Fix two bugs in encoding 32-bit logical immediates block: reset mapping if failed to update hardware queue count drm: rcar-du: Set primary plane zpos immutably at initializing lockdown: Allow unprivileged users to see lockdown status ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K platform/x86: dell-laptop: don't register micmute LED if there is no token MIPS: Loongson: Build ATI Radeon GPU driver as module Bluetooth: Add SCO fallback for invalid LMP parameters error kgdb: Disable WARN_CONSOLE_UNLOCKED for all kgdb kgdb: Prevent infinite recursive entries to the debugger pmu/smmuv3: Clear IRQ affinity hint on device removal ACPI/IORT: Fix PMCG node single ID mapping handling mips: Fix cpu_has_mips64r1/2 activation for MIPS32 CPUs spi: dw: Enable interrupts in accordance with DMA xfer mode clocksource: dw_apb_timer: Make CPU-affiliation being optional clocksource: dw_apb_timer_of: Fix missing clockevent timers media: dvbdev: Fix tuner->demod media controller link btrfs: account for trans_block_rsv in may_commit_transaction btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE batman-adv: Revert "disable ethtool link speed detection when auto negotiation off" ice: Fix memory leak ice: Fix for memory leaks and modify ICE_FREE_CQ_BUFS mmc: meson-mx-sdio: trigger a soft reset after a timeout or CRC error Bluetooth: btmtkuart: Improve exception handling in btmtuart_probe() spi: dw: Fix Rx-only DMA transfers x86/kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss() x86: fix vmap arguments in map_irq_stack staging: android: ion: use vmap instead of vm_map_ram ath10k: fix kernel null pointer dereference media: staging/intel-ipu3: Implement lock for stream on/off operations spi: Respect DataBitLength field of SpiSerialBusV2() ACPI resource brcmfmac: fix wrong location to get firmware feature regulator: qcom-rpmh: Fix typos in pm8150 and pm8150l tools api fs: Make xxx__mountpoint() more scalable e1000: Distribute switch variables for initialization dt-bindings: display: mediatek: control dpi pins mode to avoid leakage drm/mediatek: set dpi pin mode to gpio low to avoid leakage current audit: fix a net reference leak in audit_send_reply() media: dvb: return -EREMOTEIO on i2c transfer failure. media: platform: fcp: Set appropriate DMA parameters MIPS: Make sparse_init() using top-down allocation ath10k: add flush tx packets for SDIO chip Bluetooth: btbcm: Add 2 missing models to subver tables audit: fix a net reference leak in audit_list_rules_send() Drivers: hv: vmbus: Always handle the VMBus messages on CPU0 dpaa2-eth: fix return codes used in ndo_setup_tc netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported selftests/bpf: Fix memory leak in extract_build_id() net: bcmgenet: set Rx mode before starting netif net: bcmgenet: Fix WoL with password after deep sleep lib/mpi: Fix 64-bit MIPS build with Clang exit: Move preemption fixup up, move blocking operations down sched/core: Fix illegal RCU from offline CPUs drivers/perf: hisi: Fix typo in events attribute array iocost_monitor: drop string wrap around numbers when outputting json net: lpc-enet: fix error return code in lpc_mii_init() selinux: fix error return code in policydb_read() drivers: net: davinci_mdio: fix potential NULL dereference in davinci_mdio_probe() media: cec: silence shift wrapping warning in __cec_s_log_addrs() net: allwinner: Fix use correct return type for ndo_start_xmit() powerpc/spufs: fix copy_to_user while atomic libertas_tf: avoid a null dereference in pointer priv xfs: clean up the error handling in xfs_swap_extents Crypto/chcr: fix for ccm(aes) failed test MIPS: Truncate link address into 32bit for 32bit kernel mips: cm: Fix an invalid error code of INTVN_*_ERR kgdb: Fix spurious true from in_dbg_master() xfs: reset buffer write failure state on successful completion xfs: fix duplicate verification from xfs_qm_dqflush() platform/x86: intel-vbtn: Use acpi_evaluate_integer() platform/x86: intel-vbtn: Split keymap into buttons and switches parts platform/x86: intel-vbtn: Do not advertise switches to userspace if they are not there platform/x86: intel-vbtn: Also handle tablet-mode switch on "Detachable" and "Portable" chassis-types iwlwifi: avoid debug max amsdu config overwriting itself nvme: refine the Qemu Identify CNS quirk nvme-pci: align io queue count with allocted nvme_queue in nvme_probe nvme-tcp: use bh_lock in data_ready ath10k: Remove msdu from idr when management pkt send fails wcn36xx: Fix error handling path in 'wcn36xx_probe()' net: qed*: Reduce RX and TX default ring count when running inside kdump kernel drm/mcde: dsi: Fix return value check in mcde_dsi_bind() mt76: avoid rx reorder buffer overflow md: don't flush workqueue unconditionally in md_open raid5: remove gfp flags from scribble_alloc() iocost: don't let vrate run wild while there's no saturation signal veth: Adjust hard_start offset on redirect XDP frames net/mlx5e: IPoIB, Drop multicast packets that this interface sent rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() mwifiex: Fix memory corruption in dump_station kgdboc: Use a platform device to handle tty drivers showing up late x86/boot: Correct relocation destination on old linkers sched: Defend cfs and rt bandwidth quota against overflow mips: MAAR: Use more precise address mask mips: Add udelay lpj numbers adjustment crypto: stm32/crc32 - fix ext4 chksum BUG_ON() crypto: stm32/crc32 - fix run-time self test issue. crypto: stm32/crc32 - fix multi-instance drm/amd/powerpay: Disable gfxoff when setting manual mode on picasso and raven drm/amdgpu: Sync with VM root BO when switching VM to CPU update mode selftests/bpf: CONFIG_IPV6_SEG6_BPF required for test_seg6_loop.o x86/mm: Stop printing BRK addresses MIPS: tools: Fix resource leak in elf-entry.c m68k: mac: Don't call via_flush_cache() on Mac IIfx btrfs: improve global reserve stealing logic btrfs: qgroup: mark qgroup inconsistent if we're inherting snapshot to a new qgroup macvlan: Skip loopback packets in RX handler PCI: Don't disable decoding when mmio_always_on is set MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe() bcache: fix refcount underflow in bcache_device_free() mmc: sdhci-msm: Set SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 quirk staging: greybus: sdio: Respect the cmd->busy_timeout from the mmc core mmc: via-sdmmc: Respect the cmd->busy_timeout from the mmc core ice: fix potential double free in probe unrolling ixgbe: fix signed-integer-overflow warning iwlwifi: mvm: fix aux station leak mmc: sdhci-esdhc-imx: fix the mask for tuning start point spi: dw: Return any value retrieved from the dma_transfer callback cpuidle: Fix three reference count leaks platform/x86: hp-wmi: Convert simple_strtoul() to kstrtou32() platform/x86: intel-hid: Add a quirk to support HP Spectre X2 (2015) platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type platform/x86: asus_wmi: Reserve more space for struct bias_args libbpf: Fix perf_buffer__free() API for sparse allocs bpf: Fix map permissions check bpf: Refactor sockmap redirect code so its easy to reuse bpf: Fix running sk_skb program types with ktls selftests/bpf, flow_dissector: Close TAP device FD after the test kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE string.h: fix incompatibility between FORTIFY_SOURCE and KASAN btrfs: free alien device after device add btrfs: include non-missing as a qualifier for the latest_bdev btrfs: send: emit file capabilities after chown btrfs: force chunk allocation if our global rsv is larger than metadata btrfs: fix error handling when submitting direct I/O bio btrfs: fix wrong file range cleanup after an error filling dealloc range btrfs: fix space_info bytes_may_use underflow after nocow buffered write btrfs: fix space_info bytes_may_use underflow during space cache writeout powerpc/mm: Fix conditions to perform MMU specific management by blocks on PPC32. mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked() mm: initialize deferred pages with interrupts enabled mm/pagealloc.c: call touch_nmi_watchdog() on max order boundaries in deferred init mm: call cond_resched() from deferred_init_memmap() ima: Fix ima digest hash table key calculation ima: Switch to ima_hash_algo for boot aggregate ima: Evaluate error in init_ima() ima: Directly assign the ima_default_policy pointer to ima_rules ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init() ima: Remove __init annotation from ima_pcrread() evm: Fix possible memory leak in evm_calc_hmac_or_hash() ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max ext4: fix error pointer dereference ext4: fix race between ext4_sync_parent() and rename() PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 PCI: Avoid FLR for AMD Starship USB 3.0 PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints PCI: vmd: Add device id for VMD device 8086:9A0B x86/amd_nb: Add Family 19h PCI IDs PCI: Add Loongson vendor ID serial: 8250_pci: Move Pericom IDs to pci_ids.h x86/amd_nb: Add AMD family 17h model 60h PCI IDs ima: Remove redundant policy rule set in add_rules() ima: Set again build_ima_appraise variable PCI: Program MPS for RCiEP devices e1000e: Disable TSO for buffer overrun workaround e1000e: Relax condition to trigger reset for ME workaround carl9170: remove P2P_GO support media: go7007: fix a miss of snd_card_free media: cedrus: Program output format during each run serial: 8250: Avoid error message on reprobe Bluetooth: hci_bcm: fix freeing not-requested IRQ b43legacy: Fix case where channel status is corrupted b43: Fix connection problem with WPA3 b43_legacy: Fix connection problem with WPA3 media: ov5640: fix use of destroyed mutex clk: mediatek: assign the initial value to clk_init_data of mtk_mux igb: Report speed and duplex as unknown when device is runtime suspended hwmon: (k10temp) Add AMD family 17h model 60h PCI match EDAC/amd64: Add AMD family 17h model 60h PCI IDs power: vexpress: add suppress_bind_attrs to true power: supply: core: fix HWMON temperature labels power: supply: core: fix memory leak in HWMON error path pinctrl: samsung: Correct setting of eint wakeup mask on s5pv210 pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs gnss: sirf: fix error return code in sirf_probe() sparc32: fix register window handling in genregs32_[gs]et() sparc64: fix misuses of access_process_vm() in genregs32_[sg]et() dm crypt: avoid truncating the logical block size alpha: fix memory barriers so that they conform to the specification powerpc/fadump: use static allocation for reserved memory ranges powerpc/fadump: consider reserved ranges while reserving memory powerpc/fadump: Account for memory_limit while reserving memory kernel/cpu_pm: Fix uninitted local in cpu_pm ARM: tegra: Correct PL310 Auxiliary Control Register initialization soc/tegra: pmc: Select GENERIC_PINCONF ARM: dts: exynos: Fix GPIO polarity for thr GalaxyS3 CM36651 sensor's bus ARM: dts: at91: sama5d2_ptc_ek: fix vbus pin ARM: dts: s5pv210: Set keep-power-in-suspend for SDHCI1 on Aries drivers/macintosh: Fix memleak in windfarm_pm112 driver powerpc/32s: Fix another build failure with CONFIG_PPC_KUAP_DEBUG powerpc/kasan: Fix issues by lowering KASAN_SHADOW_END powerpc/kasan: Fix shadow pages allocation failure powerpc/32: Disable KASAN with pages bigger than 16k powerpc/64s: Don't let DT CPU features set FSCR_DSCR powerpc/64s: Save FSCR to init_task.thread.fscr after feature init kbuild: force to build vmlinux if CONFIG_MODVERSION=y sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations. sunrpc: clean up properly in gss_mech_unregister() mtd: rawnand: Fix nand_gpio_waitrdy() mtd: rawnand: onfi: Fix redundancy detection check mtd: rawnand: brcmnand: fix hamming oob layout mtd: rawnand: diskonchip: Fix the probe error path mtd: rawnand: sharpsl: Fix the probe error path mtd: rawnand: ingenic: Fix the probe error path mtd: rawnand: xway: Fix the probe error path mtd: rawnand: orion: Fix the probe error path mtd: rawnand: socrates: Fix the probe error path mtd: rawnand: oxnas: Fix the probe error path mtd: rawnand: sunxi: Fix the probe error path mtd: rawnand: plat_nand: Fix the probe error path mtd: rawnand: pasemi: Fix the probe error path mtd: rawnand: mtk: Fix the probe error path mtd: rawnand: tmio: Fix the probe error path w1: omap-hdq: cleanup to add missing newline for some dev_dbg f2fs: fix checkpoint=disable:%u%% perf probe: Do not show the skipped events perf probe: Fix to check blacklist address correctly perf probe: Check address correctness by map instead of _etext perf symbols: Fix debuginfo search for Ubuntu perf symbols: Fix kernel maps for kcore and eBPF Linux 5.4.48 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I9954fb3f08956419e8586bcb9078e604df207fb9	2020-06-22 11:43:59 +02:00
Krzysztof Struczynski	e131e70e21	ima: Set again build_ima_appraise variable ... [ Upstream commit b59fda449cf07f2db3be3a67142e6c000f5e8d79 ] After adding the new add_rule() function in commit c52657d93b ("ima: refactor ima_init_policy()"), all appraisal flags are added to the temp_ima_appraise variable. Revert to the previous behavior instead of removing build_ima_appraise, to benefit from the protection offered by __ro_after_init. The mentioned commit introduced a bug, as it makes all the flags modifiable, while build_ima_appraise flags can be protected with __ro_after_init. Cc: stable@vger.kernel.org # 5.0.x Fixes: c52657d93b ("ima: refactor ima_init_policy()") Co-developed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-22 09:31:17 +02:00
Krzysztof Struczynski	2600136eae	ima: Remove redundant policy rule set in add_rules() ... [ Upstream commit 6ee28442a465ab4c4be45e3b15015af24b1ba906 ] Function ima_appraise_flag() returns the flag to be set in temp_ima_appraise depending on the hook identifier passed as an argument. It is not necessary to set the flag again for the POLICY_CHECK hook. Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-22 09:31:17 +02:00
Roberto Sassu	6de50456fe	evm: Fix possible memory leak in evm_calc_hmac_or_hash() ... commit 0c4395fb2aa77341269ea619c5419ea48171883f upstream. Don't immediately return if the signature is portable and security.ima is not present. Just set error so that memory allocated is freed before returning from evm_calc_hmac_or_hash(). Fixes: 50b977481f ("EVM: Add support for portable signature format") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-22 09:31:15 +02:00
Roberto Sassu	ce7f038f85	ima: Remove __init annotation from ima_pcrread() ... commit 8b8c704d913b0fe490af370631a4200e26334ec0 upstream. Commit 6cc7c266e5b4 ("ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()") added a call to ima_calc_boot_aggregate() so that the digest can be recalculated for the boot_aggregate measurement entry if the 'd' template field has been requested. For the 'd' field, only SHA1 and MD5 digests are accepted. Given that ima_eventdigest_init() does not have the __init annotation, all functions called should not have it. This patch removes __init from ima_pcrread(). Cc: stable@vger.kernel.org Fixes: 6cc7c266e5b4 ("ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()") Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-22 09:31:15 +02:00
Roberto Sassu	f387759c2d	ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init() ... commit 6cc7c266e5b47d3cd2b5bb7fd3aac4e6bb2dd1d2 upstream. If the template field 'd' is chosen and the digest to be added to the measurement entry was not calculated with SHA1 or MD5, it is recalculated with SHA1, by using the passed file descriptor. However, this cannot be done for boot_aggregate, because there is no file descriptor. This patch adds a call to ima_calc_boot_aggregate() in ima_eventdigest_init(), so that the digest can be recalculated also for the boot_aggregate entry. Cc: stable@vger.kernel.org # 3.13.x Fixes: 3ce1217d6c ("ima: define template fields library and new helpers") Reported-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-22 09:31:15 +02:00
Roberto Sassu	64712383a1	ima: Directly assign the ima_default_policy pointer to ima_rules ... commit 067a436b1b0aafa593344fddd711a755a58afb3b upstream. This patch prevents the following oops: [ 10.771813] BUG: kernel NULL pointer dereference, address: 0000000000000 [...] [ 10.779790] RIP: 0010:ima_match_policy+0xf7/0xb80 [...] [ 10.798576] Call Trace: [ 10.798993] ? ima_lsm_policy_change+0x2b0/0x2b0 [ 10.799753] ? inode_init_owner+0x1a0/0x1a0 [ 10.800484] ? _raw_spin_lock+0x7a/0xd0 [ 10.801592] ima_must_appraise.part.0+0xb6/0xf0 [ 10.802313] ? ima_fix_xattr.isra.0+0xd0/0xd0 [ 10.803167] ima_must_appraise+0x4f/0x70 [ 10.804004] ima_post_path_mknod+0x2e/0x80 [ 10.804800] do_mknodat+0x396/0x3c0 It occurs when there is a failure during IMA initialization, and ima_init_policy() is not called. IMA hooks still call ima_match_policy() but ima_rules is NULL. This patch prevents the crash by directly assigning the ima_default_policy pointer to ima_rules when ima_rules is defined. This wouldn't alter the existing behavior, as ima_rules is always set at the end of ima_init_policy(). Cc: stable@vger.kernel.org # 3.7.x Fixes: 07f6a79415 ("ima: add appraise action keywords and default rules") Reported-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-22 09:31:15 +02:00
Roberto Sassu	4ce29d9b19	ima: Evaluate error in init_ima() ... commit e144d6b265415ddbdc54b3f17f4f95133effa5a8 upstream. Evaluate error in init_ima() before register_blocking_lsm_notifier() and return if not zero. Cc: stable@vger.kernel.org # 5.3.x Fixes: b169424551 ("ima: use the lsm policy update notifier") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: James Morris <jamorris@linux.microsoft.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-22 09:31:14 +02:00
Roberto Sassu	5f7272bd22	ima: Switch to ima_hash_algo for boot aggregate ... commit 6f1a1d103b48b1533a9c804e7a069e2c8e937ce7 upstream. boot_aggregate is the first entry of IMA measurement list. Its purpose is to link pre-boot measurements to IMA measurements. As IMA was designed to work with a TPM 1.2, the SHA1 PCR bank was always selected even if a TPM 2.0 with support for stronger hash algorithms is available. This patch first tries to find a PCR bank with the IMA default hash algorithm. If it does not find it, it selects the SHA256 PCR bank for TPM 2.0 and SHA1 for TPM 1.2. Ultimately, it selects SHA1 also for TPM 2.0 if the SHA256 PCR bank is not found. If none of the PCR banks above can be found, boot_aggregate file digest is filled with zeros, as for TPM bypass, making it impossible to perform a remote attestation of the system. Cc: stable@vger.kernel.org # 5.1.x Fixes: 879b589210 ("tpm: retrieve digest size of unknown algorithms with PCR read") Reported-by: Jerry Snitselaar <jsnitsel@redhat.com> Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-22 09:31:14 +02:00
Krzysztof Struczynski	0698eacdfc	ima: Fix ima digest hash table key calculation ... commit 1129d31b55d509f15e72dc68e4b5c3a4d7b4da8d upstream. Function hash_long() accepts unsigned long, while currently only one byte is passed from ima_hash_key(), which calculates a key for ima_htable. Given that hashing the digest does not give clear benefits compared to using the digest itself, remove hash_long() and return the modulus calculated on the first two bytes of the digest with the number of slots. Also reduce the depth of the hash table by doubling the number of slots. Cc: stable@vger.kernel.org Fixes: 3323eec921 ("integrity: IMA as an integrity service provider") Co-developed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com> Acked-by: David.Laight@aculab.com (big endian system concerns) Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-22 09:31:14 +02:00
Wei Yongjun	b2083327ea	selinux: fix error return code in policydb_read() ... [ Upstream commit 4c09f8b6913a779ca0c70ea8058bf21537eebb3b ] Fix to return negative error code -ENOMEM from the kvcalloc() error handling case instead of 0, as done elsewhere in this function. Fixes: acdf52d97f ("selinux: convert to kvmalloc") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-22 09:31:01 +02:00
Jeremy Cline	6eec65c9e2	lockdown: Allow unprivileged users to see lockdown status ... [ Upstream commit 60cf7c5ed5f7087c4de87a7676b8c82d96fd166c ] A number of userspace tools, such as systemtap, need a way to see the current lockdown state so they can gracefully deal with the kernel being locked down. The state is already exposed in /sys/kernel/security/lockdown, but is only readable by root. Adjust the permissions so unprivileged users can read the state. Fixes: 000d388ed3 ("security: Add a static lockdown policy LSM") Cc: Frank Ch. Eigler <fche@redhat.com> Signed-off-by: Jeremy Cline <jcline@redhat.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-22 09:30:53 +02:00
Greg Kroah-Hartman	eaaa29ec5a	This is the 5.4.47 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7qK2gACgkQONu9yGCS aT4kaw/8Cknc9G64S1SWchxFj4LnSYzrpeFGXOZBlHBtcCyD12JNGjA6SG6DoGLY /s/1fjBwJWrWpkI36CGNZowNPYtzRMOhyBGj7QHTpEj0vjMTKYXhVieMquQSHwRP zcrYl8f/xWJKo6XNjR1YLh5PWeD6B9dWD1RcvBZ0jCez84jyVT1EyWMWGiodkLMx gmJITO2DBaekelU0yyZJIFePO5DJpcXspf5lrPgkPG9u/U4hZf94AAGMYbXJZ5Rn BDcqGEGQe+mtcG6lq6DGRDH5VVMG4k13MrZJBfrVAhkGU+g6nKQbOXCcdcRjoM6N 9NL8RbcpL0NhphNmrKwjNcYd4kZxYgTQb87FZi+qDxwGQIWIxcET6gL5t/vqAev1 v/uKFLlt5x/2tNtpC8aY8EwdyGcXfeBXEl9AjP7HUWC/KzB8I9vLnokcMvOMYDIg 3wNIsKMYLcLzuLL8oJ7FvDkBO+H/RjSvF4UvQyLOPOJtWSV5uKbLfKIU9sw90G3i t8qo3lNC/J4saJ+jx+O7XoHjFw6biJFATvs0+HtpCkwi0aJm2SGW+OvXuZCGZPnz TW2YsGFCCwL/RPtceJVkGfV3kr7SUB5AGXjueXdC+4QWfmi3POWojjgheQrleS+3 OLxRsUVbQ6hOqEgLAaV6HhzvykkTjDj2Gq8P3I+1Y/eiRHjlpdU= =WYnW -----END PGP SIGNATURE----- Merge 5.4.47 into android-5.4-stable Changes in 5.4.47 ipv6: fix IPV6_ADDRFORM operation logic mlxsw: core: Use different get_trend() callbacks for different thermal zones net_failover: fixed rollback in net_failover_open() tun: correct header offsets in napi frags mode bridge: Avoid infinite loop when suppressing NS messages with invalid options vxlan: Avoid infinite loop when suppressing NS messages with invalid options bpf: Support llvm-objcopy for vmlinux BTF elfnote: mark all .note sections SHF_ALLOC Input: mms114 - fix handling of mms345l ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook sched/fair: Don't NUMA balance for kthreads Input: synaptics - add a second working PNP_ID for Lenovo T470s csky: Fixup abiv2 syscall_trace break a4 & a5 gfs2: Even more gfs2_find_jhead fixes drivers/net/ibmvnic: Update VNIC protocol version reporting powerpc/xive: Clear the page tables for the ESB IO mapping spi: dw: Fix native CS being unset ath9k_htc: Silence undersized packet warnings smack: avoid unused 'sip' variable warning RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated padata: add separate cpuhp node for CPUHP_PADATA_DEAD s390/pci: Log new handle in clp_disable_fh() x86/cpu/amd: Make erratum #1054 a legacy erratum KVM: x86: only do L1TF workaround on affected processors PCI/PM: Adjust pcie_wait_for_link_delay() for caller delay perf probe: Accept the instance number of kretprobe event mm: add kvfree_sensitive() for freeing sensitive data objects selftests: fix flower parent qdisc fanotify: fix ignore mask logic for events on child and on dir aio: fix async fsync creds ipv4: fix a RCU-list lock in fib_triestat_seq_show iwlwifi: mvm: fix NVM check for 3168 devices sctp: fix possibly using a bad saddr with a given dst sctp: fix refcount bug in sctp_wfree x86_64: Fix jiffies ODR violation x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs x86/speculation: Prevent rogue cross-process SSBD shutdown x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS. x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches. x86/reboot/quirks: Add MacBook6,1 reboot quirk perf/x86/intel: Add more available bits for OFFCORE_RESPONSE of Intel Tremont KVM: x86/mmu: Set mmio_value to '0' if reserved #PF can't be generated KVM: x86: respect singlestep when emulating instruction KVM: x86: Fix APIC page invalidation race powerpc/ptdump: Properly handle non standard page size ASoC: max9867: fix volume controls io_uring: use kvfree() in io_sqe_buffer_register() efi/efivars: Add missing kobject_put() in sysfs entry creation error path smb3: fix incorrect number of credits when ioctl MaxOutputResponse > 64K smb3: add indatalen that can be a non-zero value to calculation of credit charge in smb2 ioctl watchdog: imx_sc_wdt: Fix reboot on crash ALSA: es1688: Add the missed snd_card_free() ALSA: fireface: fix configuration error for nominal sampling transfer frequency ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines ALSA: pcm: disallow linking stream to itself ALSA: pcm: fix snd_pcm_link() lockdep splat ALSA: usb-audio: Fix inconsistent card PM state after resume ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe() ACPI: GED: add support for _Exx / _Lxx handler methods ACPI: PM: Avoid using power resources if there are none for D0 arm64: acpi: fix UBSAN warning lib/lzo: fix ambiguous encoding bug in lzo-rle nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() spi: dw: Fix controller unregister order spi: Fix controller unregister order spi: pxa2xx: Fix controller unregister order spi: pxa2xx: Fix runtime PM ref imbalance on probe error spi: bcm2835: Fix controller unregister order spi: bcm2835aux: Fix controller unregister order spi: bcm-qspi: Handle clock probe deferral spi: bcm-qspi: when tx/rx buffer is NULL set to 0 PM: runtime: clk: Fix clk_pm_runtime_get() error path gup: document and work around "COW can break either way" issue crypto: cavium/nitrox - Fix 'nitrox_get_first_device()' when ndevlist is fully iterated crypto: algapi - Avoid spurious modprobe on LOADED crypto: drbg - fix error return code in drbg_alloc_state() x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned firmware: imx: warn on unexpected RX firmware: imx-scu: Support one TX and one RX firmware: imx: scu: Fix corruption of header crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req() crypto: virtio: Fix src/dst scatterlist calculation in __virtio_crypto_skcipher_do_req() crypto: virtio: Fix dest length calculation in __virtio_crypto_skcipher_do_req() dccp: Fix possible memleak in dccp_init and dccp_fini selftests/net: in rxtimestamp getopt_long needs terminating null entry net/mlx5: drain health workqueue in case of driver load error net/mlx5: Fix fatal error handling during device load net/mlx5e: Fix repeated XSK usage on one channel ovl: initialize error in ovl_copy_xattr proc: Use new_inode not new_inode_pseudo remoteproc: Fall back to using parent memory pool if no dedicated available remoteproc: Fix and restore the parenting hierarchy for vdev cpufreq: Fix up cpufreq_boost_set_sw() EDAC/skx: Use the mcmtr register to retrieve close_pg/bank_xor_enable video: vt8500lcdfb: fix fallthrough warning video: fbdev: w100fb: Fix a potential double free. KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02 KVM: nSVM: fix condition for filtering async PF KVM: nSVM: leave ASID aside in copy_vmcb_control_area KVM: nVMX: Consult only the "basic" exit reason when routing nested exit KVM: MIPS: Define KVM_ENTRYHI_ASID to cpu_asid_mask(&boot_cpu_data) KVM: MIPS: Fix VPN2_MASK definition for variable cpu_vmbits KVM: arm64: Stop writing aarch32's CSSELR into ACTLR KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts scsi: megaraid_sas: TM command refire leads to controller firmware crash scsi: lpfc: Fix negation of else clause in lpfc_prep_node_fc4type selftests/ftrace: Return unsupported if no error_log file ath9k: Fix use-after-free Read in htc_connect_service ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx ath9k: Fix use-after-free Write in ath9k_htc_rx_msg ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Smack: slab-out-of-bounds in vsscanf drm/vkms: Hold gem object while still in-use mm/slub: fix a memory leak in sysfs_slab_add() fat: don't allow to mount if the FAT length == 0 perf: Add cond_resched() to task_function_call() agp/intel: Reinforce the barrier after GTT updates mmc: sdhci-msm: Clear tuning done flag while hs400 tuning mmc: mmci_sdmmc: fix DMA API warning overlapping mappings mmc: tmio: Further fixup runtime PM management at remove mmc: uniphier-sd: call devm_request_irq() after tmio_mmc_host_probe() ARM: dts: at91: sama5d2_ptc_ek: fix sdmmc0 node description mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card() mmc: sdio: Fix several potential memory leaks in mmc_sdio_init_card() block/floppy: fix contended case in floppy_queue_rq() xen/pvcalls-back: test for errors when calling backend_connect() KVM: arm64: Synchronize sysreg state on injecting an AArch32 exception KVM: arm64: Save the host's PtrAuth keys in non-preemptible context Linux 5.4.47 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3fb3216abdbc080b4ac7b827b35ff6a813e28eb8	2020-06-18 10:05:17 +02:00
Casey Schaufler	9c09a772ac	Smack: slab-out-of-bounds in vsscanf ... commit 84e99e58e8d1e26f04c097f4266e431a33987f36 upstream. Add barrier to soob. Return -EOVERFLOW if the buffer is exceeded. Suggested-by: Hillf Danton <hdanton@sina.com> Reported-by: syzbot+bfdd4a2f07be52351350@syzkaller.appspotmail.com Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-17 16:40:36 +02:00
Waiman Long	0b11ec4ae5	mm: add kvfree_sensitive() for freeing sensitive data objects ... [ Upstream commit d4eaa2837851db2bfed572898bfc17f9a9f9151e ] For kvmalloc'ed data object that contains sensitive information like cryptographic keys, we need to make sure that the buffer is always cleared before freeing it. Using memset() alone for buffer clearing may not provide certainty as the compiler may compile it away. To be sure, the special memzero_explicit() has to be used. This patch introduces a new kvfree_sensitive() for freeing those sensitive data objects allocated by kvmalloc(). The relevant places where kvfree_sensitive() can be used are modified to use it. Fixes: 4f0882491a14 ("KEYS: Avoid false positive ENOMEM error on key read") Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Eric Biggers <ebiggers@google.com> Acked-by: David Howells <dhowells@redhat.com> Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Cc: James Morris <jmorris@namei.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: Joe Perches <joe@perches.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: David Rientjes <rientjes@google.com> Cc: Uladzislau Rezki <urezki@gmail.com> Link: http://lkml.kernel.org/r/20200407200318.11711-1-longman@redhat.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-17 16:40:23 +02:00
Arnd Bergmann	3f14df580a	smack: avoid unused 'sip' variable warning ... [ Upstream commit 00720f0e7f288d29681d265c23b22bb0f0f4e5b4 ] The mix of IS_ENABLED() and #ifdef checks has left a combination that causes a warning about an unused variable: security/smack/smack_lsm.c: In function 'smack_socket_connect': security/smack/smack_lsm.c:2838:24: error: unused variable 'sip' [-Werror=unused-variable] 2838 | struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; Change the code to use C-style checks consistently so the compiler can handle it correctly. Fixes: 87fbfffcc89b ("broken ping to ipv6 linklocal addresses on debian buster") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-17 16:40:22 +02:00
Greg Kroah-Hartman	a9a13eeea9	This is the 5.4.45 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7czYMACgkQONu9yGCS aT4YHA//cHSv58LPIlq8k2VYd0PG7qqg5SCU42AAQRPJWG19DavGynEkLUI35eqZ bSqrciaQkkzeoPwawzVGKy1KOaKVnNAr5f9wsFK8XB86PlreRfQfvrR2MniRY33H 5OTfw1127UIWJYuhCB6+PTXNHGNa6VaeGwDjVVczY+Ggsh2fyokxC5kb/FUsjuCN IlK41/dmiDDcP33RSQ82PMjDkEmJZsGhibaliivgV6rDvZeWW8PYnLTP+c24wIeK 6E2+XlP807FljjBPaCgKuTHx9LRDhj9CnUUuuo1LRGDtGNlW1deZ+PFXFJJ3gY0G Ja8RzZUgS6aVsBCbloIOEOwuLzeuZQTvnm5OKxPomOwE+7UIJ4e0xihzrTqji+zv yWfNwA2cErjHWZ3krL+muxbAO7CSatE4OEmn8OPbqOvp9F78r6l8mngHnWNMWkkW gGki69hQ+L/HgcIUOSnErfo+jBGhhsm2RPubl0sb8N4n9eS9TJx5NNlmsCL+uC4c 4wndNES/rPoi80vsIMB1h2PDkkWpjUZx/M6jZ1NuAlTOXgSsa0ZSz3Jvapi7cg2U weFKwAN4l/vHs9sOHASefrtj3mcZwcTJV9a9x0qmaIHpmqSICoptB5H9BTJ/c7sm U4JZ03yQSwkPhxtfDYbngMePcLyYIizGLq+3PbGPOiM1EqLEY8M= =mtHa -----END PGP SIGNATURE----- Merge 5.4.45 into android-5.4-stable Changes in 5.4.45 Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race window" mm: Fix mremap not considering huge pmd devmap HID: sony: Fix for broken buttons on DS3 USB dongles HID: multitouch: enable multi-input as a quirk for some devices HID: i2c-hid: add Schneider SCL142ALM to descriptor override p54usb: add AirVasT USB stick device-id mt76: mt76x02u: Add support for newer versions of the XBox One wifi adapter kernel/relay.c: handle alloc_percpu returning NULL in relay_open mmc: fix compilation of user API media: Revert "staging: imgu: Address a compiler warning on alignment" media: staging: ipu3-imgu: Move alignment attribute to field scsi: ufs: Release clock if DMA map fails net: dsa: mt7530: set CPU port to fallback mode airo: Fix read overflows sending packets drm/i915: fix port checks for MST support on gen >= 11 scsi: hisi_sas: Check sas_port before using it powerpc/powernv: Avoid re-registration of imc debugfs directory powerpc/xmon: Restrict when kernel is locked down spi: dw: use "smp_mb()" to avoid sending spi data error ASoC: intel - fix the card names s390/ftrace: save traced function caller RDMA/qedr: Fix qpids xarray api used RDMA/qedr: Fix synchronization methods and memory leaks in qedr ARC: Fix ICCM & DCCM runtime size checks ARC: [plat-eznps]: Restrict to CONFIG_ISA_ARCOMPACT evm: Fix RCU list related warnings scsi: pm: Balance pm_only counter of request queue during system resume i2c: altera: Fix race between xfer_msg and isr thread io_uring: initialize ctx->sqo_wait earlier x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables net: bmac: Fix read of MAC address from ROM drm/edid: Add Oculus Rift S to non-desktop list s390/mm: fix set_huge_pte_at() for empty ptes null_blk: return error for invalid zone size net/ethernet/freescale: rework quiesce/activate for ucc_geth net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x selftests: mlxsw: qos_mc_aware: Specify arping timeout as an integer net: smsc911x: Fix runtime PM imbalance on error Linux 5.4.45 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I31d3b6ccd9963bd8eb6aad70b2015cead1ec49e3	2020-06-07 14:28:34 +02:00
Madhuparna Bhowmik	1610cd913f	evm: Fix RCU list related warnings ... [ Upstream commit 770f60586d2af0590be263f55fd079226313922c ] This patch fixes the following warning and few other instances of traversal of evm_config_xattrnames list: [ 32.848432] ============================= [ 32.848707] WARNING: suspicious RCU usage [ 32.848966] 5.7.0-rc1-00006-ga8d5875ce5f0b #1 Not tainted [ 32.849308] ----------------------------- [ 32.849567] security/integrity/evm/evm_main.c:231 RCU-list traversed in non-reader section!! Since entries are only added to the list and never deleted, use list_for_each_entry_lockless() instead of list_for_each_entry_rcu for traversing the list. Also, add a relevant comment in evm_secfs.c to indicate this fact. Reported-by: kernel test robot <lkp@intel.com> Suggested-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com> Acked-by: Paul E. McKenney <paulmck@kernel.org> (RCU viewpoint) Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-07 13:18:50 +02:00
Christopher M. Riedl	99c63ba21d	powerpc/xmon: Restrict when kernel is locked down ... [ Upstream commit 69393cb03ccdf29f3b452d3482ef918469d1c098 ] Xmon should be either fully or partially disabled depending on the kernel lockdown state. Put xmon into read-only mode for lockdown=integrity and prevent user entry into xmon when lockdown=confidentiality. Xmon checks the lockdown state on every attempted entry: (1) during early xmon'ing (2) when triggered via sysrq (3) when toggled via debugfs (4) when triggered via a previously enabled breakpoint The following lockdown state transitions are handled: (1) lockdown=none -> lockdown=integrity set xmon read-only mode (2) lockdown=none -> lockdown=confidentiality clear all breakpoints, set xmon read-only mode, prevent user re-entry into xmon (3) lockdown=integrity -> lockdown=confidentiality clear all breakpoints, set xmon read-only mode, prevent user re-entry into xmon Suggested-by: Andrew Donnellan <ajd@linux.ibm.com> Signed-off-by: Christopher M. Riedl <cmr@informatik.wtf> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20190907061124.1947-3-cmr@informatik.wtf Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-07 13:18:49 +02:00
Greg Kroah-Hartman	f520ca124c	This is the 5.4.44 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7XQXMACgkQONu9yGCS aT4OHw//YYuI/61rkff6/3qAE4gDwTZolVywu5HHzT5W7t7qeHPzJin2u04RBiS8 4S8Mut0RUSK/0IyB0B3S342ntia1v41Q04veWm0K90iAScScjjUapLDXC/P3StA0 iitGKJ8QFDS49+PFKFYkyXEsv6HYlDbtTmS0yxVoooSr+uqeR7m6rS1jsDsfUTaR T4tvfX8VPHkgfkfkOKCUq8/rM3uDW3lSk3JflIbPwRBQo9KvNPnfBetU9p//dCHG CB1K9K3sB6xLkKe7Ut7PlwoTq/Lc8qOma535xy3A8Iv6fVq4+hPE2jsB93WGI270 WoEZbHpon7W6g/bU+C+CGfov2zBtz1dKHfWNcK5+dEkEQjjzKvvigfUvaKjyUUKB Vo5rQ3GZQ4JsMkHEJaLOlp3/SkdRd6RV/E0YErBISNeswzqsOgTrX8mz6wfQInwd Ww7V9LKdwSD6h2DuzutUbEm1X8i8glXammWEOUuh6zzQ3+WS57R1L+Nkr/6WxpgN w2g7F0+5enUbE1kIdq5OCzY1D0gBpT1o5YlrZgdL2GF5lU1b/lhsGhV6P83fl2Mf rTGFtg5M1pNgjbUkSH3VHHof35PM9vQZ6lrYbKMCjwymVY+BcR6nsCadfLqjMGnW NCYeiAmoIVCJX7q0hONww+TevZ3T+SLUjQ2os3WzooPC51MPOAQ= =5p6V -----END PGP SIGNATURE----- Merge 5.4.44 into android-5.4-stable Changes in 5.4.44 ax25: fix setsockopt(SO_BINDTODEVICE) dpaa_eth: fix usage as DSA master, try 3 net: don't return invalid table id error when we fall back to PF_UNSPEC net: dsa: mt7530: fix roaming from DSA user ports net: ethernet: ti: cpsw: fix ASSERT_RTNL() warning during suspend __netif_receive_skb_core: pass skb by reference net: inet_csk: Fix so_reuseport bind-address cache in tb->fast* net: ipip: fix wrong address family in init error path net/mlx5: Add command entry handling completion net: mvpp2: fix RX hashing for non-10G ports net: nlmsg_cancel() if put fails for nhmsg net: qrtr: Fix passing invalid reference to qrtr_local_enqueue() net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" net sched: fix reporting the first-time use timestamp net/tls: fix race condition causing kernel panic nexthop: Fix attribute checking for groups r8152: support additional Microsoft Surface Ethernet Adapter variant sctp: Don't add the shutdown timer if its already been added sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed tipc: block BH before using dst_cache net/mlx5e: kTLS, Destroy key object after destroying the TIS net/mlx5e: Fix inner tirs handling net/mlx5: Fix memory leak in mlx5_events_init net/mlx5e: Update netdev txq on completions during closure net/mlx5: Fix error flow in case of function_setup failure net/mlx5: Annotate mutex destroy for root ns net/tls: fix encryption error checking net/tls: free record only on encryption error net: sun: fix missing release regions in cas_init_one(). net/mlx4_core: fix a memory leak bug. mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails ARM: dts: rockchip: fix phy nodename for rk3228-evb ARM: dts: rockchip: fix phy nodename for rk3229-xms6 arm64: dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts arm64: dts: rockchip: swap interrupts interrupt-names rk3399 gpu node ARM: dts: rockchip: swap clock-names of gpu nodes ARM: dts: rockchip: fix pinctrl sub nodename for spi in rk322x.dtsi gpio: tegra: mask GPIO IRQs during IRQ shutdown ALSA: usb-audio: add mapping for ASRock TRX40 Creator net: microchip: encx24j600: add missed kthread_stop gfs2: move privileged user check to gfs2_quota_lock_check gfs2: Grab glock reference sooner in gfs2_add_revoke drm/amdgpu: drop unnecessary cancel_delayed_work_sync on PG ungate drm/amd/powerplay: perform PG ungate prior to CG ungate drm/amdgpu: Use GEM obj reference for KFD BOs cachefiles: Fix race between read_waiter and read_copier involving op->to_do usb: dwc3: pci: Enable extcon driver for Intel Merrifield usb: phy: twl6030-usb: Fix a resource leak in an error handling path in 'twl6030_usb_probe()' usb: gadget: legacy: fix redundant initialization warnings net: freescale: select CONFIG_FIXED_PHY where needed IB/i40iw: Remove bogus call to netdev_master_upper_dev_get() riscv: stacktrace: Fix undefined reference to `walk_stackframe' clk: ti: am33xx: fix RTC clock parent csky: Fixup msa highest 3 bits mask csky: Fixup perf callchain unwind csky: Fixup remove duplicate irq_disable hwmon: (nct7904) Fix incorrect range of temperature limit registers cifs: Fix null pointer check in cifs_read csky: Fixup raw_copy_from_user() samples: bpf: Fix build error drivers: net: hamradio: Fix suspicious RCU usage warning in bpqether.c Input: usbtouchscreen - add support for BonXeon TP Input: evdev - call input_flush_device() on release(), not flush() Input: xpad - add custom init packet for Xbox One S controllers Input: dlink-dir685-touchkeys - fix a typo in driver name Input: i8042 - add ThinkPad S230u to i8042 reset list Input: synaptics-rmi4 - really fix attn_data use-after-free Input: synaptics-rmi4 - fix error return code in rmi_driver_probe() ARM: 8970/1: decompressor: increase tag size ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h ARM: uaccess: integrate uaccess_save and uaccess_restore ARM: uaccess: fix DACR mismatch with nested exceptions gpio: exar: Fix bad handling for ida_simple_get error path arm64: dts: mt8173: fix vcodec-enc clock soc: mediatek: cmdq: return send msg error code gpu/drm: Ingenic: Fix opaque pointer casted to wrong type IB/qib: Call kobject_put() when kobject_init_and_add() fails ARM: dts/imx6q-bx50v3: Set display interface clock parents ARM: dts: bcm2835-rpi-zero-w: Fix led polarity ARM: dts: bcm: HR2: Fix PPI interrupt types mmc: block: Fix use-after-free issue for rpmb gpio: pxa: Fix return value of pxa_gpio_probe() gpio: bcm-kona: Fix return value of bcm_kona_gpio_probe() RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe() ALSA: hwdep: fix a left shifting 1 by 31 UB bug ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC workaround ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC exec: Always set cap_ambient in cap_bprm_set_creds clk: qcom: gcc: Fix parent for gpll0_out_even ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio ALSA: hda/realtek - Add new codec supported for ALC287 libceph: ignore pool overlay and cache logic on redirects ceph: flush release queue when handling caps for unknown inode RDMA/core: Fix double destruction of uobject drm/amd/display: drop cursor position check in atomic test IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode mm,thp: stop leaking unreleased file pages mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() include/asm-generic/topology.h: guard cpumask_of_node() macro argument Revert "block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT" gpio: fix locking open drain IRQ lines iommu: Fix reference count leak in iommu_group_alloc. parisc: Fix kernel panic in mem_init() cfg80211: fix debugfs rename crash x86/syscalls: Revert "x86/syscalls: Make __X32_SYSCALL_BIT be unsigned long" mac80211: mesh: fix discovery timer re-arming issue / crash x86/dma: Fix max PFN arithmetic overflow on 32 bit systems copy_xstate_to_kernel(): don't leave parts of destination uninitialized xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input xfrm: do pskb_pull properly in __xfrm_transport_prep xfrm: remove the xfrm_state_put call becofe going to out_reset xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output xfrm interface: fix oops when deleting a x-netns interface xfrm: fix a warning in xfrm_policy_insert_list xfrm: fix a NULL-ptr deref in xfrm_local_error xfrm: fix error in comment ip_vti: receive ipip packet by calling ip_tunnel_rcv netfilter: nft_reject_bridge: enable reject with bridge vlan netfilter: ipset: Fix subcounter update skip netfilter: conntrack: make conntrack userspace helpers work again netfilter: nfnetlink_cthelper: unbreak userspace helper support netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code esp6: get the right proto for transport mode in esp6_gso_encap bnxt_en: Fix accumulation of bp->net_stats_prev. ieee80211: Fix incorrect mask for default PE duration xsk: Add overflow check for u64 division, stored into u32 qlcnic: fix missing release in qlcnic_83xx_interrupt_test. crypto: chelsio/chtls: properly set tp->lsndtime nexthops: Move code from remove_nexthop_from_groups to remove_nh_grp_entry nexthops: don't modify published nexthop groups nexthop: Expand nexthop_is_multipath in a few places ipv4: nexthop version of fib_info_nh_uses_dev net: dsa: declare lockless TX feature for slave ports bonding: Fix reference count leak in bond_sysfs_slave_add. netfilter: conntrack: comparison of unsigned in cthelper confirmation netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build perf: Make perf able to build with latest libbfd Linux 5.4.44 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Idd547df1abb0bea116f30e3224a80387529adb0b	2020-06-04 08:23:35 +02:00
Eric W. Biederman	68fe063327	exec: Always set cap_ambient in cap_bprm_set_creds ... [ Upstream commit a4ae32c71fe90794127b32d26d7ad795813b502e ] An invariant of cap_bprm_set_creds is that every field in the new cred structure that cap_bprm_set_creds might set, needs to be set every time to ensure the fields does not get a stale value. The field cap_ambient is not set every time cap_bprm_set_creds is called, which means that if there is a suid or sgid script with an interpreter that has neither the suid nor the sgid bits set the interpreter should be able to accept ambient credentials. Unfortuantely because cap_ambient is not reset to it's original value the interpreter can not accept ambient credentials. Given that the ambient capability set is expected to be controlled by the caller, I don't think this is particularly serious. But it is definitely worth fixing so the code works correctly. I have tested to verify my reading of the code is correct and the interpreter of a sgid can receive ambient capabilities with this change and cannot receive ambient capabilities without this change. Cc: stable@vger.kernel.org Cc: Andy Lutomirski <luto@kernel.org> Fixes: 58319057b7 ("capabilities: ambient capabilities") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-03 08:21:23 +02:00
Greg Kroah-Hartman	441ba323ad	Revert "ANDROID: sdcardfs: Enable modular sdcardfs" ... This reverts commit c0dbfed5ff as it is not needed now that sdcardfs is gone. Bug: 157700134 Cc: Daniel Rosenberg <drosen@google.com> Cc: Guenter Roeck <groeck@chromium.org> Cc: Alistair Strachan <astrachan@google.com> Cc: Yongqin Liu <yongqin.liu@linaro.org> Cc: Daniel Rosenberg <drosen@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia738ff19487e2e3e129d2ef17ef1f28f777bf306 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-05-29 15:08:00 +02:00
Greg Kroah-Hartman	750140e3c4	Revert "ANDROID: vfs: Add permission2 for filesystems with per mount permissions" ... This reverts commit 4fd07efd90 as it is no longer needed because sdcardfs is gone. Bug: 157700134 Cc: Daniel Rosenberg <drosen@google.com> Cc: Amit Pundir <amit.pundir@linaro.org> Cc: Alistair Strachan <astrachan@google.com> Cc: Yongqin Liu <yongqin.liu@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic48212d19abc161e6f77b1bd659878e20a830448	2020-05-29 14:48:37 +02:00
Greg Kroah-Hartman	f7b4f375c7	This is the 5.4.43 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7Oi20ACgkQONu9yGCS aT4ipBAA1Kqh2mLEcDBISubrU4CuOl/iHmkCXyF1FeF9+vJKz25whbfYO/FNYweP 2HYxGyuqLTQ0OnsfrXeEoImlxdAcWp3TjAFPgJdonLBvnVDmvlPe6Pzk1NRPhvce zU/Y1leE+LoQ7xDfICPJ9BwuwwYTRzRqMQHmIuVlsHLSiN+rextPj6vkzD+7h4ux i9VKoDvzmWuLrHmc9RYNoGxuZ5tGogBaCxI8tnzHGcm21bNVvsKZiANQ2J+6G2bJ sJwqq5tH2gZ6cJxmJ1tVyMbXLIJanNKLeBC5sDQN4rss9pU4gtyEARqVG+9RlglQ FeSlBuoaISJYYejo6aSH7nw81bTQrXexd0sH94qYqnqPlZo+OXN8vxHTaIapYEfd fjqyEblZXqpnMNVQcZOxbrYaefuIrZ9Q8pWUFTwVj34P8RNJLBIvg5gy2dlRvHbC PGLJewOXySZaXVpD5gFU349L32d4QPw9MmMU5php+LOl4idN8RlVY0pOaUuO0idH ewO+6vijLgHq/5HBO6BBToRlNUvLauoUeAaQwoHfPiuuYnGGFCZ9GEjPRsHnCBok IAKQ2Uj+IqlMy7gKVtG1ryekil7TVktrZQ1JBokRLWQPZiED84r7P1lQqPaH/4f4 GFFRhx3tekJs4LMMUEaUR019Q9ZcQMWkikT1/HpVOYUjQd55pc4= =jmiq -----END PGP SIGNATURE----- Merge 5.4.43 into android-5.4-stable Changes in 5.4.43 i2c: dev: Fix the race between the release of i2c_dev and cdev KVM: SVM: Fix potential memory leak in svm_cpu_init() ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() evm: Check also if *tfm is an error pointer in init_desc() ima: Fix return value of ima_write_policy() ubifs: fix wrong use of crypto_shash_descsize() ACPI: EC: PM: Avoid flushing EC work when EC GPE is inactive mtd: spinand: Propagate ECC information to the MTD structure fix multiplication overflow in copy_fdtable() ubifs: remove broken lazytime support i2c: fix missing pm_runtime_put_sync in i2c_device_probe iommu/amd: Fix over-read of ACPI UID from IVRS table evm: Fix a small race in init_desc() i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()' ubi: Fix seq_file usage in detailed_erase_block_info debugfs file afs: Don't unlock fetched data pages until the op completes successfully mtd: Fix mtd not registered due to nvmem name collision kbuild: avoid concurrency issue in parallel building dtbs and dtbs_check net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report() gcc-common.h: Update for GCC 10 HID: multitouch: add eGalaxTouch P80H84 support HID: alps: Add AUI1657 device ID HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV scsi: qla2xxx: Delete all sessions before unregister local nvme port configfs: fix config_item refcnt leak in configfs_rmdir() vhost/vsock: fix packet delivery order to monitoring devices aquantia: Fix the media type of AQC100 ethernet controller in the driver component: Silence bind error on -EPROBE_DEFER net/ena: Fix build warning in ena_xdp_set() scsi: ibmvscsi: Fix WARN_ON during event pool release HID: i2c-hid: reset Synaptics SYNA2393 on resume x86/mm/cpa: Flush direct map alias during cpa ibmvnic: Skip fatal error reset after passive init ftrace/selftest: make unresolved cases cause failure if --fail-unresolved set x86/apic: Move TSC deadline timer debug printk gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A keyboard-dock ceph: fix double unlock in handle_cap_export() stmmac: fix pointer check after utilization in stmmac_interrupt USB: core: Fix misleading driver bug report platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA iommu/amd: Call domain_flush_complete() in update_domain() drm/amd/display: Prevent dpcd reads with passive dongles KVM: selftests: Fix build for evmcs.h ARM: futex: Address build warning scripts/gdb: repair rb_first() and rb_last() ALSA: hda - constify and cleanup static NodeID tables ALSA: hda: patch_realtek: fix empty macro usage in if block ALSA: hda: Manage concurrent reg access more properly ALSA: hda/realtek - Add supported new mute Led for HP ALSA: hda/realtek - Add HP new mute led supported for ALC236 ALSA: hda/realtek: Add quirk for Samsung Notebook ALSA: hda/realtek - Enable headset mic of ASUS GL503VM with ALC295 ALSA: hda/realtek - Enable headset mic of ASUS UX550GE with ALC295 ALSA: hda/realtek: Enable headset mic of ASUS UX581LV with ALC295 KVM: x86: Fix pkru save/restore when guest CR4.PKE=0, move it to x86.c ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio option ALSA: pcm: fix incorrect hw_base increase ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Xtreme ALSA: hda/realtek - Add more fixup entries for Clevo machines scsi: qla2xxx: Do not log message when reading port speed via sysfs scsi: target: Put lun_ref at end of tmr processing arm64: Fix PTRACE_SYSEMU semantics drm/etnaviv: fix perfmon domain interation apparmor: Fix use-after-free in aa_audit_rule_init apparmor: fix potential label refcnt leak in aa_change_profile apparmor: Fix aa_label refcnt leak in policy_update dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()' drm/etnaviv: Fix a leak in submit_pin_objects() dmaengine: dmatest: Restore default for channel dmaengine: owl: Use correct lock in owl_dma_get_pchan() vsprintf: don't obfuscate NULL and error pointers drm/i915/gvt: Init DPLL/DDI vreg for virtual display instead of inheritance. drm/i915: Propagate error from completed fences powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE powerpc/64s: Disable STRICT_KERNEL_RWX bpf: Avoid setting bpf insns pages read-only when prog is jited kbuild: Remove debug info from kallsyms linking Revert "gfs2: Don't demote a glock until its revokes are written" media: fdp1: Fix R-Car M3-N naming in debug message staging: iio: ad2s1210: Fix SPI reading staging: kpc2000: fix error return code in kp2000_pcie_probe() staging: greybus: Fix uninitialized scalar variable iio: sca3000: Remove an erroneous 'get_device()' iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()' iio: adc: ti-ads8344: Fix channel selection misc: rtsx: Add short delay after exit from ASPM tty: serial: add missing spin_lock_init for SiFive serial console mei: release me_cl object reference ipack: tpci200: fix error return code in tpci200_register() s390/pci: Fix s390_mmio_read/write with MIO s390/kaslr: add support for R_390_JMP_SLOT relocation type device-dax: don't leak kernel memory to user space after unloading kmem rapidio: fix an error in get_user_pages_fast() error handling kasan: disable branch tracing for core runtime rxrpc: Fix the excessive initial retransmission timeout rxrpc: Fix a memory leak in rxkad_verify_response() s390/kexec_file: fix initrd location for kdump kernel flow_dissector: Drop BPF flow dissector prog ref on netns cleanup x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks iio: adc: stm32-adc: Use dma_request_chan() instead dma_request_slave_channel() iio: adc: stm32-adc: fix device used to request dma iio: adc: stm32-dfsdm: Use dma_request_chan() instead dma_request_slave_channel() iio: adc: stm32-dfsdm: fix device used to request dma rxrpc: Trace discarded ACKs rxrpc: Fix ack discard tpm: check event log version before reading final events sched/fair: Reorder enqueue/dequeue_task_fair path sched/fair: Fix reordering of enqueue/dequeue_task_fair() sched/fair: Fix enqueue_task_fair() warning some more Linux 5.4.43 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1582df67569f34c4455c482ed0eaf10fc1a34e03	2020-05-28 12:26:15 +02:00
Xiyu Yang	870a45e0b5	apparmor: Fix aa_label refcnt leak in policy_update ... commit c6b39f070722ea9963ffe756bfe94e89218c5e63 upstream. policy_update() invokes begin_current_label_crit_section(), which returns a reference of the updated aa_label object to "label" with increased refcount. When policy_update() returns, "label" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in one exception handling path of policy_update(). When aa_may_manage_policy() returns not NULL, the refcnt increased by begin_current_label_crit_section() is not decreased, causing a refcnt leak. Fix this issue by jumping to "end_section" label when aa_may_manage_policy() returns not NULL. Fixes: 5ac8c355ae ("apparmor: allow introspecting the loaded policy pre internal transform") Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-05-27 17:46:42 +02:00
Xiyu Yang	054934aa9f	apparmor: fix potential label refcnt leak in aa_change_profile ... commit a0b845ffa0d91855532b50fc040aeb2d8338dca4 upstream. aa_change_profile() invokes aa_get_current_label(), which returns a reference of the current task's label. According to the comment of aa_get_current_label(), the returned reference must be put with aa_put_label(). However, when the original object pointed by "label" becomes unreachable because aa_change_profile() returns or a new object is assigned to "label", reference count increased by aa_get_current_label() is not decreased, causing a refcnt leak. Fix this by calling aa_put_label() before aa_change_profile() return and dropping unnecessary aa_get_current_label(). Fixes: 9fcf78cca1 ("apparmor: update domain transitions that are subsets of confinement at nnp") Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-05-27 17:46:41 +02:00
Navid Emamdoost	97d817b9ef	apparmor: Fix use-after-free in aa_audit_rule_init ... commit c54d481d71c6849e044690d3960aaebc730224cc upstream. In the implementation of aa_audit_rule_init(), when aa_label_parse() fails the allocated memory for rule is released using aa_audit_rule_free(). But after this release, the return statement tries to access the label field of the rule which results in use-after-free. Before releasing the rule, copy errNo and return it after release. Fixes: 52e8c38001 ("apparmor: Fix memory leak of rule on error exit path") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-05-27 17:46:41 +02:00
Dan Carpenter	dd540f2d7c	evm: Fix a small race in init_desc() ... [ Upstream commit 8433856947217ebb5697a8ff9c4c9cad4639a2cf ] The IS_ERR_OR_NULL() function has two conditions and if we got really unlucky we could hit a race where "ptr" started as an error pointer and then was set to NULL. Both conditions would be false even though the pointer at the end was NULL. This patch fixes the problem by ensuring that "*tfm" can only be NULL or valid. I have introduced a "tmp_tfm" variable to make that work. I also reversed a condition and pulled the code in one tab. Reported-by: Roberto Sassu <roberto.sassu@huawei.com> Fixes: 53de3b080d5e ("evm: Check also if *tfm is an error pointer in init_desc()") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Roberto Sassu <roberto.sassu@huawei.com> Acked-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-05-27 17:46:17 +02:00
Roberto Sassu	48bbd44f5f	ima: Fix return value of ima_write_policy() ... [ Upstream commit 2e3a34e9f409ebe83d1af7cd2f49fca7af97dfac ] This patch fixes the return value of ima_write_policy() when a new policy is directly passed to IMA and the current policy requires appraisal of the file containing the policy. Currently, if appraisal is not in ENFORCE mode, ima_write_policy() returns 0 and leads user space applications to an endless loop. Fix this issue by denying the operation regardless of the appraisal mode. Cc: stable@vger.kernel.org # 4.10.x Fixes: 19f8a84713 ("ima: measure and appraise the IMA policy itself") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-05-27 17:46:08 +02:00
Roberto Sassu	1066327bf9	evm: Check also if *tfm is an error pointer in init_desc() ... [ Upstream commit 53de3b080d5eae31d0de219617155dcc34e7d698 ] This patch avoids a kernel panic due to accessing an error pointer set by crypto_alloc_shash(). It occurs especially when there are many files that require an unsupported algorithm, as it would increase the likelihood of the following race condition: Task A: *tfm = crypto_alloc_shash() <= error pointer Task B: if (*tfm == NULL) <= *tfm is not NULL, use it Task B: rc = crypto_shash_init(desc) <= panic Task A: *tfm = NULL This patch uses the IS_ERR_OR_NULL macro to determine whether or not a new crypto context must be created. Cc: stable@vger.kernel.org Fixes: d46eb36995 ("evm: crypto hash replaced by shash") Co-developed-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com> Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-05-27 17:46:08 +02:00
Roberto Sassu	4aedc534b6	ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() ... [ Upstream commit 0014cc04e8ec077dc482f00c87dfd949cfe2b98f ] Commit a408e4a86b ("ima: open a new file instance if no read permissions") tries to create a new file descriptor to calculate a file digest if the file has not been opened with O_RDONLY flag. However, if a new file descriptor cannot be obtained, it sets the FMODE_READ flag to file->f_flags instead of file->f_mode. This patch fixes this issue by replacing f_flags with f_mode as it was before that commit. Cc: stable@vger.kernel.org # 4.20.x Fixes: a408e4a86b ("ima: open a new file instance if no read permissions") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-05-27 17:46:08 +02:00
Greg Kroah-Hartman	e752c9f98d	This is the 5.4.39 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6yVfUACgkQONu9yGCS aT5ecRAArk5nOkbDVn/o2d/ro9+C1tHxkkQblEHUldnFhwkvhZXGONkI3G3IO0F2 W3DnLYIXesPClEHxsHirGJhsiXj1+/opZDo6PVDogW7vW3fXZEp6IjSKtTODeCk1 Yqs/DBmVxOJqYONJ4O+IPq73yJo1wIrgvp3nf+hA8jAidKKBHj/bZG16gFRfwlx8 XgT6b7UJNpEijc7sD1AkqMi5dILYnTx4X/Xd0bMZh4CXobLqCX2KFMghANOu1SZQ ttVGXBfEo+3OD1IrYVOMEM9v45lyiIfE7USS00XzWPZ4Ij4i2SU3BiBTnbldZ6xk f6gxrnsY9gc2hBuz/ua1p4BLnECBL2BiQEY5WCWTHtJUix6f/i3akUEsoEL1Nn+o vfDNqVoge8W2hpsiWK4tukeJC5LhwmIFz/yVb8P9OGA93tttZLvykvXQsayh5Qjs HQZIQtci4rffQcIDotrVK4PJdXZCnBN8MPHI3HfqYQ2I2smkYog6LWj9XrNB3mXU AEHWkjXycqCENrjEFD9ZW/i8Fc+s6PfcOnFPg62pozhcqzVtFRorqXuY8XrHd2RF sbGOE4jO05vgtLUEd9PI7DMs5csGuact+jE3WAEn+9Mbfezsq0wYsV6CU5NaV1sM co6YSdHsKjcamO/WnQ2eb5VABceXAoTPUVR8vU4Qi7zmGbYER0I= =Yc8U -----END PGP SIGNATURE----- Merge 5.4.39 into android-5.4-stable Changes in 5.4.39 dma-buf: Fix SET_NAME ioctl uapi drm/edid: Fix off-by-one in DispID DTD pixel clock drm/amd/display: Fix green screen issue after suspend drm/qxl: qxl_release leak in qxl_draw_dirty_fb() drm/qxl: qxl_release leak in qxl_hw_surface_alloc() drm/qxl: qxl_release use after free NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION btrfs: fix transaction leak in btrfs_recover_relocation btrfs: fix block group leak when removing fails btrfs: fix partial loss of prealloc extent past i_size after fsync btrfs: transaction: Avoid deadlock due to bad initialization timing of fs_info::journal_info mmc: cqhci: Avoid false "cqhci: CQE stuck on" by not open-coding timeout loop mmc: sdhci-xenon: fix annoying 1.8V regulator warning mmc: sdhci-pci: Fix eMMC driver strength for BYT-based controllers mmc: sdhci-msm: Enable host capabilities pertains to R1b response mmc: meson-mx-sdio: Set MMC_CAP_WAIT_WHILE_BUSY mmc: meson-mx-sdio: remove the broken ->card_busy() op crypto: caam - fix the address of the last entry of S/G ALSA: hda/realtek - Two front mics on a Lenovo ThinkCenter ALSA: usb-audio: Correct a typo of NuPrime DAC-10 USB ID ALSA: hda/hdmi: fix without unlocked before return ALSA: line6: Fix POD HD500 audio playback ALSA: pcm: oss: Place the plugin buffer overflow checks correctly i2c: amd-mp2-pci: Fix Oops in amd_mp2_pci_init() error handling Drivers: hv: vmbus: Fix Suspend-to-Idle for Generation-2 VM dlmfs_file_write(): fix the bogosity in handling non-zero *ppos IB/rdmavt: Always return ERR_PTR from rvt_create_mmap_info() PM: ACPI: Output correct message on target power state PM: hibernate: Freeze kernel threads in software_resume() dm verity fec: fix hash block number in verity_fec_decode dm writecache: fix data corruption when reloading the target dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath ARM: dts: imx6qdl-sr-som-ti: indicate powering off wifi is safe scsi: qla2xxx: set UNLOADING before waiting for session deletion scsi: qla2xxx: check UNLOADING before posting async work RDMA/mlx5: Set GRH fields in query QP on RoCE RDMA/mlx4: Initialize ib_spec on the stack RDMA/siw: Fix potential siw_mem refcnt leak in siw_fastreg_mr() RDMA/core: Prevent mixed use of FDs between shared ufiles RDMA/core: Fix race between destroy and release FD object RDMA/cm: Fix ordering of xa_alloc_cyclic() in ib_create_cm_id() RDMA/cm: Fix an error check in cm_alloc_id_priv() i2c: iproc: generate stop event for slave writes vfio: avoid possible overflow in vfio_iommu_type1_pin_pages vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() iommu/qcom: Fix local_base status check scsi: target/iblock: fix WRITE SAME zeroing iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system i2c: aspeed: Avoid i2c interrupt status clear race condition. ALSA: opti9xx: shut up gcc-10 range warning Fix use after free in get_tree_bdev() nvme: prevent double free in nvme_alloc_ns() error handling nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl dmaengine: dmatest: Fix iteration non-stop logic dmaengine: dmatest: Fix process hang when reading 'wait' parameter arm64: vdso: Add -fasynchronous-unwind-tables to cflags selinux: properly handle multiple messages in selinux_netlink_send() Linux 5.4.39 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I34596d5cedd9946e8220165099483c53ba1d01fb	2020-05-06 09:03:32 +02:00
Paul Moore	eeef0d9fd4	selinux: properly handle multiple messages in selinux_netlink_send() ... commit fb73974172ffaaf57a7c42f35424d9aece1a5af6 upstream. Fix the SELinux netlink_send hook to properly handle multiple netlink messages in a single sk_buff; each message is parsed and subject to SELinux access control. Prior to this patch, SELinux only inspected the first message in the sk_buff. Cc: stable@vger.kernel.org Reported-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-05-06 08:15:17 +02:00
Greg Kroah-Hartman	f933eb1eb4	ANDROID: sdcardfs: fix export symbol type ... In commit c0dbfed5ff ("ANDROID: sdcardfs: Enable modular sdcardfs") a new symbol was exported, but it should have been set as a _GPL symbol. Fix this up by properly changing the export type. Bug: 35142419 Cc: Daniel Rosenberg <drosen@google.com> Cc: Guenter Roeck <groeck@chromium.org> Cc: Alistair Strachan <astrachan@google.com> Cc: Yongqin Liu <yongqin.liu@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iab657f0c901496cf2eb59a5ee3087d76d7c14ea3	2020-04-30 12:26:30 +02:00