Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d4f5f22 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 4.19.229 into android-4.19-stable 



Changes in 4.19.229
	cgroup-v1: Require capabilities to set release_agent
	moxart: fix potential use-after-free on remove path
	tipc: improve size validations for received domain records
	Linux 4.19.229

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I425e37c9c77cc1ba3ba312b858f2e19dee2f3ae9
parents 1b16e1db 6b09c9f0

Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

VERSION = 4

PATCHLEVEL = 19

SUBLEVEL = 228

SUBLEVEL = 229

EXTRAVERSION =

NAME = "People's Front"

drivers/mmc/host/moxart-mmc.c

+1 −1
Original line number Diff line number Diff line
@@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev) 
		if (!IS_ERR(host->dma_chan_rx))

			dma_release_channel(host->dma_chan_rx);

		mmc_remove_host(mmc);

		mmc_free_host(mmc);



		writel(0, host->base + REG_INTERRUPT_MASK);

		writel(0, host->base + REG_POWER_CONTROL);

		writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,

		       host->base + REG_CLOCK_CONTROL);

		mmc_free_host(mmc);

	}

	return 0;

}

kernel/cgroup/cgroup-v1.c

+24 −0
Original line number Diff line number Diff line
@@ -565,6 +565,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, 


	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);



	/*

	 * Release agent gets called with all capabilities,

	 * require capabilities to set release agent.

	 */

	if ((of->file->f_cred->user_ns != &init_user_ns) ||

	    !capable(CAP_SYS_ADMIN))

		return -EPERM;



	cgrp = cgroup_kn_lock_live(of->kn, false);

	if (!cgrp)

		return -ENODEV;
@@ -1040,6 +1048,7 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data) 
{

	int ret = 0;

	struct cgroup_root *root = cgroup_root_from_kf(kf_root);

	struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;

	struct cgroup_sb_opts opts;

	u16 added_mask, removed_mask;
@@ -1053,6 +1062,12 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data) 
	if (opts.subsys_mask != root->subsys_mask || opts.release_agent)

		pr_warn("option changes via remount are deprecated (pid=%d comm=%s)\n",

			task_tgid_nr(current), current->comm);

	/* See cgroup1_mount release_agent handling */

	if (opts.release_agent &&

	    ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {

		ret = -EINVAL;

		goto out_unlock;

	}



	added_mask = opts.subsys_mask & ~root->subsys_mask;

	removed_mask = root->subsys_mask & ~opts.subsys_mask;
@@ -1191,6 +1206,15 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags, 
		ret = -EPERM;

		goto out_unlock;

	}

	/*

	 * Release agent gets called with all capabilities,

	 * require capabilities to set release agent.

	 */

	if (opts.release_agent &&

	    ((ns->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))) {

		ret = -EINVAL;

		goto out_unlock;

	}



	root = kzalloc(sizeof(*root), GFP_KERNEL);

	if (!root) {

net/tipc/link.c

+4 −1
Original line number Diff line number Diff line
@@ -1579,13 +1579,16 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, 
	u16 peers_tol = msg_link_tolerance(hdr);

	u16 peers_prio = msg_linkprio(hdr);

	u16 rcv_nxt = l->rcv_nxt;

	u16 dlen = msg_data_sz(hdr);

	u32 dlen = msg_data_sz(hdr);

	int mtyp = msg_type(hdr);

	bool reply = msg_probe(hdr);

	void *data;

	char *if_name;

	int rc = 0;



	if (dlen > U16_MAX)

		goto exit;



	if (tipc_link_is_blocked(l) || !xmitq)

		goto exit;

net/tipc/monitor.c

+2 −0
Original line number Diff line number Diff line
@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr, 
	state->probing = false;



	/* Sanity check received domain record */

	if (new_member_cnt > MAX_MON_DOMAIN)

		return;

	if (dlen < dom_rec_len(arrv_dom, 0))

		return;

	if (dlen != dom_rec_len(arrv_dom, new_member_cnt))