{"push_id":1543038434,"size":6,"distinct_size":6,"ref":"refs/heads/master","head":"6d123e97466ecc890d4ab2ad4892a1f37e0353f5","before":"bfa8035f657dfddd28df936f8cbb123067643eb4","commits":[{"sha":"436ac7bcf77c4424a33ab2a733459868d355f807","author":{"name":"Philip Pettersson","email":"a92d5039dce26639c800f4cf2f37bd0c3c2ae41c@gmail.com"},"message":"packet: fix race condition in packet_set_ring\n\n(cherry picked from commit 84ac7260236a49c79eede91617700174c2c19b0c)\n\nWhen packet_set_ring creates a ring buffer it will initialize a\nstruct timer_list if the packet version is TPACKET_V3. This value\ncan then be raced by a different thread calling setsockopt to\nset the version to TPACKET_V1 before packet_set_ring has finished.\n\nThis leads to a use-after-free on a function pointer in the\nstruct timer_list when the socket is closed as the previously\ninitialized timer will not be deleted.\n\nThe bug is fixed by taking lock_sock(sk) in packet_setsockopt when\nchanging the packet version while also taking the lock at the start\nof packet_set_ring.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nSigned-off-by: Philip Pettersson <philip.pettersson@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Ice451620ecf2c2a5ba3709f45fbb5f3f5c5bb389\nBug: 33358926","distinct":true,"url":"https://api.github.com/repos/Noxxxious/Zero/commits/436ac7bcf77c4424a33ab2a733459868d355f807"},{"sha":"6742e0d3ddd3d54c52bb105592ba15a7d6369bb8","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: avoid signed overflows for SO_{SND|RCV}BUFFORCE\n\n(cherry picked from commit b98b0bc8c431e3ceb4b26b0dfc8db509518fb290)\n\nCAP_NET_ADMIN users should not be allowed to set negative\nsk_sndbuf or sk_rcvbuf values, as it can lead to various memory\ncorruptions, crashes, OOM...\n\nNote that before commit 82981930125a (\"net: cleanups in\nsock_setsockopt()\"), the bug was even more serious, since SO_SNDBUF\nand SO_RCVBUF were vulnerable.\n\nThis needs to be backported to all known linux kernels.\n\nAgain, many thanks to syzkaller team for discovering this gem.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: I2b621c28c02267af5b34a379b2970fe5fb61a4f6\nBug: 33363517","distinct":true,"url":"https://api.github.com/repos/Noxxxious/Zero/commits/6742e0d3ddd3d54c52bb105592ba15a7d6369bb8"},{"sha":"0652a96e3a38c6e6e007ae9edc4b84558a06049c","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix 0 divide in __tcp_select_window()\n\nsyszkaller fuzzer was able to trigger a divide by zero, when\nTCP window scaling is not enabled.\n\nSO_RCVBUF can be used not only to increase sk_rcvbuf, also\nto decrease it below current receive buffers utilization.\n\nIf mss is negative or 0, just return a zero TCP window.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov  <dvyukov@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/Noxxxious/Zero/commits/0652a96e3a38c6e6e007ae9edc4b84558a06049c"},{"sha":"605fb53a3a7acbddd36d584674cc677fb8935203","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: refactor sk_page_frag_refill()\n\nWhile working on virtio_net new allocation strategy to increase\npayload/truesize ratio, we found that refactoring sk_page_frag_refill()\nwas needed.\n\nThis patch splits sk_page_frag_refill() into two parts, adding\nskb_page_frag_refill() which can be used without a socket.\n\nWhile we are at it, add a minimum frag size of 32 for\nsk_page_frag_refill()\n\nMichael will either use netdev_alloc_frag() from softirq context,\nor skb_page_frag_refill() from process context in refill_work()\n (GFP_KERNEL allocations)\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Michael Dalton <mwdalton@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit 400dfd3ae899849b27d398ca7894e1b44430887f)\nChange-Id: If4e75d8e19ea3b5250edf365397e55bbdd161f61\nReviewed-on: http://gerrit.mot.com/753137\nSME-Granted: SME Approvals Granted\nSubmit-Approved: Jira Key <jirakey@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nReviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>\nSigned-off-by: franciscofranco <franciscofranco.1990@gmail.com>\n\nnet: allow > 0 order atomic page alloc in skb_page_frag_refill\n\nskb_page_frag_refill currently permits only order-0 page allocs\nunless GFP_WAIT is used. Change skb_page_frag_refill to attempt\nhigher-order page allocations whether or not GFP_WAIT is used. If\nmemory cannot be allocated, the allocator will fall back to\nsuccessively smaller page allocs (down to order-0 page allocs).\n\nThis change brings skb_page_frag_refill in line with the existing\npage allocation strategy employed by netdev_alloc_frag, which attempts\nhigher-order page allocations whether or not GFP_WAIT is set, falling\nback to successively lower-order page allocations on failure. Part\nof migration of virtio-net to per-receive queue page frag allocators.\n\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Michael Dalton <mwdalton@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit 097b4f19e508015ca65a28ea4876740d35a19eea)\nChange-Id: Ic17955bf5cbc74a8e2ca3fa00e7ce8431e865011\nReviewed-on: http://gerrit.mot.com/753138\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nSME-Granted: SME Approvals Granted\nSubmit-Approved: Jira Key <jirakey@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nReviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>\nSigned-off-by: franciscofranco <franciscofranco.1990@gmail.com>\n\nnet: use __GFP_NORETRY for high order allocations\n\nsock_alloc_send_pskb() & sk_page_frag_refill()\nhave a loop trying high order allocations to prepare\nskb with low number of fragments as this increases performance.\n\nProblem is that under memory pressure/fragmentation, this can\ntrigger OOM while the intent was only to try the high order\nallocations, then fallback to order-0 allocations.\n\nWe had various reports from unexpected regressions.\n\nAccording to David, setting __GFP_NORETRY should be fine,\nas the asynchronous compaction is still enabled, and this\nwill prevent OOM from kicking as in :\n\nCFSClientEventm invoked oom-killer: gfp_mask=0x42d0, order=3, oom_adj=0,\noom_score_adj=0, oom_score_badness=2 (enabled),memcg_scoring=disabled\nCFSClientEventm\n\nCall Trace:\n [<ffffffff8043766c>] dump_header+0xe1/0x23e\n [<ffffffff80437a02>] oom_kill_process+0x6a/0x323\n [<ffffffff80438443>] out_of_memory+0x4b3/0x50d\n [<ffffffff8043a4a6>] __alloc_pages_may_oom+0xa2/0xc7\n [<ffffffff80236f42>] __alloc_pages_nodemask+0x1002/0x17f0\n [<ffffffff8024bd23>] alloc_pages_current+0x103/0x2b0\n [<ffffffff8028567f>] sk_page_frag_refill+0x8f/0x160\n [<ffffffff80295fa0>] tcp_sendmsg+0x560/0xee0\n [<ffffffff802a5037>] inet_sendmsg+0x67/0x100\n [<ffffffff80283c9c>] __sock_sendmsg_nosec+0x6c/0x90\n [<ffffffff80283e85>] sock_sendmsg+0xc5/0xf0\n [<ffffffff802847b6>] __sys_sendmsg+0x136/0x430\n [<ffffffff80284ec8>] sys_sendmsg+0x88/0x110\n [<ffffffff80711472>] system_call_fastpath+0x16/0x1b\nOut of Memory: Kill process 2856 (bash) score 9999 or sacrifice child\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: David Rientjes <rientjes@google.com>\nAcked-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit ed98df3361f059db42786c830ea96e2d18b8d4db)\nChange-Id: I8a20bbd1509b3d81c4c1c25f39140d325da25982\nReviewed-on: http://gerrit.mot.com/753139\nSubmit-Approved: Jira Key <jirakey@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nSME-Granted: SME Approvals Granted\nReviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>\nSigned-off-by: franciscofranco <franciscofranco.1990@gmail.com>\n\nnet: attempt a single high order allocation\n\nIn commit ed98df3361f0 (\"net: use __GFP_NORETRY for high order\nallocations\") we tried to address one issue caused by order-3\nallocations.\n\nWe still observe high latencies and system overhead in situations where\ncompaction is not successful.\n\nInstead of trying order-3, order-2, and order-1, do a single order-3\nbest effort and immediately fallback to plain order-0.\n\nThis mimics slub strategy to fallback to slab min order if the high\norder allocation used for performance failed.\n\nOrder-3 allocations give a performance boost only if they can be done\nwithout recurring and expensive memory scan.\n\nQuoting David :\n\nThe page allocator relies on synchronous (sync light) memory compaction\nafter direct reclaim for allocations that don't retry and deferred\ncompaction doesn't work with this strategy because the allocation order\nis always decreasing from the previous failed attempt.\n\nThis means sync light compaction will always be encountered if memory\ncannot be defragmented or reclaimed several times during the\nskb_page_frag_refill() iteration.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: David Rientjes <rientjes@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit d9b2938aabf757da2d40153489b251d4fc3fdd18)\nChange-Id: I30e6ae5d46aebdb7a3c0eb978e67283e00174abc\nReviewed-on: http://gerrit.mot.com/753140\nSubmit-Approved: Jira Key <jirakey@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nSME-Granted: SME Approvals Granted\nReviewed-by: Jeffrey Carlyle <jeff.carlyle@motorola.com>\nSigned-off-by: franciscofranco <franciscofranco.1990@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Noxxxious/Zero/commits/605fb53a3a7acbddd36d584674cc677fb8935203"},{"sha":"ed16d26ffd6ef83eedc94d6e80b69952229dd7a7","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: hrtimer: Handle start/stop more properly\n\ncommit d2c5cf88d5282de258f4eb6ab40040b80a075cd8 upstream.\n\nThis patch tries to address the still remaining issues in ALSA hrtimer\ndriver:\n- Spurious use-after-free was detected in hrtimer callback\n- Incorrect rescheduling due to delayed start\n- WARN_ON() is triggered in hrtimer_forward() invoked in hrtimer\n  callback\n\nThe first issue happens only when the new timer is scheduled even\nwhile hrtimer is being closed.  It's related with the second and third\nitems; since ALSA timer core invokes hw.start callback during hrtimer\ninterrupt, this may result in the explicit call of hrtimer_start().\n\nAlso, the similar problem is seen for the stop; ALSA timer core\ninvokes hw.stop callback even in the hrtimer handler, too.  Since we\nmust not call the synced hrtimer_cancel() in such a context, it's just\na hrtimer_try_to_cancel() call that doesn't properly work.\n\nAnother culprit of the second and third items is the call of\nhrtimer_forward_now() before snd_timer_interrupt().  The timer->stick\nvalue may change during snd_timer_interrupt() call, but this\npossibility is ignored completely.\n\nFor covering these subtle and messy issues, the following changes have\nbeen done in this patch:\n- A new flag, in_callback, is introduced in the private data to\n  indicate that the hrtimer handler is being processed.\n- Both start and stop callbacks skip when called from (during)\n  in_callback flag.\n- The hrtimer handler returns properly HRTIMER_RESTART and NORESTART\n  depending on the running state now.\n- The hrtimer handler reprograms the expiry properly after\n  snd_timer_interrupt() call, instead of before.\n- The close callback clears running flag and sets in_callback flag\n  to block any further start/stop calls.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>\n\nALSA: timer: fix NULL pointer dereference in read()/ioctl() race\n\ncommit 11749e086b2766cccf6217a527ef5c5604ba069c upstream.\n\nI got this with syzkaller:\n\n    ==================================================================\n    BUG: KASAN: null-ptr-deref on address 0000000000000020\n    Read of size 32 by task syz-executor/22519\n    CPU: 1 PID: 22519 Comm: syz-executor Not tainted 4.8.0-rc2+ #169\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2\n    014\n     0000000000000001 ffff880111a17a00 ffffffff81f9f141 ffff880111a17a90\n     ffff880111a17c50 ffff880114584a58 ffff880114584a10 ffff880111a17a80\n     ffffffff8161fe3f ffff880100000000 ffff880118d74a48 ffff880118d74a68\n    Call Trace:\n     [<ffffffff81f9f141>] dump_stack+0x83/0xb2\n     [<ffffffff8161fe3f>] kasan_report_error+0x41f/0x4c0\n     [<ffffffff8161ff74>] kasan_report+0x34/0x40\n     [<ffffffff82c84b54>] ? snd_timer_user_read+0x554/0x790\n     [<ffffffff8161e79e>] check_memory_region+0x13e/0x1a0\n     [<ffffffff8161e9c1>] kasan_check_read+0x11/0x20\n     [<ffffffff82c84b54>] snd_timer_user_read+0x554/0x790\n     [<ffffffff82c84600>] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0\n     [<ffffffff817d0831>] ? proc_fault_inject_write+0x1c1/0x250\n     [<ffffffff817d0670>] ? next_tgid+0x2a0/0x2a0\n     [<ffffffff8127c278>] ? do_group_exit+0x108/0x330\n     [<ffffffff8174653a>] ? fsnotify+0x72a/0xca0\n     [<ffffffff81674dfe>] __vfs_read+0x10e/0x550\n     [<ffffffff82c84600>] ? snd_timer_user_info_compat.isra.5+0x2b0/0x2b0\n     [<ffffffff81674cf0>] ? do_sendfile+0xc50/0xc50\n     [<ffffffff81745e10>] ? __fsnotify_update_child_dentry_flags+0x60/0x60\n     [<ffffffff8143fec6>] ? kcov_ioctl+0x56/0x190\n     [<ffffffff81e5ada2>] ? common_file_perm+0x2e2/0x380\n     [<ffffffff81746b0e>] ? __fsnotify_parent+0x5e/0x2b0\n     [<ffffffff81d93536>] ? security_file_permission+0x86/0x1e0\n     [<ffffffff816728f5>] ? rw_verify_area+0xe5/0x2b0\n     [<ffffffff81675355>] vfs_read+0x115/0x330\n     [<ffffffff81676371>] SyS_read+0xd1/0x1a0\n     [<ffffffff816762a0>] ? vfs_write+0x4b0/0x4b0\n     [<ffffffff82001c2c>] ? __this_cpu_preempt_check+0x1c/0x20\n     [<ffffffff8150455a>] ? __context_tracking_exit.part.4+0x3a/0x1e0\n     [<ffffffff816762a0>] ? vfs_write+0x4b0/0x4b0\n     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0\n     [<ffffffff810052fc>] ? syscall_return_slowpath+0x16c/0x1d0\n     [<ffffffff83c3276a>] entry_SYSCALL64_slow_path+0x25/0x25\n    ==================================================================\n\nThere are a couple of problems that I can see:\n\n - ioctl(SNDRV_TIMER_IOCTL_SELECT), which potentially sets\n   tu->queue/tu->tqueue to NULL on memory allocation failure, so read()\n   would get a NULL pointer dereference like the above splat\n\n - the same ioctl() can free tu->queue/to->tqueue which means read()\n   could potentially see (and dereference) the freed pointer\n\nWe can fix both by taking the ioctl_lock mutex when dereferencing\n->queue/->tqueue, since that's always held over all the ioctl() code.\n\nJust looking at the code I find it likely that there are more problems\nhere such as tu->qhead pointing outside the buffer if the size is\nchanged concurrently using SNDRV_TIMER_IOCTL_PARAMS.\n\n[js] unlock in fail paths\n\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\n\nALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE\n\ncommit 6b760bb2c63a9e322c0e4a0b5daf335ad93d5a33 upstream.\n\nI got this:\n\n    divide error: 0000 [#1] PREEMPT SMP KASAN\n    CPU: 1 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #189\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014\n    task: ffff8801120a9580 task.stack: ffff8801120b0000\n    RIP: 0010:[<ffffffff82c8bd9a>]  [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0\n    RSP: 0018:ffff88011aa87da8  EFLAGS: 00010006\n    RAX: 0000000000004f76 RBX: ffff880112655e88 RCX: 0000000000000000\n    RDX: 0000000000000000 RSI: ffff880112655ea0 RDI: 0000000000000001\n    RBP: ffff88011aa87e00 R08: ffff88013fff905c R09: ffff88013fff9048\n    R10: ffff88013fff9050 R11: 00000001050a7b8c R12: ffff880114778a00\n    R13: ffff880114778ab4 R14: ffff880114778b30 R15: 0000000000000000\n    FS:  00007f071647c700(0000) GS:ffff88011aa80000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000603001 CR3: 0000000112021000 CR4: 00000000000006e0\n    Stack:\n     0000000000000000 ffff880114778ab8 ffff880112655ea0 0000000000004f76\n     ffff880112655ec8 ffff880112655e80 ffff880112655e88 ffff88011aa98fc0\n     00000000b97ccf2b dffffc0000000000 ffff88011aa98fc0 ffff88011aa87ef0\n    Call Trace:\n     <IRQ>\n     [<ffffffff813abce7>] __hrtimer_run_queues+0x347/0xa00\n     [<ffffffff82c8bbc0>] ? snd_hrtimer_close+0x130/0x130\n     [<ffffffff813ab9a0>] ? retrigger_next_event+0x1b0/0x1b0\n     [<ffffffff813ae1a6>] ? hrtimer_interrupt+0x136/0x4b0\n     [<ffffffff813ae220>] hrtimer_interrupt+0x1b0/0x4b0\n     [<ffffffff8120f91e>] local_apic_timer_interrupt+0x6e/0xf0\n     [<ffffffff81227ad3>] ? kvm_guest_apic_eoi_write+0x13/0xc0\n     [<ffffffff83c35086>] smp_apic_timer_interrupt+0x76/0xa0\n     [<ffffffff83c3416c>] apic_timer_interrupt+0x8c/0xa0\n     <EOI>\n     [<ffffffff83c3239c>] ? _raw_spin_unlock_irqrestore+0x2c/0x60\n     [<ffffffff82c8185d>] snd_timer_start1+0xdd/0x670\n     [<ffffffff82c87015>] snd_timer_continue+0x45/0x80\n     [<ffffffff82c88100>] snd_timer_user_ioctl+0x1030/0x2830\n     [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90\n     [<ffffffff815aa4f8>] ? handle_mm_fault+0xbc8/0x27f0\n     [<ffffffff815a9930>] ? __pmd_alloc+0x370/0x370\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050\n     [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200\n     [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0\n     [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0\n     [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190\n     [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0\n     [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0\n     [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0\n     [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050\n     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0\n     [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25\n    Code: e8 fc 42 7b fe 8b 0d 06 8a 50 03 49 0f af cf 48 85 c9 0f 88 7c 01 00 00 48 89 4d a8 e8 e0 42 7b fe 48 8b 45 c0 48 8b 4d a8 48 99 <48> f7 f9 49 01 c7 e8 cb 42 7b fe 48 8b 55 d0 48 b8 00 00 00 00\n    RIP  [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0\n     RSP <ffff88011aa87da8>\n    ---[ end trace 6aa380f756a21074 ]---\n\nThe problem happens when you call ioctl(SNDRV_TIMER_IOCTL_CONTINUE) on a\ncompletely new/unused timer -- it will have ->sticks == 0, which causes a\ndivide by 0 in snd_hrtimer_callback().\n\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\n\nALSA: timer: fix NULL pointer dereference on memory allocation failure\n\ncommit 8ddc05638ee42b18ba4fe99b5fb647fa3ad20456 upstream.\n\nI hit this with syzkaller:\n\n    kasan: CONFIG_KASAN_INLINE enabled\n    kasan: GPF could be caused by NULL-ptr deref or user memory access\n    general protection fault: 0000 [#1] PREEMPT SMP KASAN\n    CPU: 0 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #190\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014\n    task: ffff88011278d600 task.stack: ffff8801120c0000\n    RIP: 0010:[<ffffffff82c8ba07>]  [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100\n    RSP: 0018:ffff8801120c7a60  EFLAGS: 00010006\n    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000007\n    RDX: 0000000000000009 RSI: 1ffff10023483091 RDI: 0000000000000048\n    RBP: ffff8801120c7a78 R08: ffff88011a5cf768 R09: ffff88011a5ba790\n    R10: 0000000000000002 R11: ffffed00234b9ef1 R12: ffff880114843980\n    R13: ffffffff84213c00 R14: ffff880114843ab0 R15: 0000000000000286\n    FS:  00007f72958f3700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000603001 CR3: 00000001126ab000 CR4: 00000000000006f0\n    Stack:\n     ffff880114843980 ffff880111eb2dc0 ffff880114843a34 ffff8801120c7ad0\n     ffffffff82c81ab1 0000000000000000 ffffffff842138e0 0000000100000000\n     ffff880111eb2dd0 ffff880111eb2dc0 0000000000000001 ffff880111eb2dc0\n    Call Trace:\n     [<ffffffff82c81ab1>] snd_timer_start1+0x331/0x670\n     [<ffffffff82c85bfd>] snd_timer_start+0x5d/0xa0\n     [<ffffffff82c8795e>] snd_timer_user_ioctl+0x88e/0x2830\n     [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90\n     [<ffffffff8132762f>] ? put_prev_entity+0x108f/0x21a0\n     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80\n     [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050\n     [<ffffffff813510af>] ? cpuacct_account_field+0x12f/0x1a0\n     [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200\n     [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0\n     [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0\n     [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190\n     [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0\n     [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0\n     [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0\n     [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050\n     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0\n     [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25\n    Code: c7 c7 c4 b9 c8 82 48 89 d9 4c 89 ee e8 63 88 7f fe e8 7e 46 7b fe 48 8d 7b 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 04 84 c0 7e 65 80 7b 48 00 74 0e e8 52 46\n    RIP  [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100\n     RSP <ffff8801120c7a60>\n    ---[ end trace 5955b08db7f2b029 ]---\n\nThis can happen if snd_hrtimer_open() fails to allocate memory and\nreturns an error, which is currently not checked by snd_timer_open():\n\n    ioctl(SNDRV_TIMER_IOCTL_SELECT)\n     - snd_timer_user_tselect()\n\t- snd_timer_close()\n\t   - snd_hrtimer_close()\n\t      - (struct snd_timer *) t->private_data = NULL\n        - snd_timer_open()\n           - snd_hrtimer_open()\n              - kzalloc() fails; t->private_data is still NULL\n\n    ioctl(SNDRV_TIMER_IOCTL_START)\n     - snd_timer_user_start()\n\t- snd_timer_start()\n\t   - snd_timer_start1()\n\t      - snd_hrtimer_start()\n\t\t- t->private_data == NULL // boom\n\n[js] no put_device in 3.12 yet\n\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\n\nALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()\n\n(cherry picked from commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729)\n\nJust a minor code cleanup: unify the error paths.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nChange-Id: I8253a86235df2ac1258153c9e128fa158527567f\nBug: 30952477\n\nALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call\n\n(cherry picked from commit 836b34a935abc91e13e63053d0a83b24dfb5ea78)\n\ncreate_fixed_stream_quirk(), snd_usb_parse_audio_interface() and\ncreate_uaxx_quirk() functions allocate the audioformat object by themselves\nand free it upon error before returning. However, once the object is linked\nto a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be\ndouble-freed, eventually resulting in a memory corruption.\n\nThis patch fixes these failures in the error paths by unlinking the audioformat\nobject before freeing it.\n\nBased on a patch by Takashi Iwai <tiwai@suse.de>\n\n[Note for stable backports:\n this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor\n code cleanup in create_fixed_stream_quirk()')]\n\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nCc: <stable@vger.kernel.org> # see the note above\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nChange-Id: I7073a17d8c99886d2f6ed7981892712ba7dd5873\nBug: 30952477","distinct":true,"url":"https://api.github.com/repos/Noxxxious/Zero/commits/ed16d26ffd6ef83eedc94d6e80b69952229dd7a7"},{"sha":"6d123e97466ecc890d4ab2ad4892a1f37e0353f5","author":{"name":"Calvin Owens","email":"114f95235b01701def87f33797e11d10e01315ab@fb.com"},"message":"sg: Fix double-free when drives detach during SG_IO\n\nIn sg_common_write(), we free the block request and return -ENODEV if\nthe device is detached in the middle of the SG_IO ioctl().\n\nUnfortunately, sg_finish_rem_req() also tries to free srp->rq, so we\nend up freeing rq->cmd in the already free rq object, and then free\nthe object itself out from under the current user.\n\nThis ends up corrupting random memory via the list_head on the rq\nobject. The most common crash trace I saw is this:\n\n  ------------[ cut here ]------------\n  kernel BUG at block/blk-core.c:1420!\n  Call Trace:\n  [<ffffffff81281eab>] blk_put_request+0x5b/0x80\n  [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg]\n  [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg]\n  [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70\n  [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg]\n  [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg]\n  [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520\n  [<ffffffff81258967>] ? file_has_perm+0x97/0xb0\n  [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0\n  [<ffffffff81602afb>] tracesys+0xdd/0xe2\n    RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0\n\nThe solution is straightforward: just set srp->rq to NULL in the\nfailure branch so that sg_finish_rem_req() doesn't attempt to re-free\nit.\n\nAdditionally, since sg_rq_end_io() will never be called on the object\nwhen this happens, we need to free memory backing ->cmd if it isn't\nembedded in the object itself.\n\nKASAN was extremely helpful in finding the root cause of this bug.\n\nChange-Id: I8c2389a4e2e1b5f753a47f8af60502a761b891b5\nSigned-off-by: Calvin Owens <calvinowens@fb.com>\nAcked-by: Douglas Gilbert <dgilbert@interlog.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>","distinct":true,"url":"https://api.github.com/repos/Noxxxious/Zero/commits/6d123e97466ecc890d4ab2ad4892a1f37e0353f5"}]}
{"actor":{"display_login":"Noxxxious"}}