5.10-stable patches

added patches:
	exfat-avoid-incorrectly-releasing-for-root-inode.patch
	net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch

diff --git a/queue-5.10/exfat-avoid-incorrectly-releasing-for-root-inode.patch b/queue-5.10/exfat-avoid-incorrectly-releasing-for-root-inode.patch
new file mode 100644 (file)
index 0000000..2ca61f0
--- /dev/null
+++ b/queue-5.10/exfat-avoid-incorrectly-releasing-for-root-inode.patch
@@ -0,0 +1,33 @@
+From 839a534f1e853f1aec100d06040c0037b89c2dc3 Mon Sep 17 00:00:00 2001
+From: Chen Li <chenli@uniontech.com>
+Date: Wed, 9 Jun 2021 11:48:55 +0800
+Subject: exfat: avoid incorrectly releasing for root inode
+
+From: Chen Li <chenli@uniontech.com>
+
+commit 839a534f1e853f1aec100d06040c0037b89c2dc3 upstream.
+
+In d_make_root, when we fail to allocate dentry for root inode,
+we will iput root inode and returned value is NULL in this function.
+
+So we do not need to release this inode again at d_make_root's caller.
+
+Signed-off-by: Chen Li <chenli@uniontech.com>
+Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
+Cc: Tadeusz Struk <tadeusz.struk@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/exfat/super.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -690,7 +690,7 @@ static int exfat_fill_super(struct super
+       if (!sb->s_root) {
+               exfat_err(sb, "failed to get the root dentry");
+               err = -ENOMEM;
+-              goto put_inode;
++              goto free_table;
+       }
+ 
+       return 0;

diff --git a/queue-5.10/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch b/queue-5.10/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch
new file mode 100644 (file)
index 0000000..36ada63
--- /dev/null
+++ b/queue-5.10/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch
@@ -0,0 +1,47 @@
+From 5e34af4142ffe68f01c8a9acae83300f8911e20c Mon Sep 17 00:00:00 2001
+From: Tadeusz Struk <tadeusz.struk@linaro.org>
+Date: Thu, 10 Mar 2022 15:25:38 -0800
+Subject: net: ipv6: fix skb_over_panic in __ip6_append_data
+
+From: Tadeusz Struk <tadeusz.struk@linaro.org>
+
+commit 5e34af4142ffe68f01c8a9acae83300f8911e20c upstream.
+
+Syzbot found a kernel bug in the ipv6 stack:
+LINK: https://syzkaller.appspot.com/bug?id=205d6f11d72329ab8d62a610c44c5e7e25415580
+The reproducer triggers it by sending a crafted message via sendmmsg()
+call, which triggers skb_over_panic, and crashes the kernel:
+
+skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575
+head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0
+dev:<NULL>
+
+Update the check that prevents an invalid packet with MTU equal
+to the fregment header size to eat up all the space for payload.
+
+The reproducer can be found here:
+LINK: https://syzkaller.appspot.com/text?tag=ReproC&x=1648c83fb00000
+
+Reported-by: syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com
+Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/r/20220310232538.1044947-1-tadeusz.struk@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_output.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1500,8 +1500,8 @@ static int __ip6_append_data(struct sock
+                     sizeof(struct frag_hdr) : 0) +
+                    rt->rt6i_nfheader_len;
+ 
+-      if (mtu < fragheaderlen ||
+-          ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr))
++      if (mtu <= fragheaderlen ||
++          ((mtu - fragheaderlen) & ~7) + fragheaderlen <= sizeof(struct frag_hdr))
+               goto emsgsize;
+ 
+       maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -

diff --git a/queue-5.10/series b/queue-5.10/series
index 1972e51d92659cd1eaba94730d6cf00f536fe1af..4ddbabe15417593df5eef7d027cc272c1d4cc9da 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -1 +1,3 @@
 nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch
+net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch
+exfat-avoid-incorrectly-releasing-for-root-inode.patch