Commit fae8df0f authored by Salvatore Bonaccorso's avatar Salvatore Bonaccorso

Update to 4.19.13

Drop iomap-Revert-fs-iomap.c-get-put-the-page-in-iomap_pa.patch

Drop usb-hso-fix-oob-memory-access-in-hso_probe-hso_get_config_data.patch

Add bug closer for #917569

Cleanup debian/changelog file
parent f8450c79
linux (4.19.12-2) UNRELEASED; urgency=medium
linux (4.19.13-1) UNRELEASED; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.13
- Revert "vfs: Allow userns root to call mknod on owned filesystems."
- USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
(CVE-2018-19985)
- xhci: Don't prevent USB2 bus suspend in state check intended for USB3
only
- USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd
- USB: serial: option: add GosunCn ZTE WeLink ME3630
- USB: serial: option: add HP lt4132
- USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
- USB: serial: option: add Fibocom NL668 series
- USB: serial: option: add Telit LN940 series
- ubifs: Handle re-linking of inodes correctly while recovery
- scsi: t10-pi: Return correct ref tag when queue has no integrity profile
- scsi: sd: use mempool for discard special page
- mmc: core: Reset HPI enabled state during re-init and in case of errors
- mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support
- mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl
- [armhf] mmc: omap_hsmmc: fix DMA API warning
- gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers
- posix-timers: Fix division by zero bug
- [x86] KVM: Fix NULL deref in vcpu_scan_ioapic
- [x86] kvm: Add AMD's EX_CFG to the list of ignored MSRs
- [x86] KVM: Fix UAF in nested posted interrupt processing
- [x86] Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened
channels
- futex: Cure exit race
- [x86] mtrr: Don't copy uninitialized gentry fields back to userspace
- [x86] mm: Fix decoy address handling vs 32-bit builds (Closes: #917569)
- [x86] vdso: Pass --eh-frame-hdr to the linker
- panic: avoid deadlocks in re-entrant console drivers
- mm: add mm_pxd_folded checks to pgtable_bytes accounting functions
- mm: make the __PAGETABLE_PxD_FOLDED defines non-empty
- mm: introduce mm_[p4d|pud|pmd]_folded
- xfrm_user: fix freeing of xfrm states on acquire
- rtlwifi: Fix leak of skb when processing C2H_BT_INFO
- iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares
- Revert "mwifiex: restructure rx_reorder_tbl_lock usage"
- iwlwifi: add new cards for 9560, 9462, 9461 and killer series
- mm, memory_hotplug: initialize struct pages for the full memory section
- mm: thp: fix flags for pmd migration when split
- mm, page_alloc: fix has_unmovable_pages for HugePages
- mm: don't miss the last page because of round-off error
- Input: elantech - disable elan-i2c for P52 and P72
- proc/sysctl: don't return ENOMEM on lookup when a table is unregistering
- drm/ioctl: Fix Spectre v1 vulnerabilities
[ Uwe Kleine-König ]
* [armhf] enable some kconfig items for Allwinner SoCs (SUNXI_CCU=y,
......@@ -17,10 +65,6 @@ linux (4.19.12-2) UNRELEASED; urgency=medium
* Fix pycodestyle "line break after binary operator" warnings
* Fix pycodestyle "inalid escape sequence" warnings
[ Salvatore Bonaccorso ]
* USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
(CVE-2018-19985)
[ Romain Perier ]
* [rt] Update to 4.19.10-rt8
......
From: Dave Chinner <dchinner@redhat.com>
Date: Thu, 20 Dec 2018 23:23:24 +1100
Subject: iomap: Revert "fs/iomap.c: get/put the page in
iomap_page_create/release()"
Origin: https://git.kernel.org/linus/a837eca2412051628c0529768c9bc4f3580b040e
This reverts commit 61c6de667263184125d5ca75e894fcad632b0dd3.
The reverted commit added page reference counting to iomap page
structures that are used to track block size < page size state. This
was supposed to align the code with page migration page accounting
assumptions, but what it has done instead is break XFS filesystems.
Every fstests run I've done on sub-page block size XFS filesystems
has since picking up this commit 2 days ago has failed with bad page
state errors such as:
# ./run_check.sh "-m rmapbt=1,reflink=1 -i sparse=1 -b size=1k" "generic/038"
....
SECTION -- xfs
FSTYP -- xfs (debug)
PLATFORM -- Linux/x86_64 test1 4.20.0-rc6-dgc+
MKFS_OPTIONS -- -f -m rmapbt=1,reflink=1 -i sparse=1 -b size=1k /dev/sdc
MOUNT_OPTIONS -- /dev/sdc /mnt/scratch
generic/038 454s ...
run fstests generic/038 at 2018-12-20 18:43:05
XFS (sdc): Unmounting Filesystem
XFS (sdc): Mounting V5 Filesystem
XFS (sdc): Ending clean mount
BUG: Bad page state in process kswapd0 pfn:3a7fa
page:ffffea0000ccbeb0 count:0 mapcount:0 mapping:ffff88800d9b6360 index:0x1
flags: 0xfffffc0000000()
raw: 000fffffc0000000 dead000000000100 dead000000000200 ffff88800d9b6360
raw: 0000000000000001 0000000000000000 00000000ffffffff
page dumped because: non-NULL mapping
CPU: 0 PID: 676 Comm: kswapd0 Not tainted 4.20.0-rc6-dgc+ #915
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014
Call Trace:
dump_stack+0x67/0x90
bad_page.cold.116+0x8a/0xbd
free_pcppages_bulk+0x4bf/0x6a0
free_unref_page_list+0x10f/0x1f0
shrink_page_list+0x49d/0xf50
shrink_inactive_list+0x19d/0x3b0
shrink_node_memcg.constprop.77+0x398/0x690
? shrink_slab.constprop.81+0x278/0x3f0
shrink_node+0x7a/0x2f0
kswapd+0x34b/0x6d0
? node_reclaim+0x240/0x240
kthread+0x11f/0x140
? __kthread_bind_mask+0x60/0x60
ret_from_fork+0x24/0x30
Disabling lock debugging due to kernel taint
....
The failures are from anyway that frees pages and empties the
per-cpu page magazines, so it's not a predictable failure or an easy
to debug failure.
generic/038 is a reliable reproducer of this problem - it has a 9 in
10 failure rate on one of my test machines. Failure on other
machines have been at random points in fstests runs but every run
has ended up tripping this problem. Hence generic/038 was used to
bisect the failure because it was the most reliable failure.
It is too close to the 4.20 release (not to mention holidays) to
try to diagnose, fix and test the underlying cause of the problem,
so reverting the commit is the only option we have right now. The
revert has been tested against a current tot 4.20-rc7+ kernel across
multiple machines running sub-page block size XFs filesystems and
none of the bad page state failures have been seen.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Cc: Piotr Jaroszynski <pjaroszynski@nvidia.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: William Kucharski <william.kucharski@oracle.com>
Cc: Darrick J. Wong <darrick.wong@oracle.com>
Cc: Brian Foster <bfoster@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---
fs/iomap.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/fs/iomap.c b/fs/iomap.c
index 5bc172f3dfe8..d6bc98ae8d35 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -116,12 +116,6 @@ iomap_page_create(struct inode *inode, struct page *page)
atomic_set(&iop->read_count, 0);
atomic_set(&iop->write_count, 0);
bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
-
- /*
- * migrate_page_move_mapping() assumes that pages with private data have
- * their count elevated by 1.
- */
- get_page(page);
set_page_private(page, (unsigned long)iop);
SetPagePrivate(page);
return iop;
@@ -138,7 +132,6 @@ iomap_page_release(struct page *page)
WARN_ON_ONCE(atomic_read(&iop->write_count));
ClearPagePrivate(page);
set_page_private(page, 0);
- put_page(page);
kfree(iop);
}
--
2.20.1
From: Hui Peng <benquike@gmail.com>
Date: Wed, 12 Dec 2018 12:42:24 +0100
Subject: USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
Origin: https://git.kernel.org/linus/5146f95df782b0ac61abde36567e718692725c89
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-19985
The function hso_probe reads if_num from the USB device (as an u8) and uses
it without a length check to index an array, resulting in an OOB memory read
in hso_probe or hso_get_config_data.
Add a length check for both locations and updated hso_probe to bail on
error.
This issue has been assigned CVE-2018-19985.
Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/usb/hso.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 184c24baca15..d6916f787fce 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface)
return -EIO;
}
+ /* check if we have a valid interface */
+ if (if_num > 16) {
+ kfree(config_data);
+ return -EINVAL;
+ }
+
switch (config_data[if_num]) {
case 0x0:
result = 0;
@@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface,
/* Get the interface/port specification from either driver_info or from
* the device itself */
- if (id->driver_info)
+ if (id->driver_info) {
+ /* if_num is controlled by the device, driver_info is a 0 terminated
+ * array. Make sure, the access is in bounds! */
+ for (i = 0; i <= if_num; ++i)
+ if (((u32 *)(id->driver_info))[i] == 0)
+ goto exit;
port_spec = ((u32 *)(id->driver_info))[if_num];
- else
+ } else {
port_spec = hso_get_config_data(interface);
+ if (port_spec < 0)
+ goto exit;
+ }
/* Check if we need to switch to alt interfaces prior to port
* configuration */
--
2.20.1
......@@ -99,7 +99,6 @@ bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch
bugfix/all/kbuild-include-addtree-remove-quotes-before-matching-path.patch
debian/revert-objtool-fix-config_stack_validation-y-warning.patch
bugfix/all/iomap-Revert-fs-iomap.c-get-put-the-page-in-iomap_pa.patch
# Miscellaneous features
......@@ -139,7 +138,6 @@ features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
# Security fixes
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
bugfix/all/usb-hso-fix-oob-memory-access-in-hso_probe-hso_get_config_data.patch
# Fix exported symbol versions
bugfix/all/module-disable-matching-missing-version-crc.patch
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment