5.4-stable patches

added patches:
	nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch
	wifi-mac80211-fix-qos-on-mesh-interfaces.patch

diff --git a/queue-5.4/nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch b/queue-5.4/nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch
new file mode 100644 (file)
index 0000000..fc8450d
--- /dev/null
+++ b/queue-5.4/nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch
@@ -0,0 +1,86 @@
+From 003587000276f81d0114b5ce773d80c119d8cb30 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Date: Tue, 7 Mar 2023 17:55:48 +0900
+Subject: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+commit 003587000276f81d0114b5ce773d80c119d8cb30 upstream.
+
+The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a
+metadata array to/from user space, may copy uninitialized buffer regions
+to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO
+and NILFS_IOCTL_GET_CPINFO.
+
+This can occur when the element size of the user space metadata given by
+the v_size member of the argument nilfs_argv structure is larger than the
+size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo
+structure) on the file system side.
+
+KMSAN-enabled kernels detect this issue as follows:
+
+ BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
+ include/linux/instrumented.h:121 [inline]
+ BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33
+  instrument_copy_to_user include/linux/instrumented.h:121 [inline]
+  _copy_to_user+0xc0/0x100 lib/usercopy.c:33
+  copy_to_user include/linux/uaccess.h:169 [inline]
+  nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99
+  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
+  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
+  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
+  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]
+  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
+  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
+  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
+  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
+  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
+  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
+  entry_SYSENTER_compat_after_hwframe+0x70/0x82
+
+ Uninit was created at:
+  __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572
+  alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287
+  __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599
+  nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74
+  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]
+  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290
+  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343
+  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]
+  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910
+  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910
+  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
+  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
+  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
+  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
+  entry_SYSENTER_compat_after_hwframe+0x70/0x82
+
+ Bytes 16-127 of 3968 are uninitialized
+ ...
+
+This eliminates the leak issue by initializing the page allocated as
+buffer using get_zeroed_page().
+
+Link: https://lkml.kernel.org/r/20230307085548.6290-1-konishi.ryusuke@gmail.com
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Reported-by: syzbot+132fdd2f1e1805fdc591@syzkaller.appspotmail.com
+  Link: https://lkml.kernel.org/r/000000000000a5bd2d05f63f04ae@google.com
+Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nilfs2/ioctl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nilfs2/ioctl.c
++++ b/fs/nilfs2/ioctl.c
+@@ -70,7 +70,7 @@ static int nilfs_ioctl_wrap_copy(struct
+       if (argv->v_index > ~(__u64)0 - argv->v_nmembs)
+               return -EINVAL;
+ 
+-      buf = (void *)__get_free_pages(GFP_NOFS, 0);
++      buf = (void *)get_zeroed_page(GFP_NOFS);
+       if (unlikely(!buf))
+               return -ENOMEM;
+       maxmembs = PAGE_SIZE / argv->v_size;

diff --git a/queue-5.4/series b/queue-5.4/series
index a8aa065c690636ffc30a5ea90002c179d43df78b..73c683a8b3d17d01c755f9380187b8f3a1cf115d 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -48,3 +48,5 @@ dm-thin-fix-deadlock-when-swapping-to-thin-device.patch
 usb-cdns3-fix-issue-with-using-incorrect-pci-device-function.patch
 usb-chipdea-core-fix-return-einval-if-request-role-is-the-same-with-current-role.patch
 usb-chipidea-core-fix-possible-concurrent-when-switch-role.patch
+wifi-mac80211-fix-qos-on-mesh-interfaces.patch
+nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch

diff --git a/queue-5.4/wifi-mac80211-fix-qos-on-mesh-interfaces.patch b/queue-5.4/wifi-mac80211-fix-qos-on-mesh-interfaces.patch
new file mode 100644 (file)
index 0000000..162793e
--- /dev/null
+++ b/queue-5.4/wifi-mac80211-fix-qos-on-mesh-interfaces.patch
@@ -0,0 +1,43 @@
+From 4e348c6c6e23491ae6eb5e077848a42d0562339c Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 14 Mar 2023 10:59:50 +0100
+Subject: wifi: mac80211: fix qos on mesh interfaces
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 4e348c6c6e23491ae6eb5e077848a42d0562339c upstream.
+
+When ieee80211_select_queue is called for mesh, the sta pointer is usually
+NULL, since the nexthop is looked up much later in the tx path.
+Explicitly check for unicast address in that case in order to make qos work
+again.
+
+Cc: stable@vger.kernel.org
+Fixes: 50e2ab392919 ("wifi: mac80211: fix queue selection for mesh/OCB interfaces")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20230314095956.62085-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/wme.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/mac80211/wme.c
++++ b/net/mac80211/wme.c
+@@ -141,12 +141,14 @@ u16 ieee80211_select_queue_80211(struct
+ u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
+                            struct sta_info *sta, struct sk_buff *skb)
+ {
++      const struct ethhdr *eth = (void *)skb->data;
+       struct mac80211_qos_map *qos_map;
+       bool qos;
+ 
+       /* all mesh/ocb stations are required to support WME */
+-      if (sta && (sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
+-                  sdata->vif.type == NL80211_IFTYPE_OCB))
++      if ((sdata->vif.type == NL80211_IFTYPE_MESH_POINT &&
++          !is_multicast_ether_addr(eth->h_dest)) ||
++          (sdata->vif.type == NL80211_IFTYPE_OCB && sta))
+               qos = true;
+       else if (sta)
+               qos = sta->sta.wme;