[PATCH] [SRU] [T] Fix for CVE-2017-16526

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

[PATCH] [SRU] [T] Fix for CVE-2017-16526

Paolo Pisati-5
https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16526.html

Clean cherry pick.

Andrey Konovalov (1):
  uwb: properly check kthread_run return value

 drivers/uwb/uwbd.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--
2.7.4


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

[PATCH] uwb: properly check kthread_run return value

Paolo Pisati-5
From: Andrey Konovalov <[hidden email]>

uwbd_start() calls kthread_run() and checks that the return value is
not NULL. But the return value is not NULL in case kthread_run() fails,
it takes the form of ERR_PTR(-EINTR).

Use IS_ERR() instead.

Also add a check to uwbd_stop().

Signed-off-by: Andrey Konovalov <[hidden email]>
Cc: stable <[hidden email]>
Signed-off-by: Greg Kroah-Hartman <[hidden email]>
(cherry picked from commit bbf26183b7a6236ba602f4d6a2f7cade35bba043)
Signed-off-by: Paolo Pisati <[hidden email]>
---
 drivers/uwb/uwbd.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
index bdcb13c..5c98283 100644
--- a/drivers/uwb/uwbd.c
+++ b/drivers/uwb/uwbd.c
@@ -303,18 +303,22 @@ static int uwbd(void *param)
 /** Start the UWB daemon */
 void uwbd_start(struct uwb_rc *rc)
 {
- rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
- if (rc->uwbd.task == NULL)
+ struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
+ if (IS_ERR(task)) {
+ rc->uwbd.task = NULL;
  printk(KERN_ERR "UWB: Cannot start management daemon; "
        "UWB won't work\n");
- else
+ } else {
+ rc->uwbd.task = task;
  rc->uwbd.pid = rc->uwbd.task->pid;
+ }
 }
 
 /* Stop the UWB daemon and free any unprocessed events */
 void uwbd_stop(struct uwb_rc *rc)
 {
- kthread_stop(rc->uwbd.task);
+ if (rc->uwbd.task)
+ kthread_stop(rc->uwbd.task);
  uwbd_flush(rc);
 }
 
--
2.7.4


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team
Reply | Threaded
Open this post in threaded view
|

ACK: [PATCH] uwb: properly check kthread_run return value

Stefan Bader-2
On 10.07.2018 13:49, Paolo Pisati wrote:

> From: Andrey Konovalov <[hidden email]>
>
> uwbd_start() calls kthread_run() and checks that the return value is
> not NULL. But the return value is not NULL in case kthread_run() fails,
> it takes the form of ERR_PTR(-EINTR).
>
> Use IS_ERR() instead.
>
> Also add a check to uwbd_stop().
>
> Signed-off-by: Andrey Konovalov <[hidden email]>
> Cc: stable <[hidden email]>
> Signed-off-by: Greg Kroah-Hartman <[hidden email]>
> (cherry picked from commit bbf26183b7a6236ba602f4d6a2f7cade35bba043)
> Signed-off-by: Paolo Pisati <[hidden email]>
Acked-by: Stefan Bader <[hidden email]>

> ---
>  drivers/uwb/uwbd.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
> index bdcb13c..5c98283 100644
> --- a/drivers/uwb/uwbd.c
> +++ b/drivers/uwb/uwbd.c
> @@ -303,18 +303,22 @@ static int uwbd(void *param)
>  /** Start the UWB daemon */
>  void uwbd_start(struct uwb_rc *rc)
>  {
> - rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
> - if (rc->uwbd.task == NULL)
> + struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
> + if (IS_ERR(task)) {
> + rc->uwbd.task = NULL;
>   printk(KERN_ERR "UWB: Cannot start management daemon; "
>         "UWB won't work\n");
> - else
> + } else {
> + rc->uwbd.task = task;
>   rc->uwbd.pid = rc->uwbd.task->pid;
> + }
>  }
>  
>  /* Stop the UWB daemon and free any unprocessed events */
>  void uwbd_stop(struct uwb_rc *rc)
>  {
> - kthread_stop(rc->uwbd.task);
> + if (rc->uwbd.task)
> + kthread_stop(rc->uwbd.task);
>   uwbd_flush(rc);
>  }
>  
>


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team

signature.asc (836 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

ACK/APPLIED/cmnt: [PATCH] uwb: properly check kthread_run return value

Juerg Haefliger
In reply to this post by Paolo Pisati-5
On 07/10/2018 01:49 PM, Paolo Pisati wrote:
> From: Andrey Konovalov <[hidden email]>

Added missing CVE line.


> uwbd_start() calls kthread_run() and checks that the return value is
> not NULL. But the return value is not NULL in case kthread_run() fails,
> it takes the form of ERR_PTR(-EINTR).
>
> Use IS_ERR() instead.
>
> Also add a check to uwbd_stop().
>
> Signed-off-by: Andrey Konovalov <[hidden email]>
> Cc: stable <[hidden email]>
> Signed-off-by: Greg Kroah-Hartman <[hidden email]>
> (cherry picked from commit bbf26183b7a6236ba602f4d6a2f7cade35bba043)
> Signed-off-by: Paolo Pisati <[hidden email]>
Signed-off-by: Juerg Haefliger <[hidden email]>

Applied to trusty master-next.

...Juerg


> ---
>  drivers/uwb/uwbd.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c
> index bdcb13c..5c98283 100644
> --- a/drivers/uwb/uwbd.c
> +++ b/drivers/uwb/uwbd.c
> @@ -303,18 +303,22 @@ static int uwbd(void *param)
>  /** Start the UWB daemon */
>  void uwbd_start(struct uwb_rc *rc)
>  {
> - rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
> - if (rc->uwbd.task == NULL)
> + struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
> + if (IS_ERR(task)) {
> + rc->uwbd.task = NULL;
>   printk(KERN_ERR "UWB: Cannot start management daemon; "
>         "UWB won't work\n");
> - else
> + } else {
> + rc->uwbd.task = task;
>   rc->uwbd.pid = rc->uwbd.task->pid;
> + }
>  }
>  
>  /* Stop the UWB daemon and free any unprocessed events */
>  void uwbd_stop(struct uwb_rc *rc)
>  {
> - kthread_stop(rc->uwbd.task);
> + if (rc->uwbd.task)
> + kthread_stop(rc->uwbd.task);
>   uwbd_flush(rc);
>  }
>  
>


--
kernel-team mailing list
[hidden email]
https://lists.ubuntu.com/mailman/listinfo/kernel-team

signature.asc (849 bytes) Download Attachment