lp:~lavanyahm/ubuntu/+source/linux/+git/bionic

Author: Jialiang Wang
Author Date: 2023-01-10 00:29:00 UTC

nfp: fix use-after-free in area_cache_get()

area_cache_get() is used to distribute cache->area and set cache->id,
 and if cache->id is not 0 and cache->area->kref refcount is 0, it will
 release the cache->area by nfp_cpp_area_release(). area_cache_get()
 set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire().

But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is
 is already set but the refcount is not increased as expected. At this
 time, calling the nfp_cpp_area_release() will cause use-after-free.

To avoid the use-after-free, set cache->id after area_init() and
 nfp_cpp_area_acquire() complete successfully.

Note: This vulnerability is triggerable by providing emulated device
 equipped with specified configuration.

 BUG: KASAN: use-after-free in nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760)
  Write of size 4 at addr ffff888005b7f4a0 by task swapper/0/1

 Call Trace:
  <TASK>
 nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760)
 area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:884)

 Allocated by task 1:
 nfp_cpp_area_alloc_with_name (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:303)
 nfp_cpp_area_cache_add (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:802)
 nfp6000_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:1230)
 nfp_cpp_from_operations (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:1215)
 nfp_pci_probe (drivers/net/ethernet/netronome/nfp/nfp_main.c:744)

 Freed by task 1:
 kfree (mm/slub.c:4562)
 area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:873)
 nfp_cpp_read (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:924 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:973)
 nfp_cpp_readl (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cpplib.c:48)

Signed-off-by: Jialiang Wang <wangjialiang0806@163.com>
Reviewed-by: Yinjun Zhang <yinjun.zhang@corigine.com>
Acked-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20220810073057.4032-1-wangjialiang0806@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

CVE-2022-3545
(cherry picked from commit 02e1a114fdb71e59ee6770294166c30d437bf86a)
Signed-off-by: Yuxuan Luo <yuxuan.luo@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Author: Stefan Bader
Author Date: 2023-01-20 15:01:55 UTC

UBUNTU: Ubuntu-4.15.0-204.215

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Author: Kleber Sacilotto de Souza
Author Date: 2023-01-13 12:20:21 UTC

UBUNTU: Ubuntu-hwe-5.4-5.4.0-138.155~18.04.1

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Stefan Bader
Author Date: 2022-11-30 15:35:25 UTC

UBUNTU: Ubuntu-hwe-5.4-5.4.0-136.153~18.04.1

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Author: Luke Nowakowski-Krijger
Author Date: 2022-10-27 20:56:02 UTC

UBUNTU: Ubuntu-4.15.0-196.207

Signed-off-by: Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>

Author: Thadeu Lima de Souza Cascardo
Author Date: 2021-07-15 09:36:31 UTC

UBUNTU: Ubuntu-hwe-5.3.0-76.72

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Author: Stefan Bader
Author Date: 2021-04-16 08:22:31 UTC

UBUNTU: Ubuntu-hwe-5.3.0-74.70

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Author: Thadeu Lima de Souza Cascardo
Author Date: 2021-02-01 22:04:45 UTC

UBUNTU: Ubuntu-hwe-5.0-5.0.0-65.71

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Author: Kleber Sacilotto de Souza
Author Date: 2019-11-26 11:41:15 UTC

UBUNTU: Ubuntu-hwe-edge-5.3.0-24.26~18.04.2

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Khaled El Mously
Author Date: 2019-10-01 03:02:24 UTC

UBUNTU: Ubuntu-4.15.0-66.75

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Kai-Heng Feng
Author Date: 2018-11-26 07:15:57 UTC

HID: multitouch: Add pointstick support for Cirque Touchpad

BugLink: https://bugs.launchpad.net/bugs/1805081

Cirque Touchpad/Pointstick combo is similar to Alps devices, it requires
MT_CLS_WIN_8_DUAL to expose its pointstick as a mouse.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
(cherry picked from commit 12d43aacf9a74d0eb66fd0ea54ebeb79ca28940f)
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Acked-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>