4.19-stable patches

added patches:
	ipv6-ensure-sane-device-mtu-in-tunnels.patch

diff --git a/queue-4.19/ipv6-ensure-sane-device-mtu-in-tunnels.patch b/queue-4.19/ipv6-ensure-sane-device-mtu-in-tunnels.patch
new file mode 100644 (file)
index 0000000..ea61dbd
--- /dev/null
+++ b/queue-4.19/ipv6-ensure-sane-device-mtu-in-tunnels.patch
@@ -0,0 +1,151 @@
+From d89d7ff01235f218dad37de84457717f699dee79 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sun, 23 Oct 2022 19:01:24 -0700
+Subject: ipv6: ensure sane device mtu in tunnels
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit d89d7ff01235f218dad37de84457717f699dee79 upstream.
+
+Another syzbot report [1] with no reproducer hints
+at a bug in ip6_gre tunnel (dev:ip6gretap0)
+
+Since ipv6 mcast code makes sure to read dev->mtu once
+and applies a sanity check on it (see commit b9b312a7a451
+"ipv6: mcast: better catch silly mtu values"), a remaining
+possibility is that a layer is able to set dev->mtu to
+an underflowed value (high order bit set).
+
+This could happen indeed in ip6gre_tnl_link_config_route(),
+ip6_tnl_link_config() and ipip6_tunnel_bind_dev()
+
+Make sure to sanitize mtu value in a local variable before
+it is written once on dev->mtu, as lockless readers could
+catch wrong temporary value.
+
+[1]
+skbuff: skb_over_panic: text:ffff80000b7a2f38 len:40 put:40 head:ffff000149dcf200 data:ffff000149dcf2b0 tail:0xd8 end:0xc0 dev:ip6gretap0
+------------[ cut here ]------------
+kernel BUG at net/core/skbuff.c:120
+Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 1 PID: 10241 Comm: kworker/1:1 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
+Workqueue: mld mld_ifc_work
+pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : skb_panic+0x4c/0x50 net/core/skbuff.c:116
+lr : skb_panic+0x4c/0x50 net/core/skbuff.c:116
+sp : ffff800020dd3b60
+x29: ffff800020dd3b70 x28: 0000000000000000 x27: ffff00010df2a800
+x26: 00000000000000c0 x25: 00000000000000b0 x24: ffff000149dcf200
+x23: 00000000000000c0 x22: 00000000000000d8 x21: ffff80000b7a2f38
+x20: ffff00014c2f7800 x19: 0000000000000028 x18: 00000000000001a9
+x17: 0000000000000000 x16: ffff80000db49158 x15: ffff000113bf1a80
+x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000113bf1a80
+x11: ff808000081c0d5c x10: 0000000000000000 x9 : 73f125dc5c63ba00
+x8 : 73f125dc5c63ba00 x7 : ffff800008161d1c x6 : 0000000000000000
+x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
+x2 : ffff0001fefddcd0 x1 : 0000000100000000 x0 : 0000000000000089
+Call trace:
+skb_panic+0x4c/0x50 net/core/skbuff.c:116
+skb_over_panic net/core/skbuff.c:125 [inline]
+skb_put+0xd4/0xdc net/core/skbuff.c:2049
+ip6_mc_hdr net/ipv6/mcast.c:1714 [inline]
+mld_newpack+0x14c/0x270 net/ipv6/mcast.c:1765
+add_grhead net/ipv6/mcast.c:1851 [inline]
+add_grec+0xa20/0xae0 net/ipv6/mcast.c:1989
+mld_send_cr+0x438/0x5a8 net/ipv6/mcast.c:2115
+mld_ifc_work+0x38/0x290 net/ipv6/mcast.c:2653
+process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
+worker_thread+0x340/0x610 kernel/workqueue.c:2436
+kthread+0x12c/0x158 kernel/kthread.c:376
+ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
+Code: 91011400 aa0803e1 a90027ea 94373093 (d4210000)
+
+Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/20221024020124.3756833-1-eric.dumazet@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ta: Backport patch for stable kernels < 5.10.y. Fix conflict in
+net/ipv6/ip6_tunnel.c, mtu initialized with:
+mtu = rt->dst.dev->mtu - t_hlen;]
+Cc: <stable@vger.kernel.org> # 4.14.y, 4.19.y, 5.4.y
+Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_gre.c    |   12 +++++++-----
+ net/ipv6/ip6_tunnel.c |   10 ++++++----
+ net/ipv6/sit.c        |    8 +++++---
+ 3 files changed, 18 insertions(+), 12 deletions(-)
+
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1154,14 +1154,16 @@ static void ip6gre_tnl_link_config_route
+                               dev->needed_headroom = dst_len;
+ 
+                       if (set_mtu) {
+-                              dev->mtu = rt->dst.dev->mtu - t_hlen;
++                              int mtu = rt->dst.dev->mtu - t_hlen;
++
+                               if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+-                                      dev->mtu -= 8;
++                                      mtu -= 8;
+                               if (dev->type == ARPHRD_ETHER)
+-                                      dev->mtu -= ETH_HLEN;
++                                      mtu -= ETH_HLEN;
+ 
+-                              if (dev->mtu < IPV6_MIN_MTU)
+-                                      dev->mtu = IPV6_MIN_MTU;
++                              if (mtu < IPV6_MIN_MTU)
++                                      mtu = IPV6_MIN_MTU;
++                              WRITE_ONCE(dev->mtu, mtu);
+                       }
+               }
+               ip6_rt_put(rt);
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1435,6 +1435,7 @@ static void ip6_tnl_link_config(struct i
+       struct __ip6_tnl_parm *p = &t->parms;
+       struct flowi6 *fl6 = &t->fl.u.ip6;
+       int t_hlen;
++      int mtu;
+ 
+       memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
+       memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
+@@ -1477,12 +1478,13 @@ static void ip6_tnl_link_config(struct i
+                       dev->hard_header_len = rt->dst.dev->hard_header_len +
+                               t_hlen;
+ 
+-                      dev->mtu = rt->dst.dev->mtu - t_hlen;
++                      mtu = rt->dst.dev->mtu - t_hlen;
+                       if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+-                              dev->mtu -= 8;
++                              mtu -= 8;
+ 
+-                      if (dev->mtu < IPV6_MIN_MTU)
+-                              dev->mtu = IPV6_MIN_MTU;
++                      if (mtu < IPV6_MIN_MTU)
++                              mtu = IPV6_MIN_MTU;
++                      WRITE_ONCE(dev->mtu, mtu);
+               }
+               ip6_rt_put(rt);
+       }
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1082,10 +1082,12 @@ static void ipip6_tunnel_bind_dev(struct
+ 
+       if (tdev && !netif_is_l3_master(tdev)) {
+               int t_hlen = tunnel->hlen + sizeof(struct iphdr);
++              int mtu;
+ 
+-              dev->mtu = tdev->mtu - t_hlen;
+-              if (dev->mtu < IPV6_MIN_MTU)
+-                      dev->mtu = IPV6_MIN_MTU;
++              mtu = tdev->mtu - t_hlen;
++              if (mtu < IPV6_MIN_MTU)
++                      mtu = IPV6_MIN_MTU;
++              WRITE_ONCE(dev->mtu, mtu);
+       }
+ }
+ 

diff --git a/queue-4.19/series b/queue-4.19/series
index ae69928ad8137b48c2bc7bcc53dc79718bb061de..0b8bd6dfa3f0d1b7e0cbeb2b33ad24c6f71a5a25 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -81,3 +81,4 @@ panic-introduce-warn_limit.patch
 panic-expose-warn_count-to-sysfs.patch
 docs-fix-path-paste-o-for-sys-kernel-warn_count.patch
 exit-use-read_once-for-all-oops-warn-limit-reads.patch
+ipv6-ensure-sane-device-mtu-in-tunnels.patch