From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-f196.google.com ([209.85.214.196]:44088 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726672AbeJIB4m (ORCPT ); Mon, 8 Oct 2018 21:56:42 -0400 Received: by mail-pl1-f196.google.com with SMTP id p25-v6so10456949pli.11 for ; Mon, 08 Oct 2018 11:43:37 -0700 (PDT) Date: Mon, 8 Oct 2018 11:43:33 -0700 From: Bjorn Andersson To: gregkh@linuxfoundation.org Cc: rafael.j.wysocki@intel.com, rishabhb@codeaurora.org, stable@vger.kernel.org Subject: Re: FAILED: patch "[PATCH] firmware: Always initialize the fw_priv list object" failed to apply to 4.14-stable tree Message-ID: <20181008184333.GD1331@tuxbook-pro> References: <15390206251907@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <15390206251907@kroah.com> Sender: stable-owner@vger.kernel.org List-ID: On Mon 08 Oct 10:43 PDT 2018, gregkh@linuxfoundation.org wrote: > > The patch below does not apply to the 4.14-stable tree. > If someone wants it applied there, or to any other stable or longterm > tree, then please email the backport, including the original git commit > id to . > Hi Greg, If/when you pick 422b3db2a503 ("firmware: Fix security issue with request_firmware_into_buf()") for stable you need this patch as well. Is there any particular way you would like me to annotate the Fixes/Cc tags in the future to make this clear? Regards, Bjorn > thanks, > > greg k-h > > ------------------ original commit in Linus's tree ------------------ > > From 7012040576c6ae25a47035659ee48673612c2c27 Mon Sep 17 00:00:00 2001 > From: Bjorn Andersson > Date: Wed, 19 Sep 2018 18:09:38 -0700 > Subject: [PATCH] firmware: Always initialize the fw_priv list object > > When freeing the fw_priv the item is taken off the list. This causes an > oops in the FW_OPT_NOCACHE case as the list object is not initialized. > > Make sure to initialize the list object regardless of this flag. > > Fixes: 422b3db2a503 ("firmware: Fix security issue with request_firmware_into_buf()") > Cc: stable@vger.kernel.org > Cc: Rishabh Bhatnagar > Signed-off-by: Bjorn Andersson > Reviewed-by: Rafael J. Wysocki > Signed-off-by: Greg Kroah-Hartman > > diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c > index b3c0498ee433..8e9213b36e31 100644 > --- a/drivers/base/firmware_loader/main.c > +++ b/drivers/base/firmware_loader/main.c > @@ -226,8 +226,11 @@ static int alloc_lookup_fw_priv(const char *fw_name, > } > > tmp = __allocate_fw_priv(fw_name, fwc, dbuf, size); > - if (tmp && !(opt_flags & FW_OPT_NOCACHE)) > - list_add(&tmp->list, &fwc->head); > + if (tmp) { > + INIT_LIST_HEAD(&tmp->list); > + if (!(opt_flags & FW_OPT_NOCACHE)) > + list_add(&tmp->list, &fwc->head); > + } > spin_unlock(&fwc->lock); > > *fw_priv = tmp; >