From: Daniel Rosenberg <drosen(a)google.com>
__configfs_open_file() used to use configfs_get_config_item, but changed
in commit b0841eefd969 ("configfs: provide exclusion between IO and
removals") to just call to_item. The error path still tries to clean up
the reference, incorrectly decrementing the ref count.
Signed-off-by: Daniel Rosenberg <drosen(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: b0841eefd969 ("configfs: provide exclusion between IO and removals")
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
v2: goto the correct out_ label as pointed out by Christoph
fs/configfs/file.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index 1f0270229d7b..da8351d1e455 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -378,7 +378,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
attr = to_attr(dentry);
if (!attr)
- goto out_put_item;
+ goto out_free_buffer;
if (type & CONFIGFS_ITEM_BIN_ATTR) {
buffer->bin_attr = to_bin_attr(dentry);
@@ -391,7 +391,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
/* Grab the module reference for this attribute if we have one */
error = -ENODEV;
if (!try_module_get(buffer->owner))
- goto out_put_item;
+ goto out_free_buffer;
error = -EACCES;
if (!buffer->item->ci_type)
@@ -435,8 +435,6 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
out_put_module:
module_put(buffer->owner);
-out_put_item:
- config_item_put(buffer->item);
out_free_buffer:
up_read(&frag->frag_sem);
kfree(buffer);
--
2.30.2
From: Daniel Rosenberg <drosen(a)google.com>
__configfs_open_file() used to use configfs_get_config_item, but changed
in commit b0841eefd969 ("configfs: provide exclusion between IO and
removals") to just call to_item. The error path still tries to clean up
the reference, incorrectly decrementing the ref count.
Signed-off-by: Daniel Rosenberg <drosen(a)google.com>
Cc: stable(a)vger.kernel.org
Fixes: b0841eefd969 ("configfs: provide exclusion between IO and removals")
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
fs/configfs/file.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index 1f0270229d7b..8b7c8a8a09f3 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -378,7 +378,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
attr = to_attr(dentry);
if (!attr)
- goto out_put_item;
+ goto out_put_module;
if (type & CONFIGFS_ITEM_BIN_ATTR) {
buffer->bin_attr = to_bin_attr(dentry);
@@ -391,7 +391,7 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
/* Grab the module reference for this attribute if we have one */
error = -ENODEV;
if (!try_module_get(buffer->owner))
- goto out_put_item;
+ goto out_put_module;
error = -EACCES;
if (!buffer->item->ci_type)
@@ -435,8 +435,6 @@ static int __configfs_open_file(struct inode *inode, struct file *file, int type
out_put_module:
module_put(buffer->owner);
-out_put_item:
- config_item_put(buffer->item);
out_free_buffer:
up_read(&frag->frag_sem);
kfree(buffer);
--
2.30.2
Hello Dmitry,
On Wed, Mar 03, 2021 at 07:32:23PM +0100, Uwe Kleine-König wrote:
> Hello,
>
> On Wed, Mar 03, 2021 at 11:13:21AM +0800, jingle wrote:
> > HI uwe:
> >
> > Please updates this patchs.
> >
> > https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git/commit/?h=ne…
> >
> > https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git/commit/?h=ne…
>
> The first was one of the two patches I already tried, but the latter
> indeed fixes my problem \o/.
>
> @Dmitry: If you don't consider your tree stable, feel free to add a
>
> Tested-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de>
>
> to e4c9062717feda88900b566463228d1c4910af6d.
Do you consider this patch for stable? I'd like to see it in Debian's
5.10 kernel and I guess I'm not the only one who would benefit from such
a backport.
Best regards
Uwe
--
Pengutronix e.K. | Uwe Kleine-König |
Industrial Linux Solutions | https://www.pengutronix.de/ |
From: Jim Lin <jilin(a)nvidia.com>
When gadget is disconnected, running sequence is like this.
. composite_disconnect
. Call trace:
usb_string_copy+0xd0/0x128
gadget_config_name_configuration_store+0x4
gadget_config_name_attr_store+0x40/0x50
configfs_write_file+0x198/0x1f4
vfs_write+0x100/0x220
SyS_write+0x58/0xa8
. configfs_composite_unbind
. configfs_composite_bind
In configfs_composite_bind, it has
"cn->strings.s = cn->configuration;"
When usb_string_copy is invoked. it would
allocate memory, copy input string, release previous pointed memory space,
and use new allocated memory.
When gadget is connected, host sends down request to get information.
Call trace:
usb_gadget_get_string+0xec/0x168
lookup_string+0x64/0x98
composite_setup+0xa34/0x1ee8
If gadget is disconnected and connected quickly, in the failed case,
cn->configuration memory has been released by usb_string_copy kfree but
configfs_composite_bind hasn't been run in time to assign new allocated
"cn->configuration" pointer to "cn->strings.s".
When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling
memory is accessed, "BUG: KASAN: use-after-free" error occurs.
Signed-off-by: Jim Lin <jilin(a)nvidia.com>
Signed-off-by: Macpaul Lin <macpaul.lin(a)mediatek.com>
Cc: stable(a)vger.kernel.org
---
Changes in v2:
Changes in v3:
- Change commit description
Changes in v4:
- Fix build error and adapt patch to kernel-5.12-rc1.
Replace definition "MAX_USB_STRING_WITH_NULL_LEN" with
"USB_MAX_STRING_WITH_NULL_LEN".
- Note: The patch v2 and v3 has been verified by
Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com>
http://spinics.net/lists/kernel/msg3840792.html
and
Macpaul Lin <macpaul.lin(a)mediatek.com> on Android kernels.
http://lkml.org/lkml/2020/6/11/8
- The patch is suggested to be applied to LTS versions.
drivers/usb/gadget/configfs.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 0d56f33..15a607c 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -97,6 +97,8 @@ struct gadget_config_name {
struct list_head list;
};
+#define USB_MAX_STRING_WITH_NULL_LEN (USB_MAX_STRING_LEN+1)
+
static int usb_string_copy(const char *s, char **s_copy)
{
int ret;
@@ -106,12 +108,16 @@ static int usb_string_copy(const char *s, char **s_copy)
if (ret > USB_MAX_STRING_LEN)
return -EOVERFLOW;
- str = kstrdup(s, GFP_KERNEL);
- if (!str)
- return -ENOMEM;
+ if (copy) {
+ str = copy;
+ } else {
+ str = kmalloc(USB_MAX_STRING_WITH_NULL_LEN, GFP_KERNEL);
+ if (!str)
+ return -ENOMEM;
+ }
+ strcpy(str, s);
if (str[ret - 1] == '\n')
str[ret - 1] = '\0';
- kfree(copy);
*s_copy = str;
return 0;
}
--
1.7.9.5
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
This is the start of the stable review cycle for the 4.4.261 release.
There are 7 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Mar 2021 13:23:09 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.261-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.261-rc1
Bjorn Helgaas <bhelgaas(a)google.com>
PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Add new force_caps module parameter
Jeffle Xu <jefflexu(a)linux.alibaba.com>
dm table: fix iterate_devices based device capability checks
Dan Carpenter <dan.carpenter(a)oracle.com>
rsxx: Return -EFAULT if copy_to_user() fails
Colin Ian King <colin.king(a)canonical.com>
ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
Thomas Schoebel-Theuer <tst(a)1und1.de>
futex: fix spin_lock() / spin_unlock_irq() imbalance
Thomas Schoebel-Theuer <tst(a)1und1.de>
futex: fix irq self-deadlock and satisfy assertion
-------------
Diffstat:
Makefile | 4 +-
drivers/block/rsxx/core.c | 8 ++--
drivers/md/dm-table.c | 83 ++++++++++++++++++++++++++---------------
drivers/pci/quirks.c | 3 ++
drivers/platform/x86/acer-wmi.c | 8 +++-
kernel/futex.c | 4 +-
sound/pci/ctxfi/cthw20k2.c | 2 +-
7 files changed, 74 insertions(+), 38 deletions(-)
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
This is the start of the stable review cycle for the 4.9.261 release.
There are 11 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Mar 2021 13:23:09 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.261-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.261-rc1
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom
Bjorn Helgaas <bhelgaas(a)google.com>
PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Add new force_caps module parameter
Andrey Ryabinin <arbn(a)yandex-team.com>
iommu/amd: Fix sleeping in atomic in increase_address_space()
Jeffle Xu <jefflexu(a)linux.alibaba.com>
dm table: fix DAX iterate_devices based device capability checks
Jeffle Xu <jefflexu(a)linux.alibaba.com>
dm table: fix iterate_devices based device capability checks
Dan Carpenter <dan.carpenter(a)oracle.com>
rsxx: Return -EFAULT if copy_to_user() fails
Colin Ian King <colin.king(a)canonical.com>
ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
Antonio Borneo <borneo.antonio(a)gmail.com>
usbip: tools: fix build error for multiple definition
Ira Weiny <ira.weiny(a)intel.com>
btrfs: fix raid6 qstripe kmap
David Sterba <dsterba(a)suse.com>
btrfs: raid56: simplify tracking of Q stripe presence
-------------
Diffstat:
Makefile | 4 +-
drivers/block/rsxx/core.c | 8 ++-
drivers/iommu/amd_iommu.c | 10 ++--
drivers/md/dm-table.c | 91 +++++++++++++++++++-----------
drivers/misc/eeprom/eeprom_93xx46.c | 15 +++++
drivers/pci/quirks.c | 3 +
drivers/platform/x86/acer-wmi.c | 8 ++-
fs/btrfs/raid56.c | 58 ++++++++-----------
include/linux/eeprom_93xx46.h | 2 +
sound/pci/ctxfi/cthw20k2.c | 2 +-
tools/usb/usbip/libsrc/usbip_host_common.c | 2 +-
11 files changed, 124 insertions(+), 79 deletions(-)
From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
This is the start of the stable review cycle for the 4.14.225 release.
There are 20 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 12 Mar 2021 13:23:09 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.225-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.225-rc1
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)somainline.org>
drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register
Aswath Govindraju <a-govindraju(a)ti.com>
misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom
Bjorn Helgaas <bhelgaas(a)google.com>
PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Add ACER_CAP_KBD_DOCK quirk for the Aspire Switch 10E SW3-016
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Add support for SW_TABLET_MODE on Switch devices
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Add ACER_CAP_SET_FUNCTION_MODE capability flag
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Add new force_caps module parameter
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Cleanup accelerometer device handling
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: acer-wmi: Cleanup ACER_CAP_FOO defines
Tsuchiya Yuto <kitakar(a)gmail.com>
mwifiex: pcie: skip cancel_work_sync() on reset failure path
Andrey Ryabinin <arbn(a)yandex-team.com>
iommu/amd: Fix sleeping in atomic in increase_address_space()
Jeffle Xu <jefflexu(a)linux.alibaba.com>
dm table: fix zoned iterate_devices based device capability checks
Jeffle Xu <jefflexu(a)linux.alibaba.com>
dm table: fix DAX iterate_devices based device capability checks
Jeffle Xu <jefflexu(a)linux.alibaba.com>
dm table: fix iterate_devices based device capability checks
Dan Carpenter <dan.carpenter(a)oracle.com>
rsxx: Return -EFAULT if copy_to_user() fails
Colin Ian King <colin.king(a)canonical.com>
ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
Antonio Borneo <borneo.antonio(a)gmail.com>
usbip: tools: fix build error for multiple definition
Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
PM: runtime: Update device status before letting suppliers suspend
Ira Weiny <ira.weiny(a)intel.com>
btrfs: fix raid6 qstripe kmap
David Sterba <dsterba(a)suse.com>
btrfs: raid56: simplify tracking of Q stripe presence
-------------
Diffstat:
Makefile | 4 +-
drivers/base/power/runtime.c | 62 ++++++----
drivers/block/rsxx/core.c | 8 +-
drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 2 -
drivers/iommu/amd_iommu.c | 10 +-
drivers/md/dm-table.c | 168 ++++++++++++---------------
drivers/misc/eeprom/eeprom_93xx46.c | 15 +++
drivers/net/wireless/marvell/mwifiex/pcie.c | 18 ++-
drivers/net/wireless/marvell/mwifiex/pcie.h | 2 +
drivers/pci/quirks.c | 3 +
drivers/platform/x86/acer-wmi.c | 169 +++++++++++++++++++++++-----
fs/btrfs/raid56.c | 58 ++++------
include/linux/eeprom_93xx46.h | 2 +
sound/pci/ctxfi/cthw20k2.c | 2 +-
tools/usb/usbip/libsrc/usbip_host_common.c | 2 +-
15 files changed, 326 insertions(+), 199 deletions(-)