linux-stable.git/drivers/isdn, branch linux-4.1.y

mISDN: Fix a sleep-in-atomic bug

2018-05-23T01:36:27+00:00

[ Upstream commit 93818da5eed63fbc17b64080406ea53b86b23309 ]

The driver may sleep under a read spin lock, and the function call path is:
send_socklist (acquire the lock by read_lock)
  skb_copy(GFP_KERNEL) --> may sleep

To fix it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC".

Signed-off-by: Jia-Ju Bai 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ISDN: eicon: reduce stack size of sig_ind function

2018-03-04T15:28:32+00:00

[ Upstream commit 27d807180ae0a9e50d90adf9b22573c21be904c2 ]

I noticed that this function uses a lot of kernel stack when the
"latent entropy" plugin is enabled:

drivers/isdn/hardware/eicon/message.c: In function 'sig_ind':
drivers/isdn/hardware/eicon/message.c:6113:1: error: the frame size of 1168 bytes is larger than 1152 bytes [-Werror=frame-larger-than=]

We currently don't warn about this, as we raise the warning limit
to 2048 bytes in mainline, but I'd like to lower that limit again
in the future, and this function can easily be changed to be more
efficient and avoid that warning, by making some of its local
variables 'const'.

Signed-off-by: Arnd Bergmann 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

isdn: icn: remove a #warning

2018-03-04T15:28:28+00:00

[ Upstream commit 01ed1e1504ac83a8b0b365c9f55d3427babbd7d9 ]

The icn driver currently produces an unconditional #warning whenever
we build it, introduced by Karsten Keil back in 2003:

 #warning TODO test headroom or use skb->nb to flag ACK

Karsten's original commit (from BitKeeper) contains this description:

    - here are lot of bugs left, so ISDN is not stable yet but
      I think it's really time to fix it, even if it need some cycles
      to get it right (normally I'm only send patches if it works 100% for
      me).
    - I add some additional #warnings to address places which need fixing
      (I hope that some of the other ISDN developer jump in)

Apparently this has not happened, and it is unlikely that it ever will,
given that the driver doesn't seem to work. No substantial bug fixes
other than janitorial cleanups have happened in the driver since then,
and I see no indication that anyone who patched it had the hardware.

We should probably either remove the driver, or remove all of i4l,
but for now, this shuts up the distracting #warning by turning it
into a comment.

Signed-off-by: Arnd Bergmann 
Link: http://git.meleeweb.net/linux.git/commit/?id=b0deac0886b0056765afd149e9834373b38e096b
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

isdn: kcapi: avoid uninitialized data

2018-03-01T00:32:14+00:00

[ Upstream commit af109a2cf6a9a6271fa420ae2d64d72d86c92b7d ]

gcc-7 points out that the AVMB1_ADDCARD ioctl results in an unintialized
value ending up in the cardnr parameter:

drivers/isdn/capi/kcapi.c: In function 'old_capi_manufacturer':
drivers/isdn/capi/kcapi.c:1042:24: error: 'cdef.cardnr' may be used uninitialized in this function [-Werror=maybe-uninitialized]
   cparams.cardnr = cdef.cardnr;

This has been broken since before the start of the git history, so
either the value is not used for anything important, or the ioctl
command doesn't get called in practice.

Setting the cardnr to zero avoids the warning and makes sure
we have consistent behavior.

Signed-off-by: Arnd Bergmann 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

isdn/i4l: fetch the ppp_write buffer in one shot

2017-11-06T04:54:28+00:00

[ Upstream commit 02388bf87f72e1d47174cd8f81c34443920eb5a0 ]

In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is
fetched twice from userspace. The first fetch is used to peek at the
protocol of the message and reset the huptimer if necessary; while the
second fetch copies in the whole buffer. However, given that buf resides
in userspace memory, a user process can race to change its memory content
across fetches. By doing so, we can either avoid resetting the huptimer
for any type of packets (by first setting proto to PPP_LCP and later
change to the actual type) or force resetting the huptimer for LCP
packets.

This patch changes this double-fetch behavior into two single fetches
decided by condition (lp->isdn_device < 0 || lp->isdn_channel <0).
A more detailed discussion can be found at
https://marc.info/?l=linux-kernel&m=150586376926123&w=2

Signed-off-by: Meng Xu 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

isdn: Fix a sleep-in-atomic bug

2017-09-10T20:35:48+00:00

[ Upstream commit e8f4ae85439f34bec3b0ab69223a41809dab28c9 ]

The driver may sleep under a spin lock, the function call path is:
isdn_ppp_mp_receive (acquire the lock)
  isdn_ppp_mp_reassembly
    isdn_ppp_push_higher
      isdn_ppp_decompress
        isdn_ppp_ccp_reset_trans
          isdn_ppp_ccp_reset_alloc_state
            kzalloc(GFP_KERNEL) --> may sleep

To fixed it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC".

Signed-off-by: Jia-Ju Bai 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

isdn/gigaset: fix NULL-deref at probe

2017-05-17T19:07:01+00:00

[ Upstream commit 68c32f9c2a36d410aa242e661506e5b2c2764179 ]

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: cf7776dc05b8 ("[PATCH] isdn4linux: Siemens Gigaset drivers -
direct USB connection")
Cc: stable 	# 2.6.17
Cc: Hansjoerg Lipp 

Signed-off-by: Johan Hovold 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ISDN: eicon: silence misleading array-bounds warning

2017-03-06T22:31:12+00:00

[ Upstream commit 950eabbd6ddedc1b08350b9169a6a51b130ebaaf ]

With some gcc versions, we get a warning about the eicon driver,
and that currently shows up as the only remaining warning in one
of the build bots:

In file included from ../drivers/isdn/hardware/eicon/message.c:30:0:
eicon/message.c: In function 'mixer_notify_update':
eicon/platform.h:333:18: warning: array subscript is above array bounds [-Warray-bounds]

The code is easily changed to open-code the unusual PUT_WORD() line
causing this to avoid the warning.

Cc: stable@vger.kernel.org
Link: http://arm-soc.lixom.net/buildlogs/stable-rc/v4.4.45/
Signed-off-by: Arnd Bergmann 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

ppp, slip: Validate VJ compression slot parameters completely

2016-01-31T19:23:37+00:00

[ Upstream commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae ]

Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).

Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL.  Change the callers accordingly.

Compile-tested only.

Reported-by: 郭永刚 
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

isdn_ppp: Add checks for allocation failure in isdn_ppp_open()

2016-01-31T19:23:37+00:00

[ Upstream commit 0baa57d8dc32db78369d8b5176ef56c5e2e18ab3 ]

Compile-tested only.

Signed-off-by: Ben Hutchings 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman