5.15-stable patches

added patches:
	arp-prevent-overflow-in-arp_req_get.patch
	netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch

diff --git a/queue-5.15/arp-prevent-overflow-in-arp_req_get.patch b/queue-5.15/arp-prevent-overflow-in-arp_req_get.patch
new file mode 100644 (file)
index 0000000..6489e63
--- /dev/null
+++ b/queue-5.15/arp-prevent-overflow-in-arp_req_get.patch
@@ -0,0 +1,96 @@
+From a7d6027790acea24446ddd6632d394096c0f4667 Mon Sep 17 00:00:00 2001
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+Date: Thu, 15 Feb 2024 15:05:16 -0800
+Subject: arp: Prevent overflow in arp_req_get().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+commit a7d6027790acea24446ddd6632d394096c0f4667 upstream.
+
+syzkaller reported an overflown write in arp_req_get(). [0]
+
+When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour
+entry and copies neigh->ha to struct arpreq.arp_ha.sa_data.
+
+The arp_ha here is struct sockaddr, not struct sockaddr_storage, so
+the sa_data buffer is just 14 bytes.
+
+In the splat below, 2 bytes are overflown to the next int field,
+arp_flags.  We initialise the field just after the memcpy(), so it's
+not a problem.
+
+However, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN),
+arp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)
+in arp_ioctl() before calling arp_req_get().
+
+To avoid the overflow, let's limit the max length of memcpy().
+
+Note that commit b5f0de6df6dc ("net: dev: Convert sa_data to flexible
+array in struct sockaddr") just silenced syzkaller.
+
+[0]:
+memcpy: detected field-spanning write (size 16) of single field "r->arp_ha.sa_data" at net/ipv4/arp.c:1128 (size 14)
+WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
+Modules linked in:
+CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014
+RIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128
+Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6
+RSP: 0018:ffffc900050b7998 EFLAGS: 00010286
+RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001
+RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000
+R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010
+FS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261
+ inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981
+ sock_do_ioctl+0xdf/0x260 net/socket.c:1204
+ sock_ioctl+0x3ef/0x650 net/socket.c:1321
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:870 [inline]
+ __se_sys_ioctl fs/ioctl.c:856 [inline]
+ __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81
+ entry_SYSCALL_64_after_hwframe+0x64/0xce
+RIP: 0033:0x7f172b262b8d
+Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d
+RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003
+RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000
+ </TASK>
+
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Reported-by: Bjoern Doebel <doebel@amazon.de>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://lore.kernel.org/r/20240215230516.31330-1-kuniyu@amazon.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/arp.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -1104,7 +1104,8 @@ static int arp_req_get(struct arpreq *r,
+       if (neigh) {
+               if (!(neigh->nud_state & NUD_NOARP)) {
+                       read_lock_bh(&neigh->lock);
+-                      memcpy(r->arp_ha.sa_data, neigh->ha, dev->addr_len);
++                      memcpy(r->arp_ha.sa_data, neigh->ha,
++                             min(dev->addr_len, (unsigned char)sizeof(r->arp_ha.sa_data_min)));
+                       r->arp_flags = arp_state_to_flags(neigh);
+                       read_unlock_bh(&neigh->lock);
+                       r->arp_ha.sa_family = dev->type;

diff --git a/queue-5.15/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch b/queue-5.15/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
new file mode 100644 (file)
index 0000000..03e9a1c
--- /dev/null
+++ b/queue-5.15/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
@@ -0,0 +1,36 @@
+From 2024439bd5ceb145eeeb428b2a59e9b905153ac3 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Thu, 11 Aug 2022 13:30:39 +0200
+Subject: netfilter: nf_tables: fix scheduling-while-atomic splat
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 2024439bd5ceb145eeeb428b2a59e9b905153ac3 upstream.
+
+nf_tables_check_loops() can be called from rhashtable list
+walk so cond_resched() cannot be used here.
+
+Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c |    4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -10044,13 +10044,9 @@ static int nf_tables_check_loops(const s
+                               break;
+                       }
+               }
+-
+-              cond_resched();
+       }
+ 
+       list_for_each_entry(set, &ctx->table->sets, list) {
+-              cond_resched();
+-
+               if (!nft_is_active_next(ctx->net, set))
+                       continue;
+               if (!(set->flags & NFT_SET_MAP) ||

diff --git a/queue-5.15/series b/queue-5.15/series
index 84686f6ea47a2fd215ca980f6518f61dae8670c5..0c64a03bcb83392c519539a31ed277e432aed711 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -238,3 +238,5 @@ i2c-imx-add-timer-for-handling-the-stop-condition.patch
 i2c-imx-when-being-a-target-mark-the-last-read-as-pr.patch
 cifs-fix-mid-leak-during-reconnection-after-timeout-threshold.patch
 fs-aio-restrict-kiocb_set_cancel_fn-to-i-o-submitted-via-libaio.patch
+arp-prevent-overflow-in-arp_req_get.patch
+netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch