lp:~ubuntu-kernel/ubuntu/+source/linux/+git/artful

Author: Dan Carpenter
Author Date: 2018-07-09 21:39:01 UTC

cdrom: information leak in cdrom_ioctl_media_changed()

CVE-2018-10940

This cast is wrong. "cdi->capacity" is an int and "arg" is an unsigned
long. The way the check is written now, if one of the high 32 bits is
set then we could read outside the info->slots[] array.

This bug is pretty old and it predates git.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry-picked from commit 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707)
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2018-07-13 04:25:23 UTC

UBUNTU: Ubuntu-snapdragon-4.4.0-1096.101

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2018-06-12 05:09:25 UTC

UBUNTU: Ubuntu-raspi2-4.13.0-1023.24

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Stefan Bader
Author Date: 2018-05-30 07:50:09 UTC

UBUNTU: Ubuntu-4.13.0-45.50

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

Author: Alexander Duyck
Author Date: 2018-03-09 08:12:00 UTC

i40e: Add programming descriptors to cleaned_count

BugLink: http://bugs.launchpad.net/bugs/1748408

This patch updates the i40e driver to include programming descriptors in
the cleaned_count. Without this change it becomes possible for us to leak
memory as we don't trigger a large enough allocation when the time comes to
allocate new buffers and we end up overwriting a number of rx_buffers equal
to the number of programming descriptors we encountered.

Fixes: 0e626ff7ccbf ("i40e: Fix support for flow director programming status")
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Tested-by: Anders K. Pedersen <akp@cohaesio.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
(cherry picked from commit 62b4c6694dfd3821bd5ea5bed48238bbabd5fe8b)
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

Author: Marcelo Cerri
Author Date: 2018-01-19 12:16:44 UTC

UBUNTU: Ubuntu-4.13.0-31.34

Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>