4.19-stable patches

added patches:
	bonding-gcc13-synchronize-bond_-a-t-lb_xmit-types.patch
	net-bridge-xmit-make-sure-we-have-at-least-eth-header-len-bytes.patch

diff --git a/queue-4.19/bonding-gcc13-synchronize-bond_-a-t-lb_xmit-types.patch b/queue-4.19/bonding-gcc13-synchronize-bond_-a-t-lb_xmit-types.patch
new file mode 100644 (file)
index 0000000..fa621d9
--- /dev/null
+++ b/queue-4.19/bonding-gcc13-synchronize-bond_-a-t-lb_xmit-types.patch
@@ -0,0 +1,47 @@
+From 777fa87c7682228e155cf0892ba61cb2ab1fe3ae Mon Sep 17 00:00:00 2001
+From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Date: Mon, 31 Oct 2022 12:44:09 +0100
+Subject: bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+commit 777fa87c7682228e155cf0892ba61cb2ab1fe3ae upstream.
+
+Both bond_alb_xmit() and bond_tlb_xmit() produce a valid warning with
+gcc-13:
+  drivers/net/bonding/bond_alb.c:1409:13: error: conflicting types for 'bond_tlb_xmit' due to enum/integer mismatch; have 'netdev_tx_t(struct sk_buff *, struct net_device *)' ...
+  include/net/bond_alb.h:160:5: note: previous declaration of 'bond_tlb_xmit' with type 'int(struct sk_buff *, struct net_device *)'
+
+  drivers/net/bonding/bond_alb.c:1523:13: error: conflicting types for 'bond_alb_xmit' due to enum/integer mismatch; have 'netdev_tx_t(struct sk_buff *, struct net_device *)' ...
+  include/net/bond_alb.h:159:5: note: previous declaration of 'bond_alb_xmit' with type 'int(struct sk_buff *, struct net_device *)'
+
+I.e. the return type of the declaration is int, while the definitions
+spell netdev_tx_t. Synchronize both of them to the latter.
+
+Cc: Martin Liska <mliska@suse.cz>
+Cc: Jay Vosburgh <j.vosburgh@gmail.com>
+Cc: Veaceslav Falico <vfalico@gmail.com>
+Cc: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20221031114409.10417-1-jirislaby@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[iwamatsu: adjust context]
+Signed-off-by: Nobuhiro Iwamatsu (CIP) <nobuhiro1.iwamatsu@toshiba.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/bond_alb.h |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/net/bond_alb.h
++++ b/include/net/bond_alb.h
+@@ -172,8 +172,8 @@ int bond_alb_init_slave(struct bonding *
+ void bond_alb_deinit_slave(struct bonding *bond, struct slave *slave);
+ void bond_alb_handle_link_change(struct bonding *bond, struct slave *slave, char link);
+ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave);
+-int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev);
+-int bond_tlb_xmit(struct sk_buff *skb, struct net_device *bond_dev);
++netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev);
++netdev_tx_t bond_tlb_xmit(struct sk_buff *skb, struct net_device *bond_dev);
+ void bond_alb_monitor(struct work_struct *);
+ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr);
+ void bond_alb_clear_vlan(struct bonding *bond, unsigned short vlan_id);

diff --git a/queue-4.19/net-bridge-xmit-make-sure-we-have-at-least-eth-header-len-bytes.patch b/queue-4.19/net-bridge-xmit-make-sure-we-have-at-least-eth-header-len-bytes.patch
new file mode 100644 (file)
index 0000000..4f82b50
--- /dev/null
+++ b/queue-4.19/net-bridge-xmit-make-sure-we-have-at-least-eth-header-len-bytes.patch
@@ -0,0 +1,78 @@
+From 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc Mon Sep 17 00:00:00 2001
+From: Nikolay Aleksandrov <razor@blackwall.org>
+Date: Mon, 13 May 2024 13:34:19 +0300
+Subject: net: bridge: xmit: make sure we have at least eth header len bytes
+
+From: Nikolay Aleksandrov <razor@blackwall.org>
+
+commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc upstream.
+
+syzbot triggered an uninit value[1] error in bridge device's xmit path
+by sending a short (less than ETH_HLEN bytes) skb. To fix it check if
+we can actually pull that amount instead of assuming.
+
+Tested with dropwatch:
+ drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)
+ origin: software
+ timestamp: Mon May 13 11:31:53 2024 778214037 nsec
+ protocol: 0x88a8
+ length: 2
+ original length: 2
+ drop reason: PKT_TOO_SMALL
+
+[1]
+BUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
+ br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65
+ __netdev_start_xmit include/linux/netdevice.h:4903 [inline]
+ netdev_start_xmit include/linux/netdevice.h:4917 [inline]
+ xmit_one net/core/dev.c:3531 [inline]
+ dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547
+ __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341
+ dev_queue_xmit include/linux/netdevice.h:3091 [inline]
+ __bpf_tx_skb net/core/filter.c:2136 [inline]
+ __bpf_redirect_common net/core/filter.c:2180 [inline]
+ __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187
+ ____bpf_clone_redirect net/core/filter.c:2460 [inline]
+ bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432
+ ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997
+ __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238
+ bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]
+ __bpf_prog_run include/linux/filter.h:657 [inline]
+ bpf_prog_run include/linux/filter.h:664 [inline]
+ bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425
+ bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058
+ bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269
+ __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678
+ __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]
+ __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765
+ x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40
+Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_device.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -41,6 +41,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *
+       const unsigned char *dest;
+       u16 vid = 0;
+ 
++      if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) {
++              kfree_skb(skb);
++              return NETDEV_TX_OK;
++      }
++
+       memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
+ 
+       rcu_read_lock();

diff --git a/queue-4.19/series b/queue-4.19/series
index f1a437aece5eabd99df69b6d1c2eac0c8b43f75a..187c1c672b548a1435b2626bee2d2b8f8f763880 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -24,3 +24,5 @@ dm-cache-fix-potential-out-of-bounds-access-on-the-first-resume.patch
 dm-unstriped-cast-an-operand-to-sector_t-to-prevent-potential-uint32_t-overflow.patch
 nfs-fix-kmsan-warning-in-decode_getfattr_attrs.patch
 btrfs-reinitialize-delayed-ref-list-after-deleting-it-from-the-list.patch
+bonding-gcc13-synchronize-bond_-a-t-lb_xmit-types.patch
+net-bridge-xmit-make-sure-we-have-at-least-eth-header-len-bytes.patch