4.19-stable patches

added patches:
	netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch
	netfilter-nf_tables-reject-constant-set-with-timeout.patch
	xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch

diff --git a/queue-4.19/netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch b/queue-4.19/netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch
new file mode 100644 (file)
index 0000000..43efec3
--- /dev/null
+++ b/queue-4.19/netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch
@@ -0,0 +1,33 @@
+From 16603605b667b70da974bea8216c93e7db043bf1 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 1 Mar 2024 00:11:10 +0100
+Subject: netfilter: nf_tables: disallow anonymous set with timeout flag
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 16603605b667b70da974bea8216c93e7db043bf1 upstream.
+
+Anonymous sets are never used with timeout from userspace, reject this.
+Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.
+
+Cc: stable@vger.kernel.org
+Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support")
+Reported-by: lonial con <kongln9170@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3560,6 +3560,9 @@ static int nf_tables_newset(struct net *
+               if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
+                            (NFT_SET_EVAL | NFT_SET_OBJECT))
+                       return -EOPNOTSUPP;
++              if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) ==
++                           (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT))
++                      return -EOPNOTSUPP;
+       }
+ 
+       dtype = 0;

diff --git a/queue-4.19/netfilter-nf_tables-reject-constant-set-with-timeout.patch b/queue-4.19/netfilter-nf_tables-reject-constant-set-with-timeout.patch
new file mode 100644 (file)
index 0000000..3a0561b
--- /dev/null
+++ b/queue-4.19/netfilter-nf_tables-reject-constant-set-with-timeout.patch
@@ -0,0 +1,34 @@
+From 5f4fc4bd5cddb4770ab120ce44f02695c4505562 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 1 Mar 2024 01:04:11 +0100
+Subject: netfilter: nf_tables: reject constant set with timeout
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+commit 5f4fc4bd5cddb4770ab120ce44f02695c4505562 upstream.
+
+This set combination is weird: it allows for elements to be
+added/deleted, but once bound to the rule it cannot be updated anymore.
+Eventually, all elements expire, leading to an empty set which cannot
+be updated anymore. Reject this flags combination.
+
+Cc: stable@vger.kernel.org
+Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3563,6 +3563,9 @@ static int nf_tables_newset(struct net *
+               if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) ==
+                            (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT))
+                       return -EOPNOTSUPP;
++              if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) ==
++                           (NFT_SET_CONSTANT | NFT_SET_TIMEOUT))
++                      return -EOPNOTSUPP;
+       }
+ 
+       dtype = 0;

diff --git a/queue-4.19/series b/queue-4.19/series
index db01d3bb9792233380e17604775225d42e65836e..88c2a0c2d0426270183c32261a360f769271c35a 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -67,3 +67,6 @@ x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch
 ahci-asm1064-correct-count-of-reported-ports.patch
 ahci-asm1064-asm1166-don-t-limit-reported-ports.patch
 comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch
+netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch
+netfilter-nf_tables-reject-constant-set-with-timeout.patch
+xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch

diff --git a/queue-4.19/xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch b/queue-4.19/xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch
new file mode 100644 (file)
index 0000000..c4fbb1f
--- /dev/null
+++ b/queue-4.19/xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch
@@ -0,0 +1,56 @@
+From 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Wed, 21 Feb 2024 14:46:21 -0700
+Subject: xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e upstream.
+
+After a couple recent changes in LLVM, there is a warning (or error with
+CONFIG_WERROR=y or W=e) from the compile time fortify source routines,
+specifically the memset() in copy_to_user_tmpl().
+
+  In file included from net/xfrm/xfrm_user.c:14:
+  ...
+  include/linux/fortify-string.h:438:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
+    438 |                         __write_overflow_field(p_size_field, size);
+        |                         ^
+  1 error generated.
+
+While ->xfrm_nr has been validated against XFRM_MAX_DEPTH when its value
+is first assigned in copy_templates() by calling validate_tmpl() first
+(so there should not be any issue in practice), LLVM/clang cannot really
+deduce that across the boundaries of these functions. Without that
+knowledge, it cannot assume that the loop stops before i is greater than
+XFRM_MAX_DEPTH, which would indeed result a stack buffer overflow in the
+memset().
+
+To make the bounds of ->xfrm_nr clear to the compiler and add additional
+defense in case copy_to_user_tmpl() is ever used in a path where
+->xfrm_nr has not been properly validated against XFRM_MAX_DEPTH first,
+add an explicit bound check and early return, which clears up the
+warning.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/ClangBuiltLinux/linux/issues/1985
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_user.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1703,6 +1703,9 @@ static int copy_to_user_tmpl(struct xfrm
+       if (xp->xfrm_nr == 0)
+               return 0;
+ 
++      if (xp->xfrm_nr > XFRM_MAX_DEPTH)
++              return -ENOBUFS;
++
+       for (i = 0; i < xp->xfrm_nr; i++) {
+               struct xfrm_user_tmpl *up = &vec[i];
+               struct xfrm_tmpl *kp = &xp->xfrm_vec[i];