Merge 4.19.321 into android-4.19-stable
Changes in 4.19.321 fuse: Initialize beyond-EOF page contents before setting uptodate ALSA: usb-audio: Support Yamaha P-125 quirk entry xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE dm resume: don't return EINVAL when signalled dm persistent data: fix memory allocation failure bitmap: introduce generic optimized bitmap_size() fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE selinux: fix potential counting error in avc_add_xperms_decision() drm/amdgpu: Actually check flags for all context ops. memcg_write_event_control(): fix a user-triggerable oops s390/cio: rename bitmap_size() -> idset_bitmap_size() overflow.h: Add flex_array_size() helper overflow: Implement size_t saturating arithmetic helpers btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() net/mlx5e: Correctly report errors for ethtool rx flows atm: idt77252: prevent use after free in dequeue_rx() net: dsa: vsc73xx: pass value in phy_write operation ssb: Fix division by zero issue in ssb_calc_clock_rate wifi: cw1200: Avoid processing an invalid TIM IE i2c: riic: avoid potential division by zero staging: ks7010: disable bh on tx_dev_lock binfmt_misc: cleanup on filesystem umount scsi: spi: Fix sshdr use gfs2: setattr_chown: Add missing initialization wifi: iwlwifi: abort scan when rfkill on but device enabled powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu ext4: do not trim the group with corrupted block bitmap quota: Remove BUG_ON from dqget() media: pci: cx23885: check cx23885_vdev_init() return fs: binfmt_elf_efpic: don't use missing interpreter's properties scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() net/sun3_82586: Avoid reading past buffer in debug output md: clean up invalid BUG_ON in md_ioctl parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 powerpc/boot: Handle allocation failure in simple_realloc() powerpc/boot: Only free if realloc() succeeds btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() f2fs: fix to do sanity check in update_sit_entry usb: gadget: fsl: Increase size of name buffer for endpoints Bluetooth: bnep: Fix out-of-bound access NFS: avoid infinite loop in pnfs_update_layout. openrisc: Call setup_memory() earlier in the init sequence s390/iucv: fix receive buffer virtual vs physical address confusion usb: dwc3: core: Skip setting event buffers for host only controllers irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc ext4: set the type of max_zeroout to unsigned int to avoid overflow nvmet-rdma: fix possible bad dereference when freeing rsps hrtimer: Prevent queuing of hrtimer without a function callback gtp: pull network headers in gtp_dev_xmit() block: use "unsigned long" for blk_validate_block_size(). Bluetooth: Make use of __check_timeout on hci_sched_le Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: hci_core: Fix LE quote calculation kcm: Serialise kcm_sendmsg() for the same socket. netfilter: nft_counter: Synchronize nft_counter_reset() against reader. ipv6: prevent UAF in ip6_send_skb() net: xilinx: axienet: Always disable promiscuous mode drm/msm: use drm_debug_enabled() to check for debug categories drm/msm/dpu: don't play tricks with debug macros mmc: mmc_test: Fix NULL dereference on allocation failure Bluetooth: MGMT: Add error handling to pair_device() HID: wacom: Defer calculation of resolution until resolution_code is known cxgb4: add forgotten u64 ivlan cast before shift mmc: dw_mmc: allow biu and ciu clocks to defer ALSA: timer: Relax start tick time check for slave timer elements Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Input: MT - limit max slots tools: move alignment-related macros to new <linux/align.h> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc pinctrl: single: fix potential NULL dereference in pcs_get_function() wifi: mwifiex: duplicate static structs used in driver instances dm suspend: return -ERESTARTSYS instead of -EINTR scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 media: uvcvideo: Fix integer overflow calculating timestamp ata: libata-core: Fix null pointer dereference on error cgroup/cpuset: Prevent UAF in proc_cpuset_show() memcg: enable accounting of ipc resources fbcon: Prevent that screen size is smaller than font size fbmem: Check virtual screen sizes in fb_set_var() net:rds: Fix possible deadlock in rds_message_put ida: Fix crash in ida_free when the bitmap is empty net: prevent mss overflow in skb_segment() soundwire: stream: fix programming slave ports for non-continous port maps gtp: fix a potential NULL pointer dereference net: busy-poll: use ktime_get_ns() instead of local_clock() cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller USB: serial: option: add MeiG Smart SRM825L usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: core: Prevent USB core invalid event buffer address access usb: dwc3: st: fix probed platform device ref count on probe error path usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() scsi: aacraid: Fix double-free on probe failure ipc: remove memcg accounting for sops objects in do_semtimedop() drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var Linux 4.19.321 Change-Id: I5ee663c7c3343a99e3c73dd8f663ca5c4e298478 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman
@@ -471,7 +471,7 @@ static void ida_remove(struct ida *ida, int id)
|
||||
} else {
|
||||
btmp = bitmap->bitmap;
|
||||
}
|
||||
if (!test_bit(offset, btmp))
|
||||
if (!bitmap || !test_bit(offset, btmp))
|
||||
goto err;
|
||||
|
||||
__clear_bit(offset, btmp);
|
||||
|
||||
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida)
|
||||
IDA_BUG_ON(ida, !ida_is_empty(ida));
|
||||
}
|
||||
|
||||
/*
|
||||
* Check various situations where we attempt to free an ID we don't own.
|
||||
*/
|
||||
static void ida_check_bad_free(struct ida *ida)
|
||||
{
|
||||
unsigned long i;
|
||||
|
||||
printk("vvv Ignore \"not allocated\" warnings\n");
|
||||
/* IDA is empty; all of these will fail */
|
||||
ida_free(ida, 0);
|
||||
for (i = 0; i < 31; i++)
|
||||
ida_free(ida, 1 << i);
|
||||
|
||||
/* IDA contains a single value entry */
|
||||
IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3);
|
||||
ida_free(ida, 0);
|
||||
for (i = 0; i < 31; i++)
|
||||
ida_free(ida, 1 << i);
|
||||
|
||||
/* IDA contains a single bitmap */
|
||||
IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023);
|
||||
ida_free(ida, 0);
|
||||
for (i = 0; i < 31; i++)
|
||||
ida_free(ida, 1 << i);
|
||||
|
||||
/* IDA contains a tree */
|
||||
IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1);
|
||||
ida_free(ida, 0);
|
||||
for (i = 0; i < 31; i++)
|
||||
ida_free(ida, 1 << i);
|
||||
printk("^^^ \"not allocated\" warnings over\n");
|
||||
|
||||
ida_free(ida, 3);
|
||||
ida_free(ida, 1023);
|
||||
ida_free(ida, (1 << 20) - 1);
|
||||
|
||||
IDA_BUG_ON(ida, !ida_is_empty(ida));
|
||||
}
|
||||
|
||||
static DEFINE_IDA(ida);
|
||||
|
||||
static int ida_checks(void)
|
||||
@@ -162,6 +201,7 @@ static int ida_checks(void)
|
||||
ida_check_leaf(&ida, 1024 * 64);
|
||||
ida_check_max(&ida);
|
||||
ida_check_conv(&ida);
|
||||
ida_check_bad_free(&ida);
|
||||
|
||||
printk("IDA: %u of %u tests passed\n", tests_passed, tests_run);
|
||||
return (tests_run != tests_passed) ? 0 : -EINVAL;
|
||||
|
||||
@@ -588,12 +588,110 @@ static int __init test_overflow_allocation(void)
|
||||
return err;
|
||||
}
|
||||
|
||||
struct __test_flex_array {
|
||||
unsigned long flags;
|
||||
size_t count;
|
||||
unsigned long data[];
|
||||
};
|
||||
|
||||
static int __init test_overflow_size_helpers(void)
|
||||
{
|
||||
struct __test_flex_array *obj;
|
||||
int count = 0;
|
||||
int err = 0;
|
||||
int var;
|
||||
|
||||
#define check_one_size_helper(expected, func, args...) ({ \
|
||||
bool __failure = false; \
|
||||
size_t _r; \
|
||||
\
|
||||
_r = func(args); \
|
||||
if (_r != (expected)) { \
|
||||
pr_warn("expected " #func "(" #args ") " \
|
||||
"to return %zu but got %zu instead\n", \
|
||||
(size_t)(expected), _r); \
|
||||
__failure = true; \
|
||||
} \
|
||||
count++; \
|
||||
__failure; \
|
||||
})
|
||||
|
||||
var = 4;
|
||||
err |= check_one_size_helper(20, size_mul, var++, 5);
|
||||
err |= check_one_size_helper(20, size_mul, 4, var++);
|
||||
err |= check_one_size_helper(0, size_mul, 0, 3);
|
||||
err |= check_one_size_helper(0, size_mul, 3, 0);
|
||||
err |= check_one_size_helper(6, size_mul, 2, 3);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX, 1);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX, 3);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX, -3);
|
||||
|
||||
var = 4;
|
||||
err |= check_one_size_helper(9, size_add, var++, 5);
|
||||
err |= check_one_size_helper(9, size_add, 4, var++);
|
||||
err |= check_one_size_helper(9, size_add, 9, 0);
|
||||
err |= check_one_size_helper(9, size_add, 0, 9);
|
||||
err |= check_one_size_helper(5, size_add, 2, 3);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX, 1);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX, 3);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX, -3);
|
||||
|
||||
var = 4;
|
||||
err |= check_one_size_helper(1, size_sub, var--, 3);
|
||||
err |= check_one_size_helper(1, size_sub, 4, var--);
|
||||
err |= check_one_size_helper(1, size_sub, 3, 2);
|
||||
err |= check_one_size_helper(9, size_sub, 9, 0);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_sub, 9, -3);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_sub, 0, 9);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_sub, 2, 3);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_sub, SIZE_MAX, 0);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_sub, SIZE_MAX, 10);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_sub, 0, SIZE_MAX);
|
||||
err |= check_one_size_helper(SIZE_MAX, size_sub, 14, SIZE_MAX);
|
||||
err |= check_one_size_helper(SIZE_MAX - 2, size_sub, SIZE_MAX - 1, 1);
|
||||
err |= check_one_size_helper(SIZE_MAX - 4, size_sub, SIZE_MAX - 1, 3);
|
||||
err |= check_one_size_helper(1, size_sub, SIZE_MAX - 1, -3);
|
||||
|
||||
var = 4;
|
||||
err |= check_one_size_helper(4 * sizeof(*obj->data),
|
||||
flex_array_size, obj, data, var++);
|
||||
err |= check_one_size_helper(5 * sizeof(*obj->data),
|
||||
flex_array_size, obj, data, var++);
|
||||
err |= check_one_size_helper(0, flex_array_size, obj, data, 0);
|
||||
err |= check_one_size_helper(sizeof(*obj->data),
|
||||
flex_array_size, obj, data, 1);
|
||||
err |= check_one_size_helper(7 * sizeof(*obj->data),
|
||||
flex_array_size, obj, data, 7);
|
||||
err |= check_one_size_helper(SIZE_MAX,
|
||||
flex_array_size, obj, data, -1);
|
||||
err |= check_one_size_helper(SIZE_MAX,
|
||||
flex_array_size, obj, data, SIZE_MAX - 4);
|
||||
|
||||
var = 4;
|
||||
err |= check_one_size_helper(sizeof(*obj) + (4 * sizeof(*obj->data)),
|
||||
struct_size, obj, data, var++);
|
||||
err |= check_one_size_helper(sizeof(*obj) + (5 * sizeof(*obj->data)),
|
||||
struct_size, obj, data, var++);
|
||||
err |= check_one_size_helper(sizeof(*obj), struct_size, obj, data, 0);
|
||||
err |= check_one_size_helper(sizeof(*obj) + sizeof(*obj->data),
|
||||
struct_size, obj, data, 1);
|
||||
err |= check_one_size_helper(SIZE_MAX,
|
||||
struct_size, obj, data, -3);
|
||||
err |= check_one_size_helper(SIZE_MAX,
|
||||
struct_size, obj, data, SIZE_MAX - 3);
|
||||
|
||||
pr_info("%d overflow size helper tests finished\n", count);
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
static int __init test_module_init(void)
|
||||
{
|
||||
int err = 0;
|
||||
|
||||
err |= test_overflow_calculation();
|
||||
err |= test_overflow_shift();
|
||||
err |= test_overflow_size_helpers();
|
||||
err |= test_overflow_allocation();
|
||||
|
||||
if (err) {
|
||||
|
||||
Reference in New Issue
Block a user