From patchwork Mon May 4 17:57:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226440 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDED3C47257 for ; Mon, 4 May 2020 17:59:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CE69520707 for ; Mon, 4 May 2020 17:59:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615183; bh=wRkYzBLk0vUVQRuUS+lFzvR6kc1EqVlOI6UkZWW2SN8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=lk1KzrDjyXL5Ikhz42d8xuJ3HuwCpWgzt7hlcrYy3gIG6+tgWRv9Xo+NQuTOL+/Ru WQxhH3m7/uNxAGClEGjCp96WzdHmDVnujbHERk4ykzOaWxd/yrOK6EPHCtKi4QDaAT VeqbwW7NyipjFepO2i6QDEKGwyXpdazwbeHhK/jw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730838AbgEDR7i (ORCPT ); Mon, 4 May 2020 13:59:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:53376 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730833AbgEDR7h (ORCPT ); Mon, 4 May 2020 13:59:37 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 04D502073B; Mon, 4 May 2020 17:59:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615177; bh=wRkYzBLk0vUVQRuUS+lFzvR6kc1EqVlOI6UkZWW2SN8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k06qAPRYsUuFU+Z29hbgZ8z/c/h3w/aobEtUVs6V1CcxvKPhUpUdN4K4Op1loeWij VKu/loCF0OuALQfPMWSJrqZ6m4ioR0t2jzpRvKqF+KTvkY/mpOzQpmkIeKzDkyN7GQ HSgAxCw0mJTZn8ln9NJhUl7nI1wVFXBrXfYw2BEo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasily Averin , Gerd Hoffmann Subject: [PATCH 4.9 03/18] drm/qxl: qxl_release leak in qxl_draw_dirty_fb() Date: Mon, 4 May 2020 19:57:13 +0200 Message-Id: <20200504165442.672704864@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vasily Averin commit 85e9b88af1e6164f19ec71381efd5e2bcfc17620 upstream. ret should be changed to release allocated struct qxl_release Cc: stable@vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin Link: http://patchwork.freedesktop.org/patch/msgid/22cfd55f-07c8-95d0-a2f7-191b7153c3d4@virtuozzo.com Signed-off-by: Gerd Hoffmann Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/qxl/qxl_draw.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -348,9 +348,10 @@ void qxl_draw_dirty_fb(struct qxl_device goto out_release_backoff; rects = drawable_set_clipping(qdev, num_clips, clips_bo); - if (!rects) + if (!rects) { + ret = -EINVAL; goto out_release_backoff; - + } drawable = (struct qxl_drawable *)qxl_release_map(qdev, release); drawable->clip.type = SPICE_CLIP_TYPE_RECTS; From patchwork Mon May 4 17:57:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226340 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43CB7C4724C for ; Mon, 4 May 2020 18:15:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2778B20705 for ; Mon, 4 May 2020 18:15:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588616114; bh=W2Ffas+nZMrihNOOgOWnoqgXgERFK+vJJddkK6R9I/Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VM/jGIbMw6e7YVKuqM4lhy4XDBn5XrPKAv+2ajkQGzFn4XzxTxXkUS+JblkWxFDMt xYbZEazbTDpEkkPP+FQ72Daxlk0jT7u7nl5BQXTLq8YUKLrfZbstA6H2W062dbOvPc GuiTeAtf7sAguLOMOppWgTMzW4MN+W2f/d7VdjKQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730912AbgEDSPK (ORCPT ); Mon, 4 May 2020 14:15:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:53542 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730851AbgEDR7n (ORCPT ); Mon, 4 May 2020 13:59:43 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D226E20663; Mon, 4 May 2020 17:59:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615182; bh=W2Ffas+nZMrihNOOgOWnoqgXgERFK+vJJddkK6R9I/Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dxsGftKeIDNfbyxZZlRXe6xfIlgg/5bTC6s8sz/Aa+r2Ter+Oi6dxX7iqPOUPS4Ie RGysXUgopr5dLQBZbpjL3DekgydzzyGPnjUQm0qGI72ufQJgXvf9DTaWOxQT2pFooe FmyWvW9Cq5YdQNnXAXq8yAHjgi8xI/Cr6jtD3ECI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiyu Yang , Xin Tan , David Sterba Subject: [PATCH 4.9 05/18] btrfs: fix block group leak when removing fails Date: Mon, 4 May 2020 19:57:15 +0200 Message-Id: <20200504165443.251593903@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Xiyu Yang commit f6033c5e333238f299c3ae03fac8cc1365b23b77 upstream. btrfs_remove_block_group() invokes btrfs_lookup_block_group(), which returns a local reference of the block group that contains the given bytenr to "block_group" with increased refcount. When btrfs_remove_block_group() returns, "block_group" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in several exception handling paths of btrfs_remove_block_group(). When those error scenarios occur such as btrfs_alloc_path() returns NULL, the function forgets to decrease its refcnt increased by btrfs_lookup_block_group() and will cause a refcnt leak. Fix this issue by jumping to "out_put_group" label and calling btrfs_put_block_group() when those error scenarios occur. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Xiyu Yang Signed-off-by: Xin Tan Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/extent-tree.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -10645,7 +10645,7 @@ int btrfs_remove_block_group(struct btrf path = btrfs_alloc_path(); if (!path) { ret = -ENOMEM; - goto out; + goto out_put_group; } /* @@ -10684,7 +10684,7 @@ int btrfs_remove_block_group(struct btrf ret = btrfs_orphan_add(trans, inode); if (ret) { btrfs_add_delayed_iput(inode); - goto out; + goto out_put_group; } clear_nlink(inode); /* One for the block groups ref */ @@ -10707,13 +10707,13 @@ int btrfs_remove_block_group(struct btrf ret = btrfs_search_slot(trans, tree_root, &key, path, -1, 1); if (ret < 0) - goto out; + goto out_put_group; if (ret > 0) btrfs_release_path(path); if (ret == 0) { ret = btrfs_del_item(trans, tree_root, path); if (ret) - goto out; + goto out_put_group; btrfs_release_path(path); } @@ -10871,9 +10871,9 @@ int btrfs_remove_block_group(struct btrf ret = remove_block_group_free_space(trans, root->fs_info, block_group); if (ret) - goto out; + goto out_put_group; - btrfs_put_block_group(block_group); + /* Once for the block groups rbtree */ btrfs_put_block_group(block_group); ret = btrfs_search_slot(trans, root, &key, path, -1, 1); @@ -10883,6 +10883,10 @@ int btrfs_remove_block_group(struct btrf goto out; ret = btrfs_del_item(trans, root, path); + +out_put_group: + /* Once for the lookup reference */ + btrfs_put_block_group(block_group); out: btrfs_free_path(path); return ret; From patchwork Mon May 4 17:57:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226439 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62CCFC47257 for ; Mon, 4 May 2020 17:59:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 44BDC20707 for ; Mon, 4 May 2020 17:59:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615187; bh=GZXs/27IPQdcxPnSRMLXpJDcuFGzqUfF4jVTSEXs3i8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Ojv/aD90SnM1mLHUebpxQPdTkhilw/pUcdxBbaxpqsFIUXo2NiB1Ha2vwBFTDcupV UXKONdJpcWAWvJJ44gU3GWqC82rqsa+y8pnPA74eNLWA+yIUhzryMr2L4cBN+sYFMW FbTyRsQ8ezR5kOGMz6HjLf2414r7EjOSnIRcyzNA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730867AbgEDR7p (ORCPT ); Mon, 4 May 2020 13:59:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:53698 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730861AbgEDR7p (ORCPT ); Mon, 4 May 2020 13:59:45 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 45FD0207DD; Mon, 4 May 2020 17:59:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615184; bh=GZXs/27IPQdcxPnSRMLXpJDcuFGzqUfF4jVTSEXs3i8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fBoTmO4P9LWCevdXLgA0JrXh89BbD+DzCu5sxuicFI2lVfIQaOLKy9yyISuvd+r3D jeyTzP9qR95vnNqPnBvaeH7f1RQBN2goKbAmifnWW+ajV29KPEc9hsfqISUrFL4isT BNK6sktNs0uh9arrbFvYY64lio/+tVgMo9Ih/THo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wu Bo , Takashi Iwai Subject: [PATCH 4.9 06/18] ALSA: hda/hdmi: fix without unlocked before return Date: Mon, 4 May 2020 19:57:16 +0200 Message-Id: <20200504165443.451800031@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wu Bo commit a2f647240998aa49632fb09b01388fdf2b87acfc upstream. Fix the following coccicheck warning: sound/pci/hda/patch_hdmi.c:1852:2-8: preceding lock on line 1846 After add sanity check to pass klockwork check, The spdif_mutex should be unlock before return true in check_non_pcm_per_cvt(). Fixes: 960a581e22d9 ("ALSA: hda: fix some klockwork scan warnings") Signed-off-by: Wu Bo Cc: Link: https://lore.kernel.org/r/1587907042-694161-1-git-send-email-wubo40@huawei.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/pci/hda/patch_hdmi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/sound/pci/hda/patch_hdmi.c +++ b/sound/pci/hda/patch_hdmi.c @@ -1699,8 +1699,10 @@ static bool check_non_pcm_per_cvt(struct /* Add sanity check to pass klockwork check. * This should never happen. */ - if (WARN_ON(spdif == NULL)) + if (WARN_ON(spdif == NULL)) { + mutex_unlock(&codec->spdif_mutex); return true; + } non_pcm = !!(spdif->status & IEC958_AES0_NONAUDIO); mutex_unlock(&codec->spdif_mutex); return non_pcm; From patchwork Mon May 4 17:57:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226438 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35634C4724C for ; Mon, 4 May 2020 17:59:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1627B206B8 for ; Mon, 4 May 2020 17:59:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615193; bh=yuYvm1fkv6a9DEkSstB0vxNmG3SmDZImH4l1nKgoB8g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JB6qT00Wn+Sj11ro6thFsZ/DG3wqFlkdD1Awaen6V0torcuIoQWZge5nDKszscHJT 3iHm/phpUcq+FKb6btIcJN1JkQmn22gYEz+MOt1z7U3e7nZuek8/KtrAEdbiDeDHWk TMCk64ytVkGODCXUYnJvgRnJhM9XGGqiVr0cVITI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730883AbgEDR7v (ORCPT ); Mon, 4 May 2020 13:59:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:53880 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730880AbgEDR7u (ORCPT ); Mon, 4 May 2020 13:59:50 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 21DC620663; Mon, 4 May 2020 17:59:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615189; bh=yuYvm1fkv6a9DEkSstB0vxNmG3SmDZImH4l1nKgoB8g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CMXfjA2J/TP8ysj23dHJbB+Dyic4+nmmDYc6HItikUZJRnL5szH4RiN9qQJsjr0rM KmSEN1WWHdc/4Ql77LQfRDvWdQUBoLhVnkoo/LCo7WQqa0Ub577BAkdd4dk3mzA8Qx xJ41s+jlX+zMmsTJkkDypLUFZyZ0Baxx0ICHupfg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kai-Heng Feng , "Rafael J. Wysocki" Subject: [PATCH 4.9 08/18] PM: ACPI: Output correct message on target power state Date: Mon, 4 May 2020 19:57:18 +0200 Message-Id: <20200504165443.856844196@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kai-Heng Feng commit a9b760b0266f563b4784f695bbd0e717610dc10a upstream. Transitioned power state logged at the end of setting ACPI power. However, D3cold won't be in the message because state can only be D3hot at most. Use target_state to corretly report when power state is D3cold. Cc: All applicable Signed-off-by: Kai-Heng Feng Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman --- drivers/acpi/device_pm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/acpi/device_pm.c +++ b/drivers/acpi/device_pm.c @@ -226,13 +226,13 @@ int acpi_device_set_power(struct acpi_de end: if (result) { dev_warn(&device->dev, "Failed to change power state to %s\n", - acpi_power_state_string(state)); + acpi_power_state_string(target_state)); } else { device->power.state = target_state; ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device [%s] transitioned to %s\n", device->pnp.bus_id, - acpi_power_state_string(state))); + acpi_power_state_string(target_state))); } return result; From patchwork Mon May 4 17:57:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226441 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FB6CC3A5A9 for ; Mon, 4 May 2020 17:59:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3F5482075E for ; Mon, 4 May 2020 17:59:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615165; bh=oj1aSHJQB2KRe6kNlCB/UO6RMr8tKwXPStULUd2W+Tg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JoN7oCWJgPrELj8dOacNnqjaA6ZsW2r5TvlTGCFNVbl6qWkrMwz58OX18ArILPxcF pdqXVwHtMwGiykx9rv+cvfrmQGnE63cMHp03imSGP2b7Jt0FwblYZTQKCU2cQcblxG hPOWTRyZcF6gGV+h6LtXncBXvOZf83OLTtxPP/qk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730770AbgEDR7X (ORCPT ); Mon, 4 May 2020 13:59:23 -0400 Received: from mail.kernel.org ([198.145.29.99]:52908 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730767AbgEDR7X (ORCPT ); Mon, 4 May 2020 13:59:23 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5ADC220746; Mon, 4 May 2020 17:59:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615162; bh=oj1aSHJQB2KRe6kNlCB/UO6RMr8tKwXPStULUd2W+Tg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iPtF2xBK+qFHYtRzxZTDLfo50NSZjAprOqFxvAWeWp/ktfTCnH9d8gkBfzrxrGg08 kCKHvk31JwC5VXNigEv8vmPpViKOmTLyen8Ocv0rXwxUEhY0GbDuXaAyKuy86lrkpz d0O2Rt9FB6kKb3Nxx571fvqoxMvWOuMm4y26C8Mw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sunwook Eom , Sami Tolvanen , Mike Snitzer Subject: [PATCH 4.9 10/18] dm verity fec: fix hash block number in verity_fec_decode Date: Mon, 4 May 2020 19:57:20 +0200 Message-Id: <20200504165444.248614958@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sunwook Eom commit ad4e80a639fc61d5ecebb03caa5cdbfb91fcebfc upstream. The error correction data is computed as if data and hash blocks were concatenated. But hash block number starts from v->hash_start. So, we have to calculate hash block number based on that. Fixes: a739ff3f543af ("dm verity: add support for forward error correction") Cc: stable@vger.kernel.org Signed-off-by: Sunwook Eom Reviewed-by: Sami Tolvanen Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman --- drivers/md/dm-verity-fec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/md/dm-verity-fec.c +++ b/drivers/md/dm-verity-fec.c @@ -447,7 +447,7 @@ int verity_fec_decode(struct dm_verity * fio->level++; if (type == DM_VERITY_BLOCK_TYPE_METADATA) - block += v->data_blocks; + block = block - v->hash_start + v->data_blocks; /* * For RS(M, N), the continuous FEC data is divided into blocks of N From patchwork Mon May 4 17:57:24 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226339 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52907C3A5A9 for ; Mon, 4 May 2020 18:15:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 327E82078C for ; Mon, 4 May 2020 18:15:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588616117; bh=wbkp8qqavz27ErAdxGpNXAyCPktsf8JUg0achhI6Gds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=quzBf79SsQ6OlFOMz3lHnyKwbQm18Kfvpq3dt1/KZuOkz8bdhQ9YsivhWVztZaigy zFk03x3Fazvkalgii55ez+Q8urliAI4mZmZo92KtzwQyqMUSO+miHZkGClQdIlzAWi 1e+AiNdcQI2UY1zqhof6JjQzTSCrJx5oSpWCRTL4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730819AbgEDR7d (ORCPT ); Mon, 4 May 2020 13:59:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:53252 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730812AbgEDR7d (ORCPT ); Mon, 4 May 2020 13:59:33 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2B1D92073B; Mon, 4 May 2020 17:59:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615172; bh=wbkp8qqavz27ErAdxGpNXAyCPktsf8JUg0achhI6Gds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=njPO0UwQZs1hpwtY9untrJKI29DzTpitI2U+BXdsvSsO7ppFEaLzFkmlVdwqApKVl 9eQJjU3NHJJJqQUjgphpfGV/+R/BxmyvJjvaO4lMMEKe2Dk+OK7osArc5pfDWO1GGB q2dl4nve/akRSszs2Em2iSvn6KEIAiHdY94ToWug= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Takashi Iwai Subject: [PATCH 4.9 14/18] ALSA: opti9xx: shut up gcc-10 range warning Date: Mon, 4 May 2020 19:57:24 +0200 Message-Id: <20200504165445.163833573@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann commit 5ce00760a84848d008554c693ceb6286f4d9c509 upstream. gcc-10 points out a few instances of suspicious integer arithmetic leading to value truncation: sound/isa/opti9xx/opti92x-ad1848.c: In function 'snd_opti9xx_configure': sound/isa/opti9xx/opti92x-ad1848.c:322:43: error: overflow in conversion from 'int' to 'unsigned char' changes value from '(int)snd_opti9xx_read(chip, 3) & -256 | 240' to '240' [-Werror=overflow] 322 | (snd_opti9xx_read(chip, reg) & ~(mask)) | ((value) & (mask))) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ sound/isa/opti9xx/opti92x-ad1848.c:351:3: note: in expansion of macro 'snd_opti9xx_write_mask' 351 | snd_opti9xx_write_mask(chip, OPTi9XX_MC_REG(3), 0xf0, 0xff); | ^~~~~~~~~~~~~~~~~~~~~~ sound/isa/opti9xx/miro.c: In function 'snd_miro_configure': sound/isa/opti9xx/miro.c:873:40: error: overflow in conversion from 'int' to 'unsigned char' changes value from '(int)snd_miro_read(chip, 3) & -256 | 240' to '240' [-Werror=overflow] 873 | (snd_miro_read(chip, reg) & ~(mask)) | ((value) & (mask))) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ sound/isa/opti9xx/miro.c:1010:3: note: in expansion of macro 'snd_miro_write_mask' 1010 | snd_miro_write_mask(chip, OPTi9XX_MC_REG(3), 0xf0, 0xff); | ^~~~~~~~~~~~~~~~~~~ These are all harmless here as only the low 8 bit are passed down anyway. Change the macros to inline functions to make the code more readable and also avoid the warning. Strictly speaking those functions also need locking to make the read/write pair atomic, but it seems unlikely that anyone would still run into that issue. Fixes: 1841f613fd2e ("[ALSA] Add snd-miro driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20200429190216.85919-1-arnd@arndb.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/isa/opti9xx/miro.c | 9 ++++++--- sound/isa/opti9xx/opti92x-ad1848.c | 9 ++++++--- 2 files changed, 12 insertions(+), 6 deletions(-) --- a/sound/isa/opti9xx/miro.c +++ b/sound/isa/opti9xx/miro.c @@ -875,10 +875,13 @@ static void snd_miro_write(struct snd_mi spin_unlock_irqrestore(&chip->lock, flags); } +static inline void snd_miro_write_mask(struct snd_miro *chip, + unsigned char reg, unsigned char value, unsigned char mask) +{ + unsigned char oldval = snd_miro_read(chip, reg); -#define snd_miro_write_mask(chip, reg, value, mask) \ - snd_miro_write(chip, reg, \ - (snd_miro_read(chip, reg) & ~(mask)) | ((value) & (mask))) + snd_miro_write(chip, reg, (oldval & ~mask) | (value & mask)); +} /* * Proc Interface --- a/sound/isa/opti9xx/opti92x-ad1848.c +++ b/sound/isa/opti9xx/opti92x-ad1848.c @@ -327,10 +327,13 @@ static void snd_opti9xx_write(struct snd } -#define snd_opti9xx_write_mask(chip, reg, value, mask) \ - snd_opti9xx_write(chip, reg, \ - (snd_opti9xx_read(chip, reg) & ~(mask)) | ((value) & (mask))) +static inline void snd_opti9xx_write_mask(struct snd_opti9xx *chip, + unsigned char reg, unsigned char value, unsigned char mask) +{ + unsigned char oldval = snd_opti9xx_read(chip, reg); + snd_opti9xx_write(chip, reg, (oldval & ~mask) | (value & mask)); +} static int snd_opti9xx_configure(struct snd_opti9xx *chip, long port, From patchwork Mon May 4 17:57:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226341 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 114CAC47257 for ; Mon, 4 May 2020 18:15:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E893120661 for ; Mon, 4 May 2020 18:15:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588616102; bh=zpmXzaO6P1PeBJPtMvXhh7XEmu0fLIE1OTqr7nC/dcw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ee3GYQFR3IASFtFT1qBoHV5Fo342LNEWZqk0K5GQTB+cd0RESZoHvExbu/H+7ESTT JqDOBFS6/hwejNQDZzRaEaBvAJHNRwkaVXXldefAOmLzyGFTOR+HGoJVtr2dXCoOlr ZcuU4EaMqRiXhbTTU82A8Ud80X+70BYDWe3lwJ48= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730906AbgEDR77 (ORCPT ); Mon, 4 May 2020 13:59:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:54184 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730902AbgEDR76 (ORCPT ); Mon, 4 May 2020 13:59:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B69EC20663; Mon, 4 May 2020 17:59:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615197; bh=zpmXzaO6P1PeBJPtMvXhh7XEmu0fLIE1OTqr7nC/dcw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0g/2xQG/HSd3Pf+/JlXJ/sZ0ZvRiAZGq8xa1+VwPp4MuPBnApFPcq/ls2d837MT0f aPSUJ3dcPP2i+KkBSBSdE5qcyuB0Awzr1ctEMZsog3Hsmqekk4LGC9VBm8wBJKkb/g kBzvOw2uBh3/3yICs4KR4Iq7RX3pAGpG4diVair0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Williams , Nicolas Ferre , Andy Shevchenko , Vinod Koul Subject: [PATCH 4.9 16/18] dmaengine: dmatest: Fix iteration non-stop logic Date: Mon, 4 May 2020 19:57:26 +0200 Message-Id: <20200504165445.574061312@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Andy Shevchenko commit b9f960201249f20deea586b4ec814669b4c6b1c0 upstream. Under some circumstances, i.e. when test is still running and about to time out and user runs, for example, grep -H . /sys/module/dmatest/parameters/* the iterations parameter is not respected and test is going on and on until user gives echo 0 > /sys/module/dmatest/parameters/run This is not what expected. The history of this bug is interesting. I though that the commit 2d88ce76eb98 ("dmatest: add a 'wait' parameter") is a culprit, but looking closer to the code I think it simple revealed the broken logic from the day one, i.e. in the commit 0a2ff57d6fba ("dmaengine: dmatest: add a maximum number of test iterations") which adds iterations parameter. So, to the point, the conditional of checking the thread to be stopped being first part of conjunction logic prevents to check iterations. Thus, we have to always check both conditions to be able to stop after given iterations. Since it wasn't visible before second commit appeared, I add a respective Fixes tag. Fixes: 2d88ce76eb98 ("dmatest: add a 'wait' parameter") Cc: Dan Williams Cc: Nicolas Ferre Signed-off-by: Andy Shevchenko Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20200424161147.16895-1-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman --- drivers/dma/dmatest.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/dma/dmatest.c +++ b/drivers/dma/dmatest.c @@ -505,8 +505,8 @@ static int dmatest_func(void *data) flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT; ktime = ktime_get(); - while (!kthread_should_stop() - && !(params->iterations && total_tests >= params->iterations)) { + while (!(kthread_should_stop() || + (params->iterations && total_tests >= params->iterations))) { struct dma_async_tx_descriptor *tx = NULL; struct dmaengine_unmap_data *um; dma_addr_t srcs[src_cnt]; From patchwork Mon May 4 17:57:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 226437 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23A45C4724C for ; Mon, 4 May 2020 18:00:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F409D2073E for ; Mon, 4 May 2020 18:00:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615203; bh=BkzwvDJlqsTTEB9XFdtRjhRaxiHIQXYB+xJukHzcDzU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=MqD5qYMQ6fjTPStdg27Ck8zbOJso3/C3wF4pbebamAz8ux6ZiACwjcRdmjbPIikkm 4AlOSDUMzCcYxmj6OmaGVOJhPp6fu8/fl11v6VhPBC9RB7/AHk/+QaxyMDvshlbWCR 7EByt2wev2eWRUsqxjm7RzZuQHjxL+nFtkfme8kI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730919AbgEDSAB (ORCPT ); Mon, 4 May 2020 14:00:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:54258 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730912AbgEDSAB (ORCPT ); Mon, 4 May 2020 14:00:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2F89620663; Mon, 4 May 2020 17:59:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588615199; bh=BkzwvDJlqsTTEB9XFdtRjhRaxiHIQXYB+xJukHzcDzU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1pRtleXkeQCTh5T/nHFjVc/vwlerBFcGFQl6VB4IRxqjIfzaiSJbKGoz0wiCVWsOe Dode9KLNFJEQChc4U1aFb48aca7NFfQUit7UvAsoo9Njox81aOGTCRAEhsZDz9komL JsguVwLKM5bqgWuL1L6yxump880dAYlk4p2gc2ZU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Vyukov , Stephen Smalley , Paul Moore Subject: [PATCH 4.9 17/18] selinux: properly handle multiple messages in selinux_netlink_send() Date: Mon, 4 May 2020 19:57:27 +0200 Message-Id: <20200504165445.840542114@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200504165442.028485341@linuxfoundation.org> References: <20200504165442.028485341@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Paul Moore commit fb73974172ffaaf57a7c42f35424d9aece1a5af6 upstream. Fix the SELinux netlink_send hook to properly handle multiple netlink messages in a single sk_buff; each message is parsed and subject to SELinux access control. Prior to this patch, SELinux only inspected the first message in the sk_buff. Cc: stable@vger.kernel.org Reported-by: Dmitry Vyukov Reviewed-by: Stephen Smalley Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman --- security/selinux/hooks.c | 68 ++++++++++++++++++++++++++++++----------------- 1 file changed, 44 insertions(+), 24 deletions(-) --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5002,39 +5002,59 @@ static int selinux_tun_dev_open(void *se static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) { - int err = 0; - u32 perm; + int rc = 0; + unsigned int msg_len; + unsigned int data_len = skb->len; + unsigned char *data = skb->data; struct nlmsghdr *nlh; struct sk_security_struct *sksec = sk->sk_security; + u16 sclass = sksec->sclass; + u32 perm; - if (skb->len < NLMSG_HDRLEN) { - err = -EINVAL; - goto out; - } - nlh = nlmsg_hdr(skb); + while (data_len >= nlmsg_total_size(0)) { + nlh = (struct nlmsghdr *)data; - err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm); - if (err) { - if (err == -EINVAL) { + /* NOTE: the nlmsg_len field isn't reliably set by some netlink + * users which means we can't reject skb's with bogus + * length fields; our solution is to follow what + * netlink_rcv_skb() does and simply skip processing at + * messages with length fields that are clearly junk + */ + if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len) + return 0; + + rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm); + if (rc == 0) { + rc = sock_has_perm(current, sk, perm); + if (rc) + return rc; + } else if (rc == -EINVAL) { + /* -EINVAL is a missing msg/perm mapping */ pr_warn_ratelimited("SELinux: unrecognized netlink" - " message: protocol=%hu nlmsg_type=%hu sclass=%s" - " pig=%d comm=%s\n", - sk->sk_protocol, nlh->nlmsg_type, - secclass_map[sksec->sclass - 1].name, - task_pid_nr(current), current->comm); - if (!selinux_enforcing || security_get_allow_unknown()) - err = 0; + " message: protocol=%hu nlmsg_type=%hu sclass=%s" + " pid=%d comm=%s\n", + sk->sk_protocol, nlh->nlmsg_type, + secclass_map[sclass - 1].name, + task_pid_nr(current), current->comm); + if (selinux_enforcing && !security_get_allow_unknown()) + return rc; + rc = 0; + } else if (rc == -ENOENT) { + /* -ENOENT is a missing socket/class mapping, ignore */ + rc = 0; + } else { + return rc; } - /* Ignore */ - if (err == -ENOENT) - err = 0; - goto out; + /* move to the next message after applying netlink padding */ + msg_len = NLMSG_ALIGN(nlh->nlmsg_len); + if (msg_len >= data_len) + return 0; + data_len -= msg_len; + data += msg_len; } - err = sock_has_perm(current, sk, perm); -out: - return err; + return rc; } #ifdef CONFIG_NETFILTER