linux-stable.git/include, branch v5.4.208

tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()

2022-07-29T15:14:20+00:00

commit a501ab75e7624d133a5a3c7ec010687c8b961d23 upstream.

There is a race in pty_write(). pty_write() can be called in parallel
with e.g. ioctl(TIOCSTI) or ioctl(TCXONC) which also inserts chars to
the buffer. Provided, tty_flip_buffer_push() in pty_write() is called
outside the lock, it can commit inconsistent tail. This can lead to out
of bounds writes and other issues. See the Link below.

To fix this, we have to introduce a new helper called
tty_insert_flip_string_and_push_buffer(). It does both
tty_insert_flip_string() and tty_flip_buffer_commit() under the port
lock. It also calls queue_work(), but outside the lock. See
71a174b39f10 (pty: do tty_flip_buffer_push without port->lock in
pty_write) for the reasons.

Keep the helper internal-only (in drivers' tty.h). It is not intended to
be used widely.

Link: https://seclists.org/oss-sec/2022/q2/155
Fixes: 71a174b39f10 (pty: do tty_flip_buffer_push without port->lock in pty_write)
Cc: 一只狗 
Cc: Dan Carpenter 
Suggested-by: Hillf Danton 
Signed-off-by: Jiri Slaby 
Link: https://lore.kernel.org/r/20220707082558.9250-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

tty: drop tty_schedule_flip()

2022-07-29T15:14:19+00:00

commit 5db96ef23bda6c2a61a51693c85b78b52d03f654 upstream.

Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014,
tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). All
users were converted in the previous patches, so remove
tty_schedule_flip() completely while inlining its body into
tty_flip_buffer_push().

One less exported function.

Reviewed-by: Johan Hovold 
Signed-off-by: Jiri Slaby 
Link: https://lore.kernel.org/r/20211122111648.30379-4-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks

2022-07-29T15:14:19+00:00

commit 29fb608396d6a62c1b85acc421ad7a4399085b9f upstream.

Since bt_skb_sendmmsg can be used with the likes of SOCK_STREAM it
shall return the partial chunks it could allocate instead of freeing
everything as otherwise it can cause problems like bellow.

Fixes: 81be03e026dc ("Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg")
Reported-by: Paul Menzel 
Link: https://lore.kernel.org/r/d7206e12-1b99-c3be-84f4-df22af427ef5@molgen.mpg.de
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=215594
Signed-off-by: Luiz Augusto von Dentz 
Tested-by: Paul Menzel  (Nokia N9 (MeeGo/Harmattan)
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Fix passing NULL to PTR_ERR

2022-07-29T15:14:19+00:00

commit 266191aa8d14b84958aaeb5e96ee4e97839e3d87 upstream.

Passing NULL to PTR_ERR will result in 0 (success), also since the likes of
bt_skb_sendmsg does never return NULL it is safe to replace the instances of
IS_ERR_OR_NULL with IS_ERR when checking its return.

Reported-by: Dan Carpenter 
Tested-by: Tedd Ho-Jeong An 
Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Add bt_skb_sendmmsg helper

2022-07-29T15:14:18+00:00

commit 97e4e80299844bb5f6ce5a7540742ffbffae3d97 upstream.

This works similarly to bt_skb_sendmsg but can split the msg into
multiple skb fragments which is useful for stream sockets.

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Add bt_skb_sendmsg helper

2022-07-29T15:14:18+00:00

commit 38f64f650dc0e44c146ff88d15a7339efa325918 upstream.

bt_skb_sendmsg helps takes care of allocation the skb and copying the
the contents of msg over to the skb while checking for possible errors
so it should be safe to call it without holding lock_sock.

Signed-off-by: Luiz Augusto von Dentz 
Signed-off-by: Marcel Holtmann 
Cc: Harshit Mogalapalli 
Signed-off-by: Greg Kroah-Hartman

bitfield.h: Fix "type of reg too small for mask" test

2022-07-29T15:14:18+00:00

[ Upstream commit bff8c3848e071d387d8b0784dc91fa49cd563774 ]

The test: 'mask > (typeof(_reg))~0ull' only works correctly when both
sides are unsigned, consider:

 - 0xff000000 vs (int)~0ull
 - 0x000000ff vs (int)~0ull

Signed-off-by: Peter Zijlstra (Intel) 
Reviewed-by: Josh Poimboeuf 
Link: https://lore.kernel.org/r/20211110101324.950210584@infradead.org
Signed-off-by: Sasha Levin

mmap locking API: initial implementation as rwsem wrappers

2022-07-29T15:14:18+00:00

[ Upstream commit 9740ca4e95b43b91a4a848694a20d01ba6818f7b ]

This patch series adds a new mmap locking API replacing the existing
mmap_sem lock and unlocks.  Initially the API is just implemente in terms
of inlined rwsem calls, so it doesn't provide any new functionality.

There are two justifications for the new API:

- At first, it provides an easy hooking point to instrument mmap_sem
  locking latencies independently of any other rwsems.

- In the future, it may be a starting point for replacing the rwsem
  implementation with a different one, such as range locks.  This is
  something that is being explored, even though there is no wide concensus
  about this possible direction yet.  (see
  https://patchwork.kernel.org/cover/11401483/)

This patch (of 12):

This change wraps the existing mmap_sem related rwsem calls into a new
mmap locking API.  There are two justifications for the new API:

- At first, it provides an easy hooking point to instrument mmap_sem
  locking latencies independently of any other rwsems.

- In the future, it may be a starting point for replacing the rwsem
  implementation with a different one, such as range locks.

Signed-off-by: Michel Lespinasse 
Signed-off-by: Andrew Morton 
Reviewed-by: Daniel Jordan 
Reviewed-by: Davidlohr Bueso 
Reviewed-by: Laurent Dufour 
Reviewed-by: Vlastimil Babka 
Cc: Peter Zijlstra 
Cc: Matthew Wilcox 
Cc: Liam Howlett 
Cc: Jerome Glisse 
Cc: David Rientjes 
Cc: Hugh Dickins 
Cc: Ying Han 
Cc: Jason Gunthorpe 
Cc: John Hubbard 
Cc: Michel Lespinasse 
Link: http://lkml.kernel.org/r/20200520052908.204642-1-walken@google.com
Link: http://lkml.kernel.org/r/20200520052908.204642-2-walken@google.com
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

locking/refcount: Consolidate implementations of refcount_t

2022-07-29T15:14:17+00:00

[ Upstream commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca ]

The generic implementation of refcount_t should be good enough for
everybody, so remove ARCH_HAS_REFCOUNT and REFCOUNT_FULL entirely,
leaving the generic implementation enabled unconditionally.

Signed-off-by: Will Deacon 
Reviewed-by: Ard Biesheuvel 
Acked-by: Kees Cook 
Tested-by: Hanjun Guo 
Cc: Ard Biesheuvel 
Cc: Elena Reshetova 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Link: https://lkml.kernel.org/r/20191121115902.2551-9-will@kernel.org
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin

locking/refcount: Consolidate REFCOUNT_{MAX,SATURATED} definitions

2022-07-29T15:14:17+00:00

[ Upstream commit 65b008552469f1c37f5e06e0016924502e40b4f5 ]

The definitions of REFCOUNT_MAX and REFCOUNT_SATURATED are the same,
regardless of CONFIG_REFCOUNT_FULL, so consolidate them into a single
pair of definitions.

Signed-off-by: Will Deacon 
Reviewed-by: Ard Biesheuvel 
Reviewed-by: Kees Cook 
Tested-by: Hanjun Guo 
Cc: Ard Biesheuvel 
Cc: Elena Reshetova 
Cc: Linus Torvalds 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Link: https://lkml.kernel.org/r/20191121115902.2551-8-will@kernel.org
Signed-off-by: Ingo Molnar 
Signed-off-by: Sasha Levin