5.10-stable patches

added patches:
	bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch
	netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch

diff --git a/queue-5.10/bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch b/queue-5.10/bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch
new file mode 100644 (file)
index 0000000..12847fc
--- /dev/null
+++ b/queue-5.10/bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch
@@ -0,0 +1,42 @@
+From eff9704f5332a13b08fbdbe0f84059c9e7051d5f Mon Sep 17 00:00:00 2001
+From: Krishna chaitanya chundru <quic_krichai@quicinc.com>
+Date: Tue, 31 Oct 2023 15:21:05 +0530
+Subject: bus: mhi: host: Add alignment check for event ring read pointer
+
+From: Krishna chaitanya chundru <quic_krichai@quicinc.com>
+
+commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f upstream.
+
+Though we do check the event ring read pointer by "is_valid_ring_ptr"
+to make sure it is in the buffer range, but there is another risk the
+pointer may be not aligned.  Since we are expecting event ring elements
+are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer
+could lead to multiple issues like DoS or ring buffer memory corruption.
+
+So add a alignment check for event ring read pointer.
+
+Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use")
+cc: stable@vger.kernel.org
+Signed-off-by: Krishna chaitanya chundru <quic_krichai@quicinc.com>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicinc.com
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/host/main.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/bus/mhi/host/main.c
++++ b/drivers/bus/mhi/host/main.c
+@@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct
+ 
+ static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr)
+ {
+-      return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len;
++      return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len &&
++                      !(addr & (sizeof(struct mhi_tre) - 1));
+ }
+ 
+ int mhi_destroy_device(struct device *dev, void *data)

diff --git a/queue-5.10/netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch b/queue-5.10/netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch
new file mode 100644 (file)
index 0000000..61b45ae
--- /dev/null
+++ b/queue-5.10/netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch
@@ -0,0 +1,80 @@
+From a84b6fedbc97078788be78dbdd7517d143ad1a77 Mon Sep 17 00:00:00 2001
+From: Xiang Mei <xmei5@asu.edu>
+Date: Tue, 9 Jun 2026 15:55:02 -0700
+Subject: netfilter: nf_log: validate MAC header was set before dumping it
+
+From: Xiang Mei <xmei5@asu.edu>
+
+commit a84b6fedbc97078788be78dbdd7517d143ad1a77 upstream.
+
+The fallback path of dump_mac_header() guards the MAC header access
+only with "skb->mac_header != skb->network_header", without checking
+skb_mac_header_was_set(). When the MAC header is unset, mac_header is
+0xffff, so the test passes and skb_mac_header(skb) returns
+skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads
+dev->hard_header_len bytes out of bounds into the kernel log.
+
+This is reachable via the netdev logger: nf_log_unknown_packet() calls
+dump_mac_header() unconditionally, and an skb sent through AF_PACKET
+with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still
+unset (__dev_queue_xmit(), which would reset it, is bypassed).
+
+Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already
+uses, and replace the open-coded MAC header length test with
+skb_mac_header_len(). Only skbs with an unset MAC header are affected;
+valid ones are dumped as before.
+
+ BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831)
+ Read of size 1 at addr ffff88800ea49d3f by task exploit/148
+ Call Trace:
+  kasan_report (mm/kasan/report.c:595)
+  dump_mac_header (net/netfilter/nf_log_syslog.c:831)
+  nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963)
+  nf_log_packet (net/netfilter/nf_log.c:260)
+  nft_log_eval (net/netfilter/nft_log.c:60)
+  nft_do_chain (net/netfilter/nf_tables_core.c:285)
+  nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307)
+  nf_hook_slow (net/netfilter/core.c:619)
+  nf_hook_direct_egress (net/packet/af_packet.c:257)
+  packet_xmit (net/packet/af_packet.c:280)
+  packet_sendmsg (net/packet/af_packet.c:3114)
+  __sys_sendto (net/socket.c:2265)
+
+Fixes: 7eb9282cd0ef ("netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header")
+Reported-by: Weiming Shi <bestswngs@gmail.com>
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/netfilter/nf_log_ipv4.c |    4 ++--
+ net/ipv6/netfilter/nf_log_ipv6.c |    4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/ipv4/netfilter/nf_log_ipv4.c
++++ b/net/ipv4/netfilter/nf_log_ipv4.c
+@@ -296,8 +296,8 @@ static void dump_ipv4_mac_header(struct
+ 
+ fallback:
+       nf_log_buf_add(m, "MAC=");
+-      if (dev->hard_header_len &&
+-          skb->mac_header != skb->network_header) {
++      if (dev->hard_header_len && skb_mac_header_was_set(skb) &&
++          skb_mac_header_len(skb) != 0) {
+               const unsigned char *p = skb_mac_header(skb);
+               unsigned int i;
+ 
+--- a/net/ipv6/netfilter/nf_log_ipv6.c
++++ b/net/ipv6/netfilter/nf_log_ipv6.c
+@@ -309,8 +309,8 @@ static void dump_ipv6_mac_header(struct
+ 
+ fallback:
+       nf_log_buf_add(m, "MAC=");
+-      if (dev->hard_header_len &&
+-          skb->mac_header != skb->network_header) {
++      if (dev->hard_header_len && skb_mac_header_was_set(skb) &&
++          skb_mac_header_len(skb) != 0) {
+               const unsigned char *p = skb_mac_header(skb);
+               unsigned int len = dev->hard_header_len;
+               unsigned int i;

diff --git a/queue-5.10/series b/queue-5.10/series
index 536e445eb7f03e6a625d316439ac7477daa6f4cf..7fcf346a6caeb444ceac34dc54ac602656d4a284 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -8,3 +8,5 @@ nfsd-change-nfs4_client_to_reclaim-to-allocate-data.patch
 mmc-renesas_sdhi-add-quirk-entry-for-rz-g2h-soc.patch
 kvm-replace-guest-triggerable-bug_on-in-ioeventfd-da.patch
 perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch
+bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch
+netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch