5.15-stable patches

added patches:
	net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch
	nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch

diff --git a/queue-5.15/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch b/queue-5.15/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch
new file mode 100644 (file)
index 0000000..8118560
--- /dev/null
+++ b/queue-5.15/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch
@@ -0,0 +1,47 @@
+From 5e34af4142ffe68f01c8a9acae83300f8911e20c Mon Sep 17 00:00:00 2001
+From: Tadeusz Struk <tadeusz.struk@linaro.org>
+Date: Thu, 10 Mar 2022 15:25:38 -0800
+Subject: net: ipv6: fix skb_over_panic in __ip6_append_data
+
+From: Tadeusz Struk <tadeusz.struk@linaro.org>
+
+commit 5e34af4142ffe68f01c8a9acae83300f8911e20c upstream.
+
+Syzbot found a kernel bug in the ipv6 stack:
+LINK: https://syzkaller.appspot.com/bug?id=205d6f11d72329ab8d62a610c44c5e7e25415580
+The reproducer triggers it by sending a crafted message via sendmmsg()
+call, which triggers skb_over_panic, and crashes the kernel:
+
+skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575
+head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0
+dev:<NULL>
+
+Update the check that prevents an invalid packet with MTU equal
+to the fregment header size to eat up all the space for payload.
+
+The reproducer can be found here:
+LINK: https://syzkaller.appspot.com/text?tag=ReproC&x=1648c83fb00000
+
+Reported-by: syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com
+Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/20220310232538.1044947-1-tadeusz.struk@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_output.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1476,8 +1476,8 @@ static int __ip6_append_data(struct sock
+                     sizeof(struct frag_hdr) : 0) +
+                    rt->rt6i_nfheader_len;
+ 
+-      if (mtu < fragheaderlen ||
+-          ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr))
++      if (mtu <= fragheaderlen ||
++          ((mtu - fragheaderlen) & ~7) + fragheaderlen <= sizeof(struct frag_hdr))
+               goto emsgsize;
+ 
+       maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -

diff --git a/queue-5.15/nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch b/queue-5.15/nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch
new file mode 100644 (file)
index 0000000..0eb7dfc
--- /dev/null
+++ b/queue-5.15/nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch
@@ -0,0 +1,48 @@
+From 4fbcc1a4cb20fe26ad0225679c536c80f1648221 Mon Sep 17 00:00:00 2001
+From: Jordy Zomer <jordy@pwning.systems>
+Date: Tue, 11 Jan 2022 17:44:51 +0100
+Subject: nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
+
+From: Jordy Zomer <jordy@pwning.systems>
+
+commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 upstream.
+
+It appears that there are some buffer overflows in EVT_TRANSACTION.
+This happens because the length parameters that are passed to memcpy
+come directly from skb->data and are not guarded in any way.
+
+Signed-off-by: Jordy Zomer <jordy@pwning.systems>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Denis Efremov <denis.e.efremov@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nfc/st21nfca/se.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/nfc/st21nfca/se.c
++++ b/drivers/nfc/st21nfca/se.c
+@@ -320,6 +320,11 @@ int st21nfca_connectivity_event_received
+                       return -ENOMEM;
+ 
+               transaction->aid_len = skb->data[1];
++
++              /* Checking if the length of the AID is valid */
++              if (transaction->aid_len > sizeof(transaction->aid))
++                      return -EINVAL;
++
+               memcpy(transaction->aid, &skb->data[2],
+                      transaction->aid_len);
+ 
+@@ -329,6 +334,11 @@ int st21nfca_connectivity_event_received
+                       return -EPROTO;
+ 
+               transaction->params_len = skb->data[transaction->aid_len + 3];
++
++              /* Total size is allocated (skb->len - 2) minus fixed array members */
++              if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))
++                      return -EINVAL;
++
+               memcpy(transaction->params, skb->data +
+                      transaction->aid_len + 4, transaction->params_len);
+ 

diff --git a/queue-5.15/series b/queue-5.15/series
new file mode 100644 (file)
index 0000000..4d0b0d0
--- /dev/null
+++ b/queue-5.15/series
@@ -0,0 +1,2 @@
+nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch
+net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch