lp:~ubuntu-kernel/ubuntu/+source/linux/+git/impish

Author: Willy Tarreau
Author Date: 2022-06-24 20:34:46 UTC

floppy: use a statically allocated error counter

Interrupt handler bad_flp_intr() may cause a UAF on the recently freed
request just to increment the error count. There's no point keeping
that one in the request anyway, and since the interrupt handler uses a
static pointer to the error which cannot be kept in sync with the
pending request, better make it use a static error counter that's reset
for each new request. This reset now happens when entering
redo_fd_request() for a new request via set_next_request().

One initial concern about a single error counter was that errors on one
floppy drive could be reported on another one, but this problem is not
real given that the driver uses a single drive at a time, as that
PC-compatible controllers also have this limitation by using shared
signals. As such the error count is always for the "current" drive.

Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Tested-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8)
CVE-2022-1652
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Zachary Tahenakos <zachary.tahenakos@canonical.com>
Acked-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Luke Nowakowski-Krijger <luke.nowakowskikrijger@canonical.com>

Author: Thadeu Lima de Souza Cascardo
Author Date: 2022-06-01 19:14:14 UTC

UBUNTU: Ubuntu-5.13.0-48.54

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Author: Kleber Sacilotto de Souza
Author Date: 2022-05-20 14:32:29 UTC

UBUNTU: Ubuntu-5.13.0-45.50

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>