linux-stable.git, branch v3.2.99

Linux 3.2.99

2018-02-13T18:32:25+00:00

kaiser: Set _PAGE_NX only if supported

2018-02-13T18:32:24+00:00

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

Link: https://www.spinics.net/lists/kernel/msg2689835.html

Reviewed-by: Guenter Roeck 
Signed-off-by: Lepton Wu 
Signed-off-by: Greg Kroah-Hartman 
(backported from Greg K-H's 4.4 stable-queue)
Signed-off-by: Juerg Haefliger 
Signed-off-by: Ben Hutchings

kaiser: Set _PAGE_NX only if supported

2018-02-13T18:32:24+00:00

This resolves a crash if loaded under qemu + haxm under windows.
See https://www.spinics.net/lists/kernel/msg2689835.html for details.
Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that
the same log is also seen with vanilla v4.4.110-rc1).

[    0.712750] Freeing unused kernel memory: 552K
[    0.721821] init: Corrupted page table at address 57b029b332e0
[    0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067
[    0.722761] Bad pagetable: 000b [#1] PREEMPT SMP
[    0.722761] Modules linked in:
[    0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31
[    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
[    0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000
[    0.722761] RIP: 0010:[]  [] __clear_user+0x42/0x67
[    0.722761] RSP: 0000:ffff8800bc28fcf8  EFLAGS: 00010202
[    0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4
[    0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0
[    0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000
[    0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0
[    0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00
[    0.722761] FS:  0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
[    0.722761] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0
[    0.722761] Stack:
[    0.722761]  000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c
[    0.722761]  ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000
[    0.722761]  ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000
[    0.722761] Call Trace:
[    0.722761]  [] clear_user+0x2e/0x30
[    0.722761]  [] load_elf_binary+0xa7f/0x18f7
[    0.722761]  [] search_binary_handler+0x86/0x19c
[    0.722761]  [] do_execveat_common.isra.26+0x909/0xf98
[    0.722761]  [] ? rest_init+0x87/0x87
[    0.722761]  [] do_execve+0x23/0x25
[    0.722761]  [] run_init_process+0x2b/0x2d
[    0.722761]  [] kernel_init+0x6d/0xda
[    0.722761]  [] ret_from_fork+0x3f/0x70
[    0.722761]  [] ? rest_init+0x87/0x87
[    0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1
eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17
48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff
[    0.722761] RIP  [] __clear_user+0x42/0x67
[    0.722761]  RSP 
[    0.722761] ---[ end trace def703879b4ff090 ]---
[    0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21
[    0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init
[    0.722761] CPU: 1 PID: 1 Comm: init Tainted: G      D         4.4.96 #31
[    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
[    0.722761]  0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004
[    0.722761]  ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9
[    0.722761]  ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000
[    0.722761] Call Trace:
[    0.722761]  [] dump_stack+0x4d/0x63
[    0.722761]  [] ___might_sleep+0x13a/0x13c
[    0.722761]  [] __might_sleep+0x9f/0xa6
[    0.722761]  [] down_read+0x20/0x31
[    0.722761]  [] __blocking_notifier_call_chain+0x35/0x63
[    0.722761]  [] blocking_notifier_call_chain+0x14/0x16
[    0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd
[    0.722761]  [] profile_task_exit+0x1a/0x1c
[    0.802309]  [] do_exit+0x39/0xe7f
[    0.802309]  [] ? vprintk_default+0x1d/0x1f
[    0.802309]  [] ? printk+0x57/0x73
[    0.802309]  [] oops_end+0x80/0x85
[    0.802309]  [] pgtable_bad+0x8a/0x95
[    0.802309]  [] __do_page_fault+0x8c/0x352
[    0.802309]  [] ? file_has_perm+0xc4/0xe5
[    0.802309]  [] do_page_fault+0xc/0xe
[    0.802309]  [] page_fault+0x22/0x30
[    0.802309]  [] ? __clear_user+0x42/0x67
[    0.802309]  [] ? __clear_user+0x23/0x67
[    0.802309]  [] clear_user+0x2e/0x30
[    0.802309]  [] load_elf_binary+0xa7f/0x18f7
[    0.802309]  [] search_binary_handler+0x86/0x19c
[    0.802309]  [] do_execveat_common.isra.26+0x909/0xf98
[    0.802309]  [] ? rest_init+0x87/0x87
[    0.802309]  [] do_execve+0x23/0x25
[    0.802309]  [] run_init_process+0x2b/0x2d
[    0.802309]  [] kernel_init+0x6d/0xda
[    0.802309]  [] ret_from_fork+0x3f/0x70
[    0.802309]  [] ? rest_init+0x87/0x87
[    0.830559] Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009
[    0.830559]
[    0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[    0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009

The crash part of this problem may be solved with the following patch
(thanks to Hugh for the hint). There is still another problem, though -
with this patch applied, the qemu session aborts with "VCPU Shutdown
request", whatever that means.

Cc: lepton 
Signed-off-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman 
(cherry picked from commit b33c3c64c4786cd724ccde6fa97c87ada49f6a73 linux-4.4.y)
Signed-off-by: Juerg Haefliger 
Signed-off-by: Ben Hutchings

cx231xx: Fix the max number of interfaces

2018-02-13T18:32:24+00:00

commit 139d28826b8e2bc7a9232fde0d2f14812914f501 upstream.

The max number of interfaces was read from the wrong descriptor.

Signed-off-by: Mauro Carvalho Chehab 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer

2018-02-13T18:32:24+00:00

commit be6123df1ea8f01ee2f896a16c2b7be3e4557a5a upstream.

stub_send_ret_submit() handles urb with a potential null transfer_buffer,
when it replays a packet with potential malicious data that could contain
a null buffer. Add a check for the condition when actual_length > 0 and
transfer_buffer is null.

Reported-by: Secunia Research 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2:
 - Device for logging purposes is &sdev->interface->dev
 - Adjust filename]
Signed-off-by: Ben Hutchings

usbip: prevent vhci_hcd driver from leaking a socket pointer address

2018-02-13T18:32:23+00:00

commit 2f2d0088eb93db5c649d2a5e34a3800a8a935fc5 upstream.

When a client has a USB device attached over IP, the vhci_hcd driver is
locally leaking a socket pointer address via the

/sys/devices/platform/vhci_hcd/status file (world-readable) and in debug
output when "usbip --debug port" is run.

Fix it to not leak. The socket pointer address is not used at the moment
and it was made visible as a convenient way to find IP address from socket
pointer address by looking up /proc/net/{tcp,tcp6}.

As this opens a security hole, the fix replaces socket pointer address with
sockfd.

Reported-by: Secunia Research 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2:
 - usbip port status does not include hub type
 - Adjust filenames, context, indentation]
Signed-off-by: Ben Hutchings

usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input

2018-02-13T18:32:23+00:00

commit c6688ef9f29762e65bce325ef4acd6c675806366 upstream.

Harden CMD_SUBMIT path to handle malicious input that could trigger
large memory allocations. Add checks to validate transfer_buffer_length
and number_of_packets to protect against bad input requesting for
unbounded memory allocations. Validate early in get_pipe() and return
failure.

Reported-by: Secunia Research 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2:
 - Device for logging purposes is &sdev->interface->dev
 - Adjust filename, context]
Signed-off-by: Ben Hutchings

usbip: fix stub_rx: get_pipe() to validate endpoint number

2018-02-13T18:32:23+00:00

commit 635f545a7e8be7596b9b2b6a43cab6bbd5a88e43 upstream.

get_pipe() routine doesn't validate the input endpoint number
and uses to reference ep_in and ep_out arrays. Invalid endpoint
number can trigger BUG(). Range check the epnum and returning
error instead of calling BUG().

Change caller stub_recv_cmd_submit() to handle the get_pipe()
error return.

Reported-by: Secunia Research 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

usb: add helper to extract bits 12:11 of wMaxPacketSize

2018-02-13T18:32:23+00:00

commit 541b6fe63023f3059cf85d47ff2767a3e42a8e44 upstream.

According to USB Specification 2.0 table 9-4,
wMaxPacketSize is a bitfield. Endpoint's maxpacket
is laid out in bits 10:0. For high-speed,
high-bandwidth isochronous endpoints, bits 12:11
contain a multiplier to tell us how many
transactions we want to try per uframe.

This means that if we want an isochronous endpoint
to issue 3 transfers of 1024 bytes per uframe,
wMaxPacketSize should contain the value:

	1024 | (2 << 11)

or 5120 (0x1400). In order to make Host and
Peripheral controller drivers' life easier, we're
adding a helper which returns bits 12:11. Note that
no care is made WRT to checking endpoint type and
gadget's speed. That's left for drivers to handle.

Signed-off-by: Felipe Balbi 
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings

usbip: Fix sscanf handling

2018-02-13T18:32:23+00:00

commit 2d32927127f44d755780aa5fa88c8c34e72558f8 upstream.

Scan only to the length permitted by the buffer

One of a set of sscanf problems noted by Jackie Chang

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings