Linux 4.19.229
Greg Kroah-Hartman
maintainerI'm announcing the release of the 4.19.229 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +- drivers/mmc/host/moxart-mmc.c | 2 +- kernel/cgroup/cgroup-v1.c | 24 ++++++++++++++++++++++++ net/tipc/link.c | 5 ++++- net/tipc/monitor.c | 2 ++ 5 files changed, 32 insertions(+), 3 deletions(-)
Eric W. Biederman (1):
cgroup-v1: Require capabilities to set release_agent
Greg Kroah-Hartman (2):
moxart: fix potential use-after-free on remove path Linux 4.19.229
Jon Maloy (1):
tipc: improve size validations for received domain records
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 4 PATCHLEVEL = 19 -SUBLEVEL = 228 +SUBLEVEL = 229 EXTRAVERSION = NAME = "People's Front"
drivers/mmc/host/moxart-mmc.c +1 -1
@@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev)if (!IS_ERR (host->dma_chan_rx))dma_release_channel (host->dma_chan_rx);mmc_remove_host (mmc); -mmc_free_host (mmc);writel (0 , host->base +REG_INTERRUPT_MASK );writel (0 , host->base +REG_POWER_CONTROL );writel (readl (host->base +REG_CLOCK_CONTROL ) |CLK_OFF , host->base +REG_CLOCK_CONTROL ); +mmc_free_host (mmc); }return 0 ; }
kernel/cgroup/cgroup-v1.c +24 -0
@@ -577,6 +577,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,BUILD_BUG_ON (sizeof (cgrp->root->release_agent_path) <PATH_MAX ); +/* +* Release agent gets called with all capabilities, +* require capabilities to set release agent. +*/ +if ((of->file->f_cred->user_ns != &init_user_ns) || + !capable (CAP_SYS_ADMIN )) +return -EPERM ; + cgrp =cgroup_kn_lock_live (of->kn, false);if (!cgrp)return -ENODEV ;
@@ -1048,6 +1056,7 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data) {int ret =0 ;struct cgroup_root *root =cgroup_root_from_kf (kf_root); +struct cgroup_namespace *ns = current->nsproxy->cgroup_ns;struct cgroup_sb_opts opts;u16 added_mask, removed_mask;
@@ -1061,6 +1070,12 @@ static int cgroup1_remount(struct kernfs_root *kf_root, int *flags, char *data)if (opts.subsys_mask != root->subsys_mask || opts.release_agent)pr_warn ("option changes via remount are deprecated (pid=%d comm=%s)\n" ,task_tgid_nr (current), current->comm); +/* See cgroup1_mount release_agent handling */ +if (opts.release_agent && + ((ns->user_ns != &init_user_ns) || !capable (CAP_SYS_ADMIN ))) { + ret = -EINVAL ; + goto out_unlock; + } added_mask = opts.subsys_mask & ~root->subsys_mask; removed_mask = root->subsys_mask & ~opts.subsys_mask;
@@ -1224,6 +1239,15 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags, ret = -EPERM ; goto out_unlock; } +/* +* Release agent gets called with all capabilities, +* require capabilities to set release agent. +*/ +if (opts.release_agent && + ((ns->user_ns != &init_user_ns) || !capable (CAP_SYS_ADMIN ))) { + ret = -EINVAL ; + goto out_unlock; + } root =kzalloc (sizeof (*root),GFP_KERNEL );if (!root) {
net/tipc/link.c +4 -1
@@ -1579,13 +1579,16 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,u16 peers_tol =msg_link_tolerance (hdr);u16 peers_prio =msg_linkprio (hdr);u16 rcv_nxt = l->rcv_nxt; -u16 dlen =msg_data_sz (hdr); +u32 dlen =msg_data_sz (hdr);int mtyp =msg_type (hdr);bool reply =msg_probe (hdr);void *data;char *if_name;int rc =0 ; +if (dlen >U16_MAX ) + goto exit; +if (tipc_link_is_blocked (l) || !xmitq) goto exit;
net/tipc/monitor.c +2 -0
@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr, state->probing = false;/* Sanity check received domain record */ +if (new_member_cnt >MAX_MON_DOMAIN ) +return ;if (dlen <dom_rec_len (arrv_dom,0 ))return ;if (dlen !=dom_rec_len (arrv_dom, new_member_cnt))