This is a note to let you know that I've just added the patch titled
netfilter: bridge: ebt_among: add missing match size checks
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
netfilter-bridge-ebt_among-add-missing-match-size-checks.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From c4585a2823edf4d1326da44d1524ecbfda26bb37 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw(a)strlen.de>
Date: Mon, 19 Feb 2018 03:01:45 +0100
Subject: netfilter: bridge: ebt_among: add missing match size checks
From: Florian Westphal <fw(a)strlen.de>
commit c4585a2823edf4d1326da44d1524ecbfda26bb37 upstream.
ebt_among is special, it has a dynamic match size and is exempt
from the central size checks.
Therefore it must check that the size of the match structure
provided from userspace is sane by making sure em->match_size
is at least the minimum size of the expected structure.
The module has such a check, but its only done after accessing
a structure that might be out of bounds.
tested with: ebtables -A INPUT ... \
--among-dst fe:fe:fe:fe:fe:fe
--among-dst fe:fe:fe:fe:fe:fe --among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fb,fe:fe:fe:fe:fc:fd,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe
--among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fa,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe,fe:fe:fe:fe:fe:fe
Reported-by: <syzbot+fe0b19af568972814355(a)syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw(a)strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/bridge/netfilter/ebt_among.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb,
return true;
}
+static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
+{
+ return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
+}
+
static int ebt_among_mt_check(const struct xt_mtchk_param *par)
{
const struct ebt_among_info *info = par->matchinfo;
const struct ebt_entry_match *em =
container_of(par->matchinfo, const struct ebt_entry_match, data);
- int expected_length = sizeof(struct ebt_among_info);
+ unsigned int expected_length = sizeof(struct ebt_among_info);
const struct ebt_mac_wormhash *wh_dst, *wh_src;
int err;
+ if (expected_length > em->match_size)
+ return -EINVAL;
+
wh_dst = ebt_among_wh_dst(info);
- wh_src = ebt_among_wh_src(info);
+ if (poolsize_invalid(wh_dst))
+ return -EINVAL;
+
expected_length += ebt_mac_wormhash_size(wh_dst);
+ if (expected_length > em->match_size)
+ return -EINVAL;
+
+ wh_src = ebt_among_wh_src(info);
+ if (poolsize_invalid(wh_src))
+ return -EINVAL;
+
expected_length += ebt_mac_wormhash_size(wh_src);
if (em->match_size != EBT_ALIGN(expected_length)) {
Patches currently in stable-queue which might be from fw(a)strlen.de are
queue-3.18/netfilter-ipv6-fix-use-after-free-write-in-nf_nat_ipv6_manip_pkt.patch
queue-3.18/netfilter-ebtables-config_compat-don-t-trust-userland-offsets.patch
queue-3.18/netfilter-bridge-ebt_among-add-missing-match-size-checks.patch
Hi Greg,
Please apply the following upstream commits to v4.14.y.
d1c4cb447a7e ("ASoC: Intel: Skylake: Fix jack name format substitution")
cedb6415f9ec ("ASoC: Intel: kbl: fix jack name")
Please see https://bugs.chromium.org/p/chromium/issues/detail?id=786545
for details.
Thanks,
Guenter
This is a note to let you know that I've just added the patch titled
ASoC: Intel: kbl: fix jack name
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
asoc-intel-kbl-fix-jack-name.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From cedb6415f9ece6d3368aa0ac8a433caff799792a Mon Sep 17 00:00:00 2001
From: Vinod Koul <vinod.koul(a)intel.com>
Date: Tue, 31 Oct 2017 16:47:27 +0530
Subject: ASoC: Intel: kbl: fix jack name
From: Vinod Koul <vinod.koul(a)intel.com>
commit cedb6415f9ece6d3368aa0ac8a433caff799792a upstream.
Commit d1c4cb447a7e ("ASoC: Intel: Skylake: Fix jack name format
substitution") added Jack name but erroneously added a space as well,
so remove the space in Jack name.
Fixes: d1c4cb447a7e ("ASoC: Intel: Skylake: Fix jack name format substitution")
Signed-off-by: Vinod Koul <vinod.koul(a)intel.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Cc: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
@@ -605,7 +605,7 @@ static int kabylake_card_late_probe(stru
list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
codec = pcm->codec_dai->codec;
snprintf(jack_name, sizeof(jack_name),
- "HDMI/DP, pcm=%d Jack", pcm->device);
+ "HDMI/DP,pcm=%d Jack", pcm->device);
err = snd_soc_card_jack_new(card, jack_name,
SND_JACK_AVOUT, &ctx->kabylake_hdmi[i],
NULL, 0);
Patches currently in stable-queue which might be from vinod.koul(a)intel.com are
queue-4.14/asoc-intel-skylake-fix-jack-name-format-substitution.patch
queue-4.14/asoc-intel-kbl-fix-jack-name.patch
This is a note to let you know that I've just added the patch titled
ASoC: Intel: Skylake: Fix jack name format substitution
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
asoc-intel-skylake-fix-jack-name-format-substitution.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From d1c4cb447a7efcb5608a33cdfed8ab4234378b0a Mon Sep 17 00:00:00 2001
From: Chintan Patel <chintan.m.patel(a)intel.com>
Date: Mon, 18 Sep 2017 08:43:18 -0700
Subject: ASoC: Intel: Skylake: Fix jack name format substitution
From: Chintan Patel <chintan.m.patel(a)intel.com>
commit d1c4cb447a7efcb5608a33cdfed8ab4234378b0a upstream.
Jack name is not getting formatted correctly hence resulting
in invalid name for HDMI/DP input devices.
This was recently exposed due changes brought by MST:
commit 3a13347f05fd ("ASoC: Intel: kbl: Add jack port initialize
in kbl machine drivers")
Signed-off-by: Chintan Patel <chintan.m.patel(a)intel.com>
Acked-By: Vinod Koul <vinod.koul(a)intel.com>
Signed-off-by: Mark Brown <broonie(a)kernel.org>
Cc: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
@@ -604,6 +604,8 @@ static int kabylake_card_late_probe(stru
list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) {
codec = pcm->codec_dai->codec;
+ snprintf(jack_name, sizeof(jack_name),
+ "HDMI/DP, pcm=%d Jack", pcm->device);
err = snd_soc_card_jack_new(card, jack_name,
SND_JACK_AVOUT, &ctx->kabylake_hdmi[i],
NULL, 0);
Patches currently in stable-queue which might be from chintan.m.patel(a)intel.com are
queue-4.14/asoc-intel-skylake-fix-jack-name-format-substitution.patch
This is a note to let you know that I've just added the patch titled
ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
arm-omap2-hide-omap3_save_secure_ram-on-non-omap3-builds.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 863204cfdae98626a92535ac928ad79f4d6b74ff Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd(a)arndb.de>
Date: Wed, 6 Dec 2017 14:17:17 +0100
Subject: ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
From: Arnd Bergmann <arnd(a)arndb.de>
commit 863204cfdae98626a92535ac928ad79f4d6b74ff upstream.
In configurations without CONFIG_OMAP3 but with secure RAM support,
we now run into a link failure:
arch/arm/mach-omap2/omap-secure.o: In function `omap3_save_secure_ram':
omap-secure.c:(.text+0x130): undefined reference to `save_secure_ram_context'
The omap3_save_secure_ram() function is only called from the OMAP34xx
power management code, so we can simply hide that function in the
appropriate #ifdef.
Fixes: d09220a887f7 ("ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context")
Acked-by: Tony Lindgren <tony(a)atomide.com>
Tested-by: Dan Murphy <dmurphy(a)ti.com>
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
arch/arm/mach-omap2/omap-secure.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/mach-omap2/omap-secure.c
+++ b/arch/arm/mach-omap2/omap-secure.c
@@ -73,6 +73,7 @@ phys_addr_t omap_secure_ram_mempool_base
return omap_secure_memblock_base;
}
+#if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM)
u32 omap3_save_secure_ram(void __iomem *addr, int size)
{
u32 ret;
@@ -91,6 +92,7 @@ u32 omap3_save_secure_ram(void __iomem *
return ret;
}
+#endif
/**
* rx51_secure_dispatcher: Routine to dispatch secure PPA API calls
Patches currently in stable-queue which might be from arnd(a)arndb.de are
queue-4.14/watchdog-hpwdt-fix-unused-variable-warning.patch
queue-4.14/arm-omap2-hide-omap3_save_secure_ram-on-non-omap3-builds.patch
queue-4.14/dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch
queue-4.14/objtool-fix-another-switch-table-detection-issue.patch
This is a note to let you know that I've just added the patch titled
watchdog: hpwdt: SMBIOS check
to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
watchdog-hpwdt-smbios-check.patch
and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From c42cbe41727a138905a28f8e0b00c147be77ee93 Mon Sep 17 00:00:00 2001
From: Jerry Hoemann <jerry.hoemann(a)hpe.com>
Date: Mon, 23 Oct 2017 16:46:16 -0600
Subject: watchdog: hpwdt: SMBIOS check
From: Jerry Hoemann <jerry.hoemann(a)hpe.com>
commit c42cbe41727a138905a28f8e0b00c147be77ee93 upstream.
This corrects:
commit cce78da76601 ("watchdog: hpwdt: Add check for UEFI bits")
The test on HPE SMBIOS extension type 219 record "Misc Features"
bits for UEFI support is incorrect. The definition of the Misc Features
bits in the HPE SMBIOS OEM Extensions specification (and related
firmware) was changed to use a different pair of bits to
represent UEFI supported. Howerver, a corresponding change
to Linux was missed.
Current code/platform work because the iCRU test is working.
But purpose of cce78da766 is to ensure correct functionality
on future systems where iCRU isn't supported.
Signed-off-by: Jerry Hoemann <jerry.hoemann(a)hpe.com>
Reviewed-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Guenter Roeck <linux(a)roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim(a)iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/watchdog/hpwdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -700,7 +700,7 @@ static void dmi_find_icru(const struct d
smbios_proliant_ptr = (struct smbios_proliant_info *) dm;
if (smbios_proliant_ptr->misc_features & 0x01)
is_icru = 1;
- if (smbios_proliant_ptr->misc_features & 0x408)
+ if (smbios_proliant_ptr->misc_features & 0x1400)
is_uefi = 1;
}
}
Patches currently in stable-queue which might be from jerry.hoemann(a)hpe.com are
queue-4.9/watchdog-hpwdt-fix-unused-variable-warning.patch
queue-4.9/watchdog-hpwdt-smbios-check.patch
queue-4.9/watchdog-hpwdt-remove-legacy-nmi-sourcing.patch
queue-4.9/watchdog-hpwdt-check-source-of-nmi.patch