Simon Gaiser
6 years ago
parent
8905340413
commit
4700f2cff4
@ -1,50 +0,0 @@
|
||||
From 50220dead1650609206efe91f0cc116132d59b3f Mon Sep 17 00:00:00 2001
|
||||
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
|
||||
Date: Tue, 19 Jan 2016 12:34:58 +0100
|
||||
Subject: [PATCH] HID: core: prevent out-of-bound readings
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Plugging a Logitech DJ receiver with KASAN activated raises a bunch of
|
||||
out-of-bound readings.
|
||||
|
||||
The fields are allocated up to MAX_USAGE, meaning that potentially, we do
|
||||
not have enough fields to fit the incoming values.
|
||||
Add checks and silence KASAN.
|
||||
|
||||
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
|
||||
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
|
||||
---
|
||||
drivers/hid/hid-core.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
|
||||
index 16c2c66..3f6ac5f 100644
|
||||
--- a/drivers/hid/hid-core.c
|
||||
+++ b/drivers/hid/hid-core.c
|
||||
@@ -1293,6 +1293,7 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
|
||||
/* Ignore report if ErrorRollOver */
|
||||
if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&
|
||||
value[n] >= min && value[n] <= max &&
|
||||
+ value[n] - min < field->maxusage &&
|
||||
field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
|
||||
goto exit;
|
||||
}
|
||||
@@ -1305,11 +1306,13 @@ static void hid_input_field(struct hid_device *hid, struct hid_field *field,
|
||||
}
|
||||
|
||||
if (field->value[n] >= min && field->value[n] <= max
|
||||
+ && field->value[n] - min < field->maxusage
|
||||
&& field->usage[field->value[n] - min].hid
|
||||
&& search(value, field->value[n], count))
|
||||
hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);
|
||||
|
||||
if (value[n] >= min && value[n] <= max
|
||||
+ && value[n] - min < field->maxusage
|
||||
&& field->usage[value[n] - min].hid
|
||||
&& search(field->value, value[n], count))
|
||||
hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);
|
||||
--
|
||||
2.5.5
|
||||
|
||||
@ -1,44 +0,0 @@
|
||||
From 221255aee67ec1c752001080aafec0c4e9390d95 Mon Sep 17 00:00:00 2001
|
||||
From: Hannes Reinecke <hare@suse.de>
|
||||
Date: Tue, 1 Dec 2015 10:16:42 +0100
|
||||
Subject: [PATCH] scsi: ignore errors from scsi_dh_add_device()
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
device handler initialisation might fail due to a number of
|
||||
reasons. But as device_handlers are optional this shouldn't
|
||||
cause us to disable the device entirely.
|
||||
So just ignore errors from scsi_dh_add_device().
|
||||
|
||||
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.com>
|
||||
Reviewed-by: Christoph Hellwig <hch@lst.de>
|
||||
Signed-off-by: Hannes Reinecke <hare@suse.de>
|
||||
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|
||||
---
|
||||
drivers/scsi/scsi_sysfs.c | 7 ++++---
|
||||
1 file changed, 4 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
|
||||
index fc3cd26..d015374 100644
|
||||
--- a/drivers/scsi/scsi_sysfs.c
|
||||
+++ b/drivers/scsi/scsi_sysfs.c
|
||||
@@ -1120,11 +1120,12 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
|
||||
}
|
||||
|
||||
error = scsi_dh_add_device(sdev);
|
||||
- if (error) {
|
||||
+ if (error)
|
||||
+ /*
|
||||
+ * device_handler is optional, so any error can be ignored
|
||||
+ */
|
||||
sdev_printk(KERN_INFO, sdev,
|
||||
"failed to add device handler: %d\n", error);
|
||||
- return error;
|
||||
- }
|
||||
|
||||
device_enable_async_suspend(&sdev->sdev_dev);
|
||||
error = device_add(&sdev->sdev_dev);
|
||||
--
|
||||
2.5.5
|
||||
|
||||
@ -1,71 +0,0 @@
|
||||
From 5266b8e4445cc836c46689d80a9ff539fa3bfbda Mon Sep 17 00:00:00 2001
|
||||
From: Juergen Gross <jgross@suse.com>
|
||||
Date: Thu, 26 Oct 2017 11:50:56 +0200
|
||||
Subject: [PATCH] xen: fix booting ballooned down hvm guest
|
||||
|
||||
Commit 96edd61dcf44362d3ef0bed1a5361e0ac7886a63 ("xen/balloon: don't
|
||||
online new memory initially") introduced a regression when booting a
|
||||
HVM domain with memory less than mem-max: instead of ballooning down
|
||||
immediately the system would try to use the memory up to mem-max
|
||||
resulting in Xen crashing the domain.
|
||||
|
||||
For HVM domains the current size will be reflected in Xenstore node
|
||||
memory/static-max instead of memory/target.
|
||||
|
||||
Additionally we have to trigger the ballooning process at once.
|
||||
|
||||
Cc: <stable@vger.kernel.org> # 4.13
|
||||
Fixes: 96edd61dcf44362d3ef0bed1a5361e0ac7886a63 ("xen/balloon: don't
|
||||
online new memory initially")
|
||||
|
||||
Reported-by: Simon Gaiser <hw42@ipsumj.de>
|
||||
Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
||||
Signed-off-by: Juergen Gross <jgross@suse.com>
|
||||
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
||||
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
||||
---
|
||||
drivers/xen/xen-balloon.c | 19 +++++++++++++------
|
||||
1 file changed, 13 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
|
||||
index e89136ab851e..b437fccd4e62 100644
|
||||
--- a/drivers/xen/xen-balloon.c
|
||||
+++ b/drivers/xen/xen-balloon.c
|
||||
@@ -57,7 +57,7 @@ static int register_balloon(struct device *dev);
|
||||
static void watch_target(struct xenbus_watch *watch,
|
||||
const char *path, const char *token)
|
||||
{
|
||||
- unsigned long long new_target;
|
||||
+ unsigned long long new_target, static_max;
|
||||
int err;
|
||||
static bool watch_fired;
|
||||
static long target_diff;
|
||||
@@ -72,13 +72,20 @@ static void watch_target(struct xenbus_watch *watch,
|
||||
* pages. PAGE_SHIFT converts bytes to pages, hence PAGE_SHIFT - 10.
|
||||
*/
|
||||
new_target >>= PAGE_SHIFT - 10;
|
||||
- if (watch_fired) {
|
||||
- balloon_set_new_target(new_target - target_diff);
|
||||
- return;
|
||||
+
|
||||
+ if (!watch_fired) {
|
||||
+ watch_fired = true;
|
||||
+ err = xenbus_scanf(XBT_NIL, "memory", "static-max", "%llu",
|
||||
+ &static_max);
|
||||
+ if (err != 1)
|
||||
+ static_max = new_target;
|
||||
+ else
|
||||
+ static_max >>= PAGE_SHIFT - 10;
|
||||
+ target_diff = xen_pv_domain() ? 0
|
||||
+ : static_max - balloon_stats.target_pages;
|
||||
}
|
||||
|
||||
- watch_fired = true;
|
||||
- target_diff = new_target - balloon_stats.target_pages;
|
||||
+ balloon_set_new_target(new_target - target_diff);
|
||||
}
|
||||
static struct xenbus_watch target_watch = {
|
||||
.node = "memory/target",
|
||||
--
|
||||
2.15.0.rc2
|
||||
|
||||
Loading…
Reference in new issue