Linux 5.14.1
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.14.1 kernel.
All users of the 5.14 kernel series must upgrade.
The updated 5.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +- drivers/block/floppy.c | 30 +++++++++++++++--------------- drivers/bluetooth/btusb.c | 22 ++++++++++++++-------- drivers/net/dsa/mt7530.c | 5 +---- drivers/tty/vt/vt_ioctl.c | 10 ++++++---- fs/btrfs/volumes.c | 2 +- fs/crypto/hooks.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ fs/ext4/symlink.c | 12 +++++++++++- fs/f2fs/namei.c | 12 +++++++++++- fs/ubifs/file.c | 13 ++++++++++++- include/linux/fscrypt.h | 7 +++++++ include/linux/netdevice.h | 4 ++++ kernel/audit_tree.c | 2 +- net/socket.c | 6 +++++- 14 files changed, 133 insertions(+), 38 deletions(-)
DENG Qingfang (1):
net: dsa: mt7530: fix VLAN traffic leaks again
Denis Efremov (1):
Revert "floppy: reintroduce O_NDELAY fix"
Eric Biggers (4):
fscrypt: add fscrypt_symlink_getattr() for computing st_size
ext4: report correct st_size for encrypted symlinks
f2fs: report correct st_size for encrypted symlinks
ubifs: report correct st_size for encrypted symlinks
Greg Kroah-Hartman (1):
Linux 5.14.1
Linus Torvalds (1):
vt_kdsetmode: extend console locking
Pauli Virtanen (1):
Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
Peter Collingbourne (1):
net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
Qu Wenruo (1):
btrfs: fix NULL pointer dereference when deleting device by invalid id
Richard Guy Briggs (1):
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 14 -SUBLEVEL = 0 +SUBLEVEL = 1 EXTRAVERSION = NAME = Opossums on Parade
drivers/block/floppy.c +15 -15
@@ -4029,23 +4029,23 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)if (fdc_state[FDC (drive)].rawcmd ==1 ) fdc_state[FDC (drive)].rawcmd =2 ; -if (mode & (FMODE_READ |FMODE_WRITE )) { - drive_state[drive].last_checked =0 ; -clear_bit (FD_OPEN_SHOULD_FAIL_BIT , &drive_state[drive].flags); -if (bdev_check_media_change (bdev)) -floppy_revalidate (bdev->bd_disk); -if (test_bit (FD_DISK_CHANGED_BIT , &drive_state[drive].flags)) - goto out; -if (test_bit (FD_OPEN_SHOULD_FAIL_BIT , &drive_state[drive].flags)) +if (!(mode &FMODE_NDELAY )) { +if (mode & (FMODE_READ |FMODE_WRITE )) { + drive_state[drive].last_checked =0 ; +clear_bit (FD_OPEN_SHOULD_FAIL_BIT , + &drive_state[drive].flags); +if (bdev_check_media_change (bdev)) +floppy_revalidate (bdev->bd_disk); +if (test_bit (FD_DISK_CHANGED_BIT , &drive_state[drive].flags)) + goto out; +if (test_bit (FD_OPEN_SHOULD_FAIL_BIT , &drive_state[drive].flags)) + goto out; + } + res = -EROFS ; +if ((mode &FMODE_WRITE ) && + !test_bit (FD_DISK_WRITABLE_BIT , &drive_state[drive].flags)) goto out; } - - res = -EROFS ; - -if ((mode &FMODE_WRITE ) && - !test_bit (FD_DISK_WRITABLE_BIT , &drive_state[drive].flags)) - goto out; -mutex_unlock (&open_lock);mutex_unlock (&floppy_mutex);return 0 ;
drivers/bluetooth/btusb.c +14 -8
@@ -525,6 +525,7 @@ static const struct dmi_system_id btusb_needs_reset_resume_table[] = {#define BTUSB_HW_RESET_ACTIVE 12#define BTUSB_TX_WAIT_VND_EVT 13#define BTUSB_WAKEUP_DISABLE 14 +#define BTUSB_USE_ALT3_FOR_WBS 15struct btusb_data {struct hci_dev *hdev;
@@ -1757,16 +1758,20 @@ static void btusb_work(struct work_struct *work)/* Bluetooth USB spec recommends alt 6 (63 bytes), but * many adapters do not support it. Alt 1 appears to * work for all adapters that do not have alt 6, and -* which work with WBS at all. +* which work with WBS at all. Some devices prefer +* alt 3 (HCI payload >= 60 Bytes let air packet +* data satisfy 60 bytes), requiring +* MTU >= 3 (packets) * 25 (size) - 3 (headers) = 72 +* see also Core spec 5, vol 4, B 2.1.1 & Table 2.1. */ - new_alts =btusb_find_altsetting (data,6 ) ?6 :1 ; -/* Because mSBC frames do not need to be aligned to the -* SCO packet boundary. If support the Alt 3, use the -* Alt 3 for HCI payload >= 60 Bytes let air packet -* data satisfy 60 bytes. -*/ -if (new_alts ==1 &&btusb_find_altsetting (data,3 )) +if (btusb_find_altsetting (data,6 )) + new_alts =6 ; +else if (btusb_find_altsetting (data,3 ) && + hdev->sco_mtu >=72 && +test_bit (BTUSB_USE_ALT3_FOR_WBS , &data->flags)) new_alts =3 ; +else + new_alts =1 ; }if (btusb_switch_alt_setting (hdev, new_alts) <0 )
@@ -4742,6 +4747,7 @@ static int btusb_probe(struct usb_interface *intf,* (DEVICE_REMOTE_WAKEUP) */ set_bit (BTUSB_WAKEUP_DISABLE , &data->flags); +set_bit (BTUSB_USE_ALT3_FOR_WBS , &data->flags); }if (!reset)
drivers/net/dsa/mt7530.c +1 -4
@@ -1308,11 +1308,8 @@ mt7530_port_bridge_leave(struct dsa_switch *ds, int port,/* Remove this port from the port matrix of the other ports * in the same bridge. If the port is disabled, port matrix * is kept and not being setup until the port becomes enabled. -* And the other port's port matrix cannot be broken when the -* other port is still a VLAN-aware port. */ -if (dsa_is_user_port (ds, i) && i != port && - !dsa_port_is_vlan_filtering (dsa_to_port (ds, i))) { +if (dsa_is_user_port (ds, i) && i != port) {if (dsa_to_port (ds, i)->bridge_dev != bridge)continue ;if (priv->ports[i].enable)
drivers/tty/vt/vt_ioctl.c +6 -4
@@ -246,6 +246,8 @@ int vt_waitactive(int n)* * XXX It should at least call into the driver, fbdev's definitely need to * restore their engine state. --BenH +* +* Called with the console lock held. */ static int vt_kdsetmode (struct vc_data *vc,unsigned long mode) {
@@ -262,7 +264,6 @@ static int vt_kdsetmode(struct vc_data *vc, unsigned long mode)return -EINVAL ; } -/* FIXME: this needs the console lock extending */ if (vc->vc_mode == mode)return 0 ;
@@ -271,12 +272,10 @@ static int vt_kdsetmode(struct vc_data *vc, unsigned long mode)return 0 ;/* explicitly blank/unblank the screen if switching modes */ -console_lock ();if (mode ==KD_TEXT )do_unblank_screen (1 );else do_blank_screen (1 ); -console_unlock ();return 0 ; }
@@ -378,7 +377,10 @@ static int vt_k_ioctl(struct tty_struct *tty, unsigned int cmd,if (!perm)return -EPERM ; -return vt_kdsetmode (vc, arg); +console_lock (); + ret =vt_kdsetmode (vc, arg); +console_unlock (); +return ret;case KDGETMODE :return put_user (vc->vc_mode, (int __user *)arg);
fs/btrfs/volumes.c +1 -1
@@ -2137,7 +2137,7 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,if (IS_ERR (device)) {if (PTR_ERR (device) == -ENOENT && -strcmp (device_path,"missing" ) ==0 ) + device_path &&strcmp (device_path,"missing" ) ==0 ) ret =BTRFS_ERROR_DEV_MISSING_NOT_FOUND ;else ret =PTR_ERR (device);
fs/crypto/hooks.c +44 -0
47 lines not on this page · raw message
fs/ext4/symlink.c +11 -1
@@ -52,10 +52,20 @@ static const char *ext4_encrypted_get_link(struct dentry *dentry,return paddr; } +static int ext4_encrypted_symlink_getattr (struct user_namespace *mnt_userns, +const struct path *path, +struct kstat *stat,u32 request_mask, +unsigned int query_flags) +{ +ext4_getattr (mnt_userns, path, stat, request_mask, query_flags); + +return fscrypt_symlink_getattr (path, stat); +} +const struct inode_operations ext4_encrypted_symlink_inode_operations = { .get_link = ext4_encrypted_get_link, .setattr = ext4_setattr, - .getattr = ext4_getattr, + .getattr = ext4_encrypted_symlink_getattr, .listxattr = ext4_listxattr, };
fs/f2fs/namei.c +11 -1
@@ -1323,9 +1323,19 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry,return target; } +static int f2fs_encrypted_symlink_getattr (struct user_namespace *mnt_userns, +const struct path *path, +struct kstat *stat,u32 request_mask, +unsigned int query_flags) +{ +f2fs_getattr (mnt_userns, path, stat, request_mask, query_flags); + +return fscrypt_symlink_getattr (path, stat); +} +const struct inode_operations f2fs_encrypted_symlink_inode_operations = { .get_link = f2fs_encrypted_get_link, - .getattr = f2fs_getattr, + .getattr = f2fs_encrypted_symlink_getattr, .setattr = f2fs_setattr, .listxattr = f2fs_listxattr, };
fs/ubifs/file.c +12 -1
@@ -1630,6 +1630,17 @@ static const char *ubifs_get_link(struct dentry *dentry,return fscrypt_get_symlink (inode, ui->data, ui->data_len, done); } +static int ubifs_symlink_getattr (struct user_namespace *mnt_userns, +const struct path *path,struct kstat *stat, +u32 request_mask,unsigned int query_flags) +{ +ubifs_getattr (mnt_userns, path, stat, request_mask, query_flags); + +if (IS_ENCRYPTED (d_inode (path->dentry))) +return fscrypt_symlink_getattr (path, stat); +return 0 ; +} +const struct address_space_operations ubifs_file_address_operations = { .readpage = ubifs_readpage, .writepage = ubifs_writepage,
@@ -1655,7 +1666,7 @@ const struct inode_operations ubifs_file_inode_operations = {const struct inode_operations ubifs_symlink_inode_operations = { .get_link = ubifs_get_link, .setattr = ubifs_setattr, - .getattr = ubifs_getattr, + .getattr = ubifs_symlink_getattr, .listxattr = ubifs_listxattr, .update_time = ubifs_update_time, };
include/linux/fscrypt.h +7 -0
@@ -253,6 +253,7 @@ int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,const char *fscrypt_get_symlink (struct inode *inode,const void *caddr,unsigned int max_size,struct delayed_call *done); +int fscrypt_symlink_getattr (const struct path *path,struct kstat *stat);static inline void fscrypt_set_ops (struct super_block *sb,const struct fscrypt_operations *s_cop) {
@@ -583,6 +584,12 @@ static inline const char *fscrypt_get_symlink(struct inode *inode,return ERR_PTR (-EOPNOTSUPP ); } +static inline int fscrypt_symlink_getattr (const struct path *path, +struct kstat *stat) +{ +return -EOPNOTSUPP ; +} +static inline void fscrypt_set_ops (struct super_block *sb,const struct fscrypt_operations *s_cop) {
include/linux/netdevice.h +4 -0
@@ -4012,6 +4012,10 @@ int netdev_rx_handler_register(struct net_device *dev,void netdev_rx_handler_unregister (struct net_device *dev);bool dev_valid_name (const char *name); +static inline bool is_socket_ioctl_cmd (unsigned int cmd) +{ +return _IOC_TYPE (cmd) ==SOCK_IOC_TYPE ; +}int dev_ioctl (struct net *net,unsigned int cmd,struct ifreq *ifr,bool *need_copyout);int dev_ifconf (struct net *net,struct ifconf *,int );
kernel/audit_tree.c +1 -1
@@ -593,7 +593,6 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged)spin_lock (&hash_lock); }spin_unlock (&hash_lock); -put_tree (victim); }/*
@@ -602,6 +601,7 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged)static void prune_one (struct audit_tree *victim) {prune_tree_chunks (victim, false); +put_tree (victim); }/* trim the uncommitted chunks from tree */
net/socket.c +5 -1
@@ -1109,7 +1109,7 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,rtnl_unlock ();if (!err &©_to_user (argp, &ifc,sizeof (struct ifconf ))) err = -EFAULT ; - }else { + }else if (is_socket_ioctl_cmd (cmd)) {struct ifreq ifr;bool need_copyout;if (copy_from_user (&ifr, argp,sizeof (struct ifreq )))
@@ -1118,6 +1118,8 @@ static long sock_do_ioctl(struct net *net, struct socket *sock,if (!err && need_copyout)if (copy_to_user (argp, &ifr,sizeof (struct ifreq )))return -EFAULT ; + }else { + err = -ENOTTY ; }return err; }
@@ -3306,6 +3308,8 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,struct ifreq ifreq;u32 data32; +if (!is_socket_ioctl_cmd (cmd)) +return -ENOTTY ;if (copy_from_user (ifreq.ifr_name, u_ifreq32->ifr_name,IFNAMSIZ ))return -EFAULT ;if (get_user (data32, &u_ifreq32->ifr_data))