From patchwork Fri Oct 16 09:08:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290285 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19439C4363A for ; Fri, 16 Oct 2020 09:12:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 78F852063A for ; Fri, 16 Oct 2020 09:12:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839547; bh=rCuKaO0ItDgcez7vR2S0pKoYWlZRDIP/DdBssTSD7QY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=xd75OKvg6eoEqprMtYAJMo3C98OsiZIg1xxYU/ggXZzxteIdpjffiROVyN4YJc981 Xi5A4DhVVxJOqg6bnFrQBLbF+b4DZtkyZYgHSYbKcwPWKNIXgMeMRfKpcnh7QSkl4V 38Pmni+Sk2s4HsxbiP6xAE7U1s4rOyoN+vcUlvK0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405963AbgJPJM0 (ORCPT ); Fri, 16 Oct 2020 05:12:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:41588 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405899AbgJPJLx (ORCPT ); Fri, 16 Oct 2020 05:11:53 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DC3FE20789; Fri, 16 Oct 2020 09:11:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839513; bh=rCuKaO0ItDgcez7vR2S0pKoYWlZRDIP/DdBssTSD7QY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VETMSEPJY7niEVFz4zRlVFIoM3TkIiU/muNDHyA6ruBBADt8230xUxippYgJqGu89 y32wedirL+O3fyYz/VKcFdMAnVQPOTB/jeZ3/OI/k0daVEl4QCNfXLDazTQmSaR8/M w3ryAF06xlaSR+DDq6PXwVqQQ23hp3mUXI+mDsZY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Ben Hutchings , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 5.9 04/15] media: usbtv: Fix refcounting mixup Date: Fri, 16 Oct 2020 11:08:06 +0200 Message-Id: <20201016090437.387840662@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.170032996@linuxfoundation.org> References: <20201016090437.170032996@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Oliver Neukum commit bf65f8aabdb37bc1a785884374e919477fe13e10 upstream. The premature free in the error path is blocked by V4L refcounting, not USB refcounting. Thanks to Ben Hutchings for review. [v2] corrected attributions Signed-off-by: Oliver Neukum Fixes: 50e704453553 ("media: usbtv: prevent double free in error case") CC: stable@vger.kernel.org Reported-by: Ben Hutchings Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/usbtv/usbtv-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/media/usb/usbtv/usbtv-core.c +++ b/drivers/media/usb/usbtv/usbtv-core.c @@ -113,7 +113,8 @@ static int usbtv_probe(struct usb_interf usbtv_audio_fail: /* we must not free at this point */ - usb_get_dev(usbtv->udev); + v4l2_device_get(&usbtv->v4l2_dev); + /* this will undo the v4l2_device_get() */ usbtv_video_free(usbtv); usbtv_video_fail: From patchwork Fri Oct 16 09:08:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290281 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C79FFC43457 for ; Fri, 16 Oct 2020 09:13:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 743B720872 for ; Fri, 16 Oct 2020 09:13:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839609; bh=/UysN2AnYmczg2KD5D8HsfKr2UsfaKckj+vtchLRbi4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rebUw9eYBQAy6rxDSGsLZZEMSa6JTFJmIMC5fsQBTtmW6uECeT+6P18pN7JC8hj3S IjcnbU/yCMFCmR6DhwR//aYJFKIz1QEGwaf7Nob49fRwL2jI81/0ZTelTef3P8IFjH aEr+1mkCHJHpzFTU93MBz0t0Oor39XUSFAHQW46Y= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405961AbgJPJM0 (ORCPT ); Fri, 16 Oct 2020 05:12:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:41648 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405259AbgJPJL4 (ORCPT ); Fri, 16 Oct 2020 05:11:56 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 56BA020872; Fri, 16 Oct 2020 09:11:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839515; bh=/UysN2AnYmczg2KD5D8HsfKr2UsfaKckj+vtchLRbi4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tA8Uhux6ICXaOhKrXuhsk2YByj3ObSzPuD1T15CmFE2OMtMY9KQjYfkR4A8bNtk5+ jAEdGQzf1GHNDgUEKCVhhNZK2gooN26BsIrTEyelbXf301Jbb9p4k2+QGWCiUvtjta M+GfX5QwzkbcRpOSrjG3xNfCqHr01ploC9/21sco= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wilken Gottwalt , Johan Hovold Subject: [PATCH 5.9 05/15] USB: serial: option: add Cellient MPL200 card Date: Fri, 16 Oct 2020 11:08:07 +0200 Message-Id: <20201016090437.438027917@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.170032996@linuxfoundation.org> References: <20201016090437.170032996@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wilken Gottwalt commit 3e765cab8abe7f84cb80d4a7a973fc97d5742647 upstream. Add usb ids of the Cellient MPL200 card. Signed-off-by: Wilken Gottwalt Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/3db5418fe9e516f4b290736c5a199c9796025e3c.1601715478.git.wilken.gottwalt@mailbox.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -528,6 +528,7 @@ static void option_instat_callback(struc /* Cellient products */ #define CELLIENT_VENDOR_ID 0x2692 #define CELLIENT_PRODUCT_MEN200 0x9005 +#define CELLIENT_PRODUCT_MPL200 0x9025 /* Hyundai Petatel Inc. products */ #define PETATEL_VENDOR_ID 0x1ff4 @@ -1982,6 +1983,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, + { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200), + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) }, { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ From patchwork Fri Oct 16 09:08:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290288 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E809BC433DF for ; Fri, 16 Oct 2020 09:12:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8748D20848 for ; Fri, 16 Oct 2020 09:12:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839536; bh=yKckwfUmmqhsdO2j2KA/qh1gXICTdLHLltRHDtBq+Ys=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jrmyngIJCMFy2IYYXH027g0J3d8Lh1TRKtYgpqlUTVrHU9xphhw9AKsACnFpg3rXV wsoNE0DRTj0j5CxsCyho0g1LTJIFtXpEECAYLOVy6ZTiZWCf1aWFlkHbMg3onKgYS8 7fpaPTXhDYJ6Lpdq1Yrv5+wI3ESwY5ov9pd+FU4M= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405461AbgJPJMJ (ORCPT ); Fri, 16 Oct 2020 05:12:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:41944 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405926AbgJPJMI (ORCPT ); Fri, 16 Oct 2020 05:12:08 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 26A3921655; Fri, 16 Oct 2020 09:12:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839525; bh=yKckwfUmmqhsdO2j2KA/qh1gXICTdLHLltRHDtBq+Ys=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L7iDw1ZkJ1XmGzM6f70Xt4vv/NEEKk64Zcjry2xt3Pg+ftYOrI4qckkgwqtbfPjws DV5Lo4w8rzB2HvBN2gL2zxxs+CXpf3cTJn6Bqlmgtfs58Y9msYF6aZFEx/eNwHijjE A0vPENwixniRCbGThdgibDPj0rWSes3oeKiDoth0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Mychaela N. Falconia" , Johan Hovold Subject: [PATCH 5.9 09/15] USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters Date: Fri, 16 Oct 2020 11:08:11 +0200 Message-Id: <20201016090437.629039451@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.170032996@linuxfoundation.org> References: <20201016090437.170032996@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mychaela N. Falconia commit 6cf87e5edd9944e1d3b6efd966ea401effc304ee upstream. There exist many FT2232-based JTAG+UART adapter designs in which FT2232 Channel A is used for JTAG and Channel B is used for UART. The best way to handle them in Linux is to have the ftdi_sio driver create a ttyUSB device only for Channel B and not for Channel A: a ttyUSB device for Channel A would be bogus and will disappear as soon as the user runs OpenOCD or other applications that access Channel A for JTAG from userspace, causing undesirable noise for users. The ftdi_sio driver already has a dedicated quirk for such JTAG+UART FT2232 adapters, and it requires assigning custom USB IDs to such adapters and adding these IDs to the driver with the ftdi_jtag_quirk applied. Boutique hardware manufacturer Falconia Partners LLC has created a couple of JTAG+UART adapter designs (one buffered, one unbuffered) as part of FreeCalypso project, and this hardware is specifically made to be used with Linux hosts, with the intent that Channel A will be accessed only from userspace via appropriate applications, and that Channel B will be supported by the ftdi_sio kernel driver, presenting a standard ttyUSB device to userspace. Toward this end the hardware manufacturer will be programming FT2232 EEPROMs with custom USB IDs, specifically with the intent that these IDs will be recognized by the ftdi_sio driver with the ftdi_jtag_quirk applied. Signed-off-by: Mychaela N. Falconia [johan: insert in PID order and drop unused define] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/ftdi_sio.c | 5 +++++ drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++ 2 files changed, 12 insertions(+) --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -1037,6 +1037,11 @@ static const struct usb_device_id id_tab /* U-Blox devices */ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, + /* FreeCalypso USB adapters */ + { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { } /* Terminating entry */ }; --- a/drivers/usb/serial/ftdi_sio_ids.h +++ b/drivers/usb/serial/ftdi_sio_ids.h @@ -39,6 +39,13 @@ #define FTDI_LUMEL_PD12_PID 0x6002 +/* + * Custom USB adapters made by Falconia Partners LLC + * for FreeCalypso project, ID codes allocated to Falconia by FTDI. + */ +#define FTDI_FALCONIA_JTAG_BUF_PID 0x7150 +#define FTDI_FALCONIA_JTAG_UNBUF_PID 0x7151 + /* Sienna Serial Interface by Secyourit GmbH */ #define FTDI_SIENNA_PID 0x8348 From patchwork Fri Oct 16 09:08:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290289 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41423C433E7 for ; Fri, 16 Oct 2020 09:12:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DD60820FC3 for ; Fri, 16 Oct 2020 09:12:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839524; bh=cP5hvnB09FZDLWeFDRBDlbet7jFxupc527doXBiT/T8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=H+UAbAia+ICtbaI94z3g/A0AGXI5Zh7iJ+piTisRbJfxCZkVjsmdQarzNXc/1FK3B zqaFHcd7VPIP97UMBpCrglpoqHHB7QG+Li/GdV0Gy3Rmtz9Uz3RkttaEUjX/VbzRYN 2PCynxcuuLMaLnk+0stW3EzngzoS7qqXMf7H7V/k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2394799AbgJPJLr (ORCPT ); Fri, 16 Oct 2020 05:11:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:41178 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405856AbgJPJLe (ORCPT ); Fri, 16 Oct 2020 05:11:34 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5A3AD20789; Fri, 16 Oct 2020 09:11:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839493; bh=cP5hvnB09FZDLWeFDRBDlbet7jFxupc527doXBiT/T8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GbvrFDRB7Z4fbRs5Tt8ZYOjfJaVWu+rAkWamWnWb0osMGkwuY6qkEhSN8AmouVCOL Qqkaox9MSt/45PjwNCdjVNk7xDD4bHrgNr2kJncz5C1ny4TOozIpBQhkE1B0Ziw3sd 24NHmYyBU6fOu53/PwB8BBTn88xEFtAUSkSd5E9o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , syzbot , Tetsuo Handa Subject: [PATCH 5.9 10/15] vt_ioctl: make VT_RESIZEX behave like VT_RESIZE Date: Fri, 16 Oct 2020 11:08:12 +0200 Message-Id: <20201016090437.674530384@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.170032996@linuxfoundation.org> References: <20201016090437.170032996@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tetsuo Handa commit 988d0763361bb65690d60e2bc53a6b72777040c3 upstream. syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2], for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height larger than actual font height calculated by con_font_set() from ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates minimal amount of memory based on actual font height calculated by con_font_set(), use of vt_resizex() can cause UAF/OOB read for font data. VT_RESIZEX was introduced in Linux 1.3.3, but it is unclear that what comes to the "+ more" part, and I couldn't find a user of VT_RESIZEX. #define VT_RESIZE 0x5609 /* set kernel's idea of screensize */ #define VT_RESIZEX 0x560A /* set kernel's idea of screensize + more */ So far we are not aware of syzbot reports caused by setting non-zero value to v_vlin parameter. But given that it is possible that nobody is using VT_RESIZEX, we can try removing support for v_clin and v_vlin parameters. Therefore, this patch effectively makes VT_RESIZEX behave like VT_RESIZE, with emitting a message if somebody is still using v_clin and/or v_vlin parameters. [1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837 [2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3 Reported-by: syzbot Reported-by: syzbot Signed-off-by: Tetsuo Handa Cc: stable Link: https://lore.kernel.org/r/4933b81b-9b1a-355b-df0e-9b31e8280ab9@i-love.sakura.ne.jp Signed-off-by: Greg Kroah-Hartman --- drivers/tty/vt/vt_ioctl.c | 57 ++++++++-------------------------------------- 1 file changed, 10 insertions(+), 47 deletions(-) --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -773,58 +773,21 @@ static int vt_resizex(struct vc_data *vc if (copy_from_user(&v, cs, sizeof(struct vt_consize))) return -EFAULT; - /* FIXME: Should check the copies properly */ - if (!v.v_vlin) - v.v_vlin = vc->vc_scan_lines; - - if (v.v_clin) { - int rows = v.v_vlin / v.v_clin; - if (v.v_rows != rows) { - if (v.v_rows) /* Parameters don't add up */ - return -EINVAL; - v.v_rows = rows; - } - } - - if (v.v_vcol && v.v_ccol) { - int cols = v.v_vcol / v.v_ccol; - if (v.v_cols != cols) { - if (v.v_cols) - return -EINVAL; - v.v_cols = cols; - } - } - - if (v.v_clin > 32) - return -EINVAL; + if (v.v_vlin) + pr_info_once("\"struct vt_consize\"->v_vlin is ignored. Please report if you need this.\n"); + if (v.v_clin) + pr_info_once("\"struct vt_consize\"->v_clin is ignored. Please report if you need this.\n"); + console_lock(); for (i = 0; i < MAX_NR_CONSOLES; i++) { - struct vc_data *vcp; - - if (!vc_cons[i].d) - continue; - console_lock(); - vcp = vc_cons[i].d; - if (vcp) { - int ret; - int save_scan_lines = vcp->vc_scan_lines; - int save_font_height = vcp->vc_font.height; + vc = vc_cons[i].d; - if (v.v_vlin) - vcp->vc_scan_lines = v.v_vlin; - if (v.v_clin) - vcp->vc_font.height = v.v_clin; - vcp->vc_resize_user = 1; - ret = vc_resize(vcp, v.v_cols, v.v_rows); - if (ret) { - vcp->vc_scan_lines = save_scan_lines; - vcp->vc_font.height = save_font_height; - console_unlock(); - return ret; - } + if (vc) { + vc->vc_resize_user = 1; + vc_resize(vc, v.v_cols, v.v_rows); } - console_unlock(); } + console_unlock(); return 0; } From patchwork Fri Oct 16 09:08:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290287 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10145C43457 for ; Fri, 16 Oct 2020 09:12:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B1C9620575 for ; Fri, 16 Oct 2020 09:12:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839544; bh=OkU+ijpoJzBxsdp/VudQKEGfE7VMXl6Vmb731poS+Is=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=l+okC/VurPE2qMeIyC6Sl4vP26Dz+aWUkAwqsfHro/8aP99I5aMo+5D4P5QEg34wg XQZkIm4WBHxROgaqtvzZ1FsxEhNyxQmGVRKL+r+pCNVeUbCzv5mlDwlMkGYai81yGQ U8eW+8doaSfeAYR0bYs+g5kAp2uNHTUHwsDseX/8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405921AbgJPJME (ORCPT ); Fri, 16 Oct 2020 05:12:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:41372 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405880AbgJPJLl (ORCPT ); Fri, 16 Oct 2020 05:11:41 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B08E220872; Fri, 16 Oct 2020 09:11:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839501; bh=OkU+ijpoJzBxsdp/VudQKEGfE7VMXl6Vmb731poS+Is=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sBfcPyj1kExoRg33a/q7oQFWdb4GE05LWaL4nGD8fUtNPNhjGTU0ue0JbhFgcYDRS uU7ahG8Y2cNpim4jsWzBUgimCaEtif9Azmr58CnUch+skrCL0DL+3djz4mLfesN+ck TZNCRYUQG3YEvePgBPlWX7x+l9Y5tG1boYmt4qfs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Deucher Subject: [PATCH 5.9 13/15] Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers" Date: Fri, 16 Oct 2020 11:08:15 +0200 Message-Id: <20201016090437.824053443@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.170032996@linuxfoundation.org> References: <20201016090437.170032996@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Alex Deucher commit 2456c290a7889be492cb96092b62d16c11176f72 upstream. This regressed some working configurations so revert it. Will fix this properly for 5.9 and backport then. This reverts commit 38e0c89a19fd13f28d2b4721035160a3e66e270b. Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c @@ -796,7 +796,8 @@ static ssize_t amdgpu_set_pp_od_clk_volt tmp_str++; while (isspace(*++tmp_str)); - while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) { + while (tmp_str[0]) { + sub_str = strsep(&tmp_str, delimiter); ret = kstrtol(sub_str, 0, ¶meter[parameter_size]); if (ret) return -EINVAL; @@ -1066,7 +1067,8 @@ static ssize_t amdgpu_read_mask(const ch memcpy(buf_cpy, buf, bytes); buf_cpy[bytes] = '\0'; tmp = buf_cpy; - while ((sub_str = strsep(&tmp, delimiter)) != NULL) { + while (tmp[0]) { + sub_str = strsep(&tmp, delimiter); if (strlen(sub_str)) { ret = kstrtol(sub_str, 0, &level); if (ret) @@ -1695,7 +1697,8 @@ static ssize_t amdgpu_set_pp_power_profi i++; memcpy(buf_cpy, buf, count-i); tmp_str = buf_cpy; - while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) { + while (tmp_str[0]) { + sub_str = strsep(&tmp_str, delimiter); ret = kstrtol(sub_str, 0, ¶meter[parameter_size]); if (ret) return -EINVAL; From patchwork Fri Oct 16 09:08:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290286 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1176EC433DF for ; Fri, 16 Oct 2020 09:12:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A85DA20575 for ; Fri, 16 Oct 2020 09:12:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839546; bh=20S+Ry+wwnSQSVzsqIq4suWan8f7Ps0V3Jj1KHwM0XM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=EdhR/EXZspgCEObHg8XPafNLJoURnbP+qeFps3p+7YONDwR86/CK+z9BMlOvrwqhT /rFR5C0jLZlj8TY4BNfiIALl1bQB0tx4o3FkiYzUNV51DIsUgty60BBu7zHQWefKbf S1QIGIhmGzU1fAfXgvCsOP9x5ubkDFyljqTByg/U= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405448AbgJPJME (ORCPT ); Fri, 16 Oct 2020 05:12:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:41428 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2405384AbgJPJLo (ORCPT ); Fri, 16 Oct 2020 05:11:44 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 221B520EDD; Fri, 16 Oct 2020 09:11:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602839503; bh=20S+Ry+wwnSQSVzsqIq4suWan8f7Ps0V3Jj1KHwM0XM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jng2ZM48+/q88UCyAnNhTKAQJUiFA1K6hkB7FD/ktR5xZe5MPpjoVQeRxbTlVdFjV RX+YBRT5lXup0CQSKPL8AyxYJZLq1eikF6rKVDrLT8/4XqwecJA2M/6oGN9/Xhl8u6 G/r/T3WCqB0FES8gDO8HH0wlNyo0aTonr1LU9ADc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?kiyin_?= , Herbert Xu Subject: [PATCH 5.9 14/15] crypto: bcm - Verify GCM/CCM key length in setkey Date: Fri, 16 Oct 2020 11:08:16 +0200 Message-Id: <20201016090437.872816378@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201016090437.170032996@linuxfoundation.org> References: <20201016090437.170032996@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Herbert Xu commit 10a2f0b311094ffd45463a529a410a51ca025f27 upstream. The setkey function for GCM/CCM algorithms didn't verify the key length before copying the key and subtracting the salt length. This patch delays the copying of the key til after the verification has been done. It also adds checks on the key length to ensure that it's at least as long as the salt. Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") Cc: Reported-by: kiyin(尹亮) Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/bcm/cipher.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) --- a/drivers/crypto/bcm/cipher.c +++ b/drivers/crypto/bcm/cipher.c @@ -2930,7 +2930,6 @@ static int aead_gcm_ccm_setkey(struct cr ctx->enckeylen = keylen; ctx->authkeylen = 0; - memcpy(ctx->enckey, key, ctx->enckeylen); switch (ctx->enckeylen) { case AES_KEYSIZE_128: @@ -2946,6 +2945,8 @@ static int aead_gcm_ccm_setkey(struct cr goto badkey; } + memcpy(ctx->enckey, key, ctx->enckeylen); + flow_log(" enckeylen:%u authkeylen:%u\n", ctx->enckeylen, ctx->authkeylen); flow_dump(" enc: ", ctx->enckey, ctx->enckeylen); @@ -3000,6 +3001,10 @@ static int aead_gcm_esp_setkey(struct cr struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher); flow_log("%s\n", __func__); + + if (keylen < GCM_ESP_SALT_SIZE) + return -EINVAL; + ctx->salt_len = GCM_ESP_SALT_SIZE; ctx->salt_offset = GCM_ESP_SALT_OFFSET; memcpy(ctx->salt, key + keylen - GCM_ESP_SALT_SIZE, GCM_ESP_SALT_SIZE); @@ -3028,6 +3033,10 @@ static int rfc4543_gcm_esp_setkey(struct struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher); flow_log("%s\n", __func__); + + if (keylen < GCM_ESP_SALT_SIZE) + return -EINVAL; + ctx->salt_len = GCM_ESP_SALT_SIZE; ctx->salt_offset = GCM_ESP_SALT_OFFSET; memcpy(ctx->salt, key + keylen - GCM_ESP_SALT_SIZE, GCM_ESP_SALT_SIZE); @@ -3057,6 +3066,10 @@ static int aead_ccm_esp_setkey(struct cr struct iproc_ctx_s *ctx = crypto_aead_ctx(cipher); flow_log("%s\n", __func__); + + if (keylen < CCM_ESP_SALT_SIZE) + return -EINVAL; + ctx->salt_len = CCM_ESP_SALT_SIZE; ctx->salt_offset = CCM_ESP_SALT_OFFSET; memcpy(ctx->salt, key + keylen - CCM_ESP_SALT_SIZE, CCM_ESP_SALT_SIZE);