The idea is to check: a) the owning user_ns of cgroup_ns, b)
capabilities in init_user_ns.
The commit 24f600856418 ("cgroup-v1: Require capabilities to set
release_agent") got this wrong in the write handler of release_agent
since it checked user_ns of the opener (may be different from the owning
user_ns of cgroup_ns).
Secondly, to avoid possibly confused deputy, the capability of the
opener must be checked.
Fixes: 24f600856418 ("cgroup-v1: Require capabilities to set release_agent")
Cc: stable(a)vger.kernel.org
Link: https://lore.kernel.org/stable/20220216121142.GB30035@blackbody.suse.cz/
Signed-off-by: Michal Koutný <mkoutny(a)suse.com>
---
kernel/cgroup/cgroup-v1.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 0e877dbcfeea..afc6c0e9c966 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -546,6 +546,7 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
char *buf, size_t nbytes, loff_t off)
{
struct cgroup *cgrp;
+ struct cgroup_file_ctx *ctx;
BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
@@ -553,8 +554,9 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
* Release agent gets called with all capabilities,
* require capabilities to set release agent.
*/
- if ((of->file->f_cred->user_ns != &init_user_ns) ||
- !capable(CAP_SYS_ADMIN))
+ ctx = of->priv;
+ if ((ctx->ns->user_ns != &init_user_ns) ||
+ !file_ns_capable(of->file, &init_user_ns, CAP_SYS_ADMIN))
return -EPERM;
cgrp = cgroup_kn_lock_live(of->kn, false);
--
2.34.1
This is the start of the stable review cycle for the 4.19.231 release.
There are 58 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.231-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.231-rc1
Marc St-Amand <mstamand(a)ciena.com>
net: macb: Align the dma and coherent dma masks
Slark Xiao <slark_xiao(a)163.com>
net: usb: qmi_wwan: Add support for Dell DW5829e
JaeSang Yoo <js.yoo.5b(a)gmail.com>
tracing: Fix tp_printk option related with tp_printk_stop_on_boot
Zoltán Böszörményi <zboszor(a)gmail.com>
ata: libata-core: Disable TRIM on M88V29
Brenda Streiff <brenda.streiff(a)ni.com>
kconfig: let 'shell' return enough output for deep path names
Christian Hewitt <christianshewitt(a)gmail.com>
arm64: dts: meson-gx: add ATF BL32 reserved-memory region
Florian Westphal <fw(a)strlen.de>
netfilter: conntrack: don't refresh sctp entries in closed state
Guo Ren <guoren(a)linux.alibaba.com>
irqchip/sifive-plic: Add missing thead,c900-plic match string
Wan Jiabing <wanjiabing(a)vivo.com>
ARM: OMAP2+: hwmod: Add of_node_put() before break
Jim Mattson <jmattson(a)google.com>
KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
Miaoqian Lin <linmq006(a)gmail.com>
Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
Kimberly Brown <kimbrownkd(a)gmail.com>
Drivers: hv: vmbus: Expose monitor data only when monitor pages are used
david regan <dregan(a)mail.com>
mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
Kamal Dasu <kdasu.kdev(a)gmail.com>
mtd: rawnand: brcmnand: Refactored code to introduce helper functions
Rafał Miłecki <rafal(a)milecki.pl>
i2c: brcmstb: fix support for DSL and CM variants
Jiasheng Jiang <jiasheng(a)iscas.ac.cn>
dmaengine: sh: rcar-dmac: Check for error num after setting mask
Eric Dumazet <edumazet(a)google.com>
net: sched: limit TC_ACT_REPEAT loops
Eliav Farber <farbere(a)amazon.com>
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Do not report writeback errors in nfs_getattr()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: LOOKUP_DIRECTORY is also ok with symlinks
Laibin Qiu <qiulaibin(a)huawei.com>
block/wbt: fix negative inflight counter when remove scsi device
Zhang Yi <yi.zhang(a)huawei.com>
ext4: check for out-of-order index extents in ext4_valid_extent_entries()
Anders Roxell <anders.roxell(a)linaro.org>
powerpc/lib/sstep: fix 'ptesync' build error
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix missing codec probe on Shenker Dock 15
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix regression on forced probe mask option
Kees Cook <keescook(a)chromium.org>
libsubcmd: Fix use-after-free for realloc(..., 0)
Eric Dumazet <edumazet(a)google.com>
bonding: fix data-races around agg_select_timer
Eric Dumazet <edumazet(a)google.com>
drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
Xin Long <lucien.xin(a)gmail.com>
ping: fix the dif and sdif check in ping_lookup
Miquel Raynal <miquel.raynal(a)bootlin.com>
net: ieee802154: ca8210: Fix lifs/sifs periods
Mans Rullgard <mans(a)mansr.com>
net: dsa: lan9303: fix reset on probe
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: gen2: fix locking when "HW not ready"
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: fix locking when "HW not ready"
Seth Forshee <sforshee(a)digitalocean.com>
vsock: remove vsock from connected table when connect is interrupted by a signal
Christian Löhle <CLoehle(a)hyperstone.com>
mmc: block: fix read single on recovery logic
Eric W. Biederman <ebiederm(a)xmission.com>
taskstats: Cleanup the use of task->exit_code
Guillaume Nault <gnault(a)redhat.com>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
Nicholas Bishop <nicholasbishop(a)google.com>
drm/radeon: Fix backlight control on iMac 12,1
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: fix use-after-free
Igor Pylypiv <ipylypiv(a)google.com>
Revert "module, async: async_synchronize_full() on module init iff async is used"
Sagi Grimberg <sagi(a)grimberg.me>
nvme-rdma: fix possible use-after-free in transport error_recovery work
Sagi Grimberg <sagi(a)grimberg.me>
nvme: fix a possible use-after-free in controller reset during load
Darrick J. Wong <djwong(a)kernel.org>
quota: make dquot_quota_sync return errors from ->sync_fs
Darrick J. Wong <djwong(a)kernel.org>
vfs: make freeze_super abort when sync_filesystem returns error
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: improve the incomplete fix to avoid UAF and NPD bugs
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Adapt the situation that /dev/zram0 is being used
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram01.sh: Fix compression ratio calculation
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Skip max_comp_streams interface on newer kernel
Miquel Raynal <miquel.raynal(a)bootlin.com>
net: ieee802154: at86rf230: Stop leaking skb's
Dāvis Mosāns <davispuh(a)gmail.com>
btrfs: send: in case of IO error log it
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix sglist access in ccio-dma.c
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix data TLB miss in sba_unmap_sg
Randy Dunlap <rdunlap(a)infradead.org>
serial: parisc: GSC: fix build when IOSAPIC is not set
Jann Horn <jannh(a)google.com>
net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
Nathan Chancellor <nathan(a)kernel.org>
Makefile.extrawarn: Move -Wunaligned-access to W=1
-------------
Diffstat:
Documentation/ABI/stable/sysfs-bus-vmbus | 12 +-
Makefile | 4 +-
arch/arm/mach-omap2/omap_hwmod.c | 4 +-
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +
arch/powerpc/lib/sstep.c | 2 +
arch/x86/kvm/pmu.c | 2 +-
block/bfq-iosched.c | 2 +
block/elevator.c | 2 -
drivers/ata/libata-core.c | 1 +
drivers/dma/sh/rcar-dmac.c | 4 +-
drivers/edac/edac_mc.c | 2 +-
drivers/gpu/drm/radeon/atombios_encoders.c | 3 +-
drivers/hv/channel_mgmt.c | 1 +
drivers/hv/hyperv_vmbus.h | 2 +
drivers/hv/vmbus_drv.c | 82 ++++++++++++-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/irqchip/irq-sifive-plic.c | 1 +
drivers/mmc/core/block.c | 28 ++---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 102 ++++++++++------
drivers/mtd/nand/raw/qcom_nandc.c | 14 +--
drivers/net/bonding/bond_3ad.c | 30 ++++-
drivers/net/dsa/lan9303-core.c | 2 +-
drivers/net/ethernet/cadence/macb_main.c | 2 +-
drivers/net/ieee802154/at86rf230.c | 13 +-
drivers/net/ieee802154/ca8210.c | 4 +-
drivers/net/usb/ax88179_178a.c | 68 ++++++-----
drivers/net/usb/qmi_wwan.c | 2 +
drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +
.../net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 3 +-
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +-
drivers/nvme/host/core.c | 9 +-
drivers/nvme/host/rdma.c | 1 +
drivers/parisc/ccio-dma.c | 3 +-
drivers/parisc/sba_iommu.c | 3 +-
drivers/tty/serial/8250/8250_gsc.c | 2 +-
fs/btrfs/send.c | 4 +
fs/ext4/extents.c | 21 ++--
fs/nfs/dir.c | 4 +-
fs/nfs/inode.c | 9 +-
fs/quota/dquot.c | 11 +-
fs/super.c | 19 +--
include/linux/sched.h | 1 -
include/net/bond_3ad.h | 2 +-
kernel/async.c | 3 -
kernel/module.c | 25 +---
kernel/trace/trace.c | 4 +
kernel/tsacct.c | 7 +-
net/ax25/af_ax25.c | 9 +-
net/core/drop_monitor.c | 11 +-
net/ipv4/ping.c | 11 +-
net/ipv4/xfrm4_policy.c | 3 +-
net/netfilter/nf_conntrack_proto_sctp.c | 9 ++
net/sched/act_api.c | 13 +-
net/vmw_vsock/af_vsock.c | 1 +
scripts/Makefile.extrawarn | 1 +
scripts/kconfig/preprocess.c | 2 +-
sound/pci/hda/hda_intel.c | 5 +-
sound/soc/soc-ops.c | 29 +++--
tools/lib/subcmd/subcmd-util.h | 11 +-
tools/testing/selftests/zram/zram.sh | 15 +--
tools/testing/selftests/zram/zram01.sh | 33 ++---
tools/testing/selftests/zram/zram02.sh | 1 -
tools/testing/selftests/zram/zram_lib.sh | 134 ++++++++++++++-------
63 files changed, 526 insertions(+), 295 deletions(-)
This is the start of the stable review cycle for the 4.9.303 release.
There are 33 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.303-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.303-rc1
Slark Xiao <slark_xiao(a)163.com>
net: usb: qmi_wwan: Add support for Dell DW5829e
JaeSang Yoo <js.yoo.5b(a)gmail.com>
tracing: Fix tp_printk option related with tp_printk_stop_on_boot
Zoltán Böszörményi <zboszor(a)gmail.com>
ata: libata-core: Disable TRIM on M88V29
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: Do not report writeback errors in nfs_getattr()
Jim Mattson <jmattson(a)google.com>
KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
Rafał Miłecki <rafal(a)milecki.pl>
i2c: brcmstb: fix support for DSL and CM variants
Eliav Farber <farbere(a)amazon.com>
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFS: LOOKUP_DIRECTORY is also ok with symlinks
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
Mark Brown <broonie(a)kernel.org>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix missing codec probe on Shenker Dock 15
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda: Fix regression on forced probe mask option
Kees Cook <keescook(a)chromium.org>
libsubcmd: Fix use-after-free for realloc(..., 0)
Eric Dumazet <edumazet(a)google.com>
drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: fix locking when "HW not ready"
Seth Forshee <sforshee(a)digitalocean.com>
vsock: remove vsock from connected table when connect is interrupted by a signal
Sunil Muthuswamy <sunilmut(a)microsoft.com>
vsock: correct removal of socket from the list
Eric W. Biederman <ebiederm(a)xmission.com>
taskstats: Cleanup the use of task->exit_code
Guillaume Nault <gnault(a)redhat.com>
xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
Nicholas Bishop <nicholasbishop(a)google.com>
drm/radeon: Fix backlight control on iMac 12,1
Darrick J. Wong <djwong(a)kernel.org>
quota: make dquot_quota_sync return errors from ->sync_fs
Darrick J. Wong <djwong(a)kernel.org>
vfs: make freeze_super abort when sync_filesystem returns error
Duoming Zhou <duoming(a)zju.edu.cn>
ax25: improve the incomplete fix to avoid UAF and NPD bugs
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Adapt the situation that /dev/zram0 is being used
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram01.sh: Fix compression ratio calculation
Yang Xu <xuyang2018.jy(a)fujitsu.com>
selftests/zram: Skip max_comp_streams interface on newer kernel
Miquel Raynal <miquel.raynal(a)bootlin.com>
net: ieee802154: at86rf230: Stop leaking skb's
Dāvis Mosāns <davispuh(a)gmail.com>
btrfs: send: in case of IO error log it
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix sglist access in ccio-dma.c
John David Anglin <dave.anglin(a)bell.net>
parisc: Fix data TLB miss in sba_unmap_sg
Randy Dunlap <rdunlap(a)infradead.org>
serial: parisc: GSC: fix build when IOSAPIC is not set
Jann Horn <jannh(a)google.com>
net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
Nathan Chancellor <nathan(a)kernel.org>
Makefile.extrawarn: Move -Wunaligned-access to W=1
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kvm/pmu.c | 2 +-
drivers/ata/libata-core.c | 1 +
drivers/edac/edac_mc.c | 2 +-
drivers/gpu/drm/radeon/atombios_encoders.c | 3 +-
drivers/i2c/busses/i2c-brcmstb.c | 2 +-
drivers/net/ieee802154/at86rf230.c | 13 ++-
drivers/net/usb/ax88179_178a.c | 68 +++++++-----
drivers/net/usb/qmi_wwan.c | 2 +
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +-
drivers/parisc/ccio-dma.c | 3 +-
drivers/parisc/sba_iommu.c | 3 +-
drivers/tty/serial/8250/8250_gsc.c | 2 +-
fs/btrfs/send.c | 4 +
fs/nfs/dir.c | 4 +-
fs/nfs/inode.c | 7 +-
fs/quota/dquot.c | 11 +-
fs/super.c | 19 ++--
kernel/trace/trace.c | 4 +
kernel/tsacct.c | 7 +-
net/ax25/af_ax25.c | 9 +-
net/core/drop_monitor.c | 11 +-
net/ipv4/xfrm4_policy.c | 3 +-
net/vmw_vsock/af_vsock.c | 39 ++-----
scripts/Makefile.extrawarn | 1 +
sound/pci/hda/hda_intel.c | 5 +-
sound/soc/soc-ops.c | 29 +++--
tools/lib/subcmd/subcmd-util.h | 11 +-
tools/testing/selftests/zram/zram.sh | 15 +--
tools/testing/selftests/zram/zram01.sh | 33 ++----
tools/testing/selftests/zram/zram02.sh | 1 -
tools/testing/selftests/zram/zram_lib.sh | 134 ++++++++++++++++--------
32 files changed, 250 insertions(+), 205 deletions(-)
The driver_override field from platform driver should not be initialized
from const memory because the core later kfree() it, for example when
driver_override is set via sysfs.
Fixes: 77d8f3068c63 ("clk: imx: scu: add two cells binding support")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com>
---
drivers/clk/imx/clk-scu.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/imx/clk-scu.c b/drivers/clk/imx/clk-scu.c
index 083da31dc3ea..78ed40a0e3e2 100644
--- a/drivers/clk/imx/clk-scu.c
+++ b/drivers/clk/imx/clk-scu.c
@@ -683,7 +683,11 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name,
return ERR_PTR(ret);
}
- pdev->driver_override = "imx-scu-clk";
+ pdev->driver_override = kstrdup("imx-scu-clk", GFP_KERNEL);
+ if (!pdev->driver_override) {
+ platform_device_put(pdev);
+ return ERR_PTR(-ENOMEM);
+ }
ret = imx_clk_scu_attach_pd(&pdev->dev, rsrc_id);
if (ret)
--
2.32.0
--
I want to invest in your country
Greetings Sir/Madam.
May i use this medium to open a mutual communication with you, and
seeking your acceptance towards investing in your country under your
management as my partner, My name is Aisha Gaddafi , i am a Widow and
single Mother with three Children, the only biological Daughter of
late Libyan President (Late Colonel Muammar Gaddafi) and presently i
am under political asylum protection by the Government of this
nation.
I have funds worth “Twenty Seven Million Five Hundred Thousand United
State Dollars” -$27.500.000.00 US Dollars which i want to entrust on
you for investment project in your country. If you are willing to
handle this project on my behalf, kindly reply urgent to enable me
provide you more details to start the transfer process.
I shall appreciate your urgent response through my email address
below: gaddafi.mrsaisha(a)bk.ru
Thanks
Yours Truly Aisha