4.19-stable patches

added patches:
	dm-crypt-don-t-modify-the-data-when-using-authenticated-encryption.patch
	gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_genl_dump_pdp.patch

diff --git a/queue-4.19/dm-crypt-don-t-modify-the-data-when-using-authenticated-encryption.patch b/queue-4.19/dm-crypt-don-t-modify-the-data-when-using-authenticated-encryption.patch
new file mode 100644 (file)
index 0000000..adec291
--- /dev/null
+++ b/queue-4.19/dm-crypt-don-t-modify-the-data-when-using-authenticated-encryption.patch
@@ -0,0 +1,43 @@
+From 50c70240097ce41fe6bce6478b80478281e4d0f7 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 19 Feb 2024 21:30:10 +0100
+Subject: dm-crypt: don't modify the data when using authenticated encryption
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream.
+
+It was said that authenticated encryption could produce invalid tag when
+the data that is being encrypted is modified [1]. So, fix this problem by
+copying the data into the clone bio first and then encrypt them inside the
+clone bio.
+
+This may reduce performance, but it is needed to prevent the user from
+corrupting the device by writing data with O_DIRECT and modifying them at
+the same time.
+
+[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-crypt.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1734,6 +1734,12 @@ static void kcryptd_crypt_write_convert(
+       io->ctx.bio_out = clone;
+       io->ctx.iter_out = clone->bi_iter;
+ 
++      if (crypt_integrity_aead(cc)) {
++              bio_copy_data(clone, io->base_bio);
++              io->ctx.bio_in = clone;
++              io->ctx.iter_in = clone->bi_iter;
++      }
++
+       sector += bio_sectors(clone);
+ 
+       crypt_inc_pending(io);

diff --git a/queue-4.19/gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_genl_dump_pdp.patch b/queue-4.19/gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_genl_dump_pdp.patch
new file mode 100644 (file)
index 0000000..ea1aa4d
--- /dev/null
+++ b/queue-4.19/gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_genl_dump_pdp.patch
@@ -0,0 +1,97 @@
+From 136cfaca22567a03bbb3bf53a43d8cb5748b80ec Mon Sep 17 00:00:00 2001
+From: Vasiliy Kovalev <kovalev@altlinux.org>
+Date: Wed, 14 Feb 2024 19:27:33 +0300
+Subject: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
+
+From: Vasiliy Kovalev <kovalev@altlinux.org>
+
+commit 136cfaca22567a03bbb3bf53a43d8cb5748b80ec upstream.
+
+The gtp_net_ops pernet operations structure for the subsystem must be
+registered before registering the generic netlink family.
+
+Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug:
+
+general protection fault, probably for non-canonical address
+0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN NOPTI
+KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
+CPU: 1 PID: 5826 Comm: gtp Not tainted 6.8.0-rc3-std-def-alt1 #1
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014
+RIP: 0010:gtp_genl_dump_pdp+0x1be/0x800 [gtp]
+Code: c6 89 c6 e8 64 e9 86 df 58 45 85 f6 0f 85 4e 04 00 00 e8 c5 ee 86
+      df 48 8b 54 24 18 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80>
+      3c 02 00 0f 85 de 05 00 00 48 8b 44 24 18 4c 8b 30 4c 39 f0 74
+RSP: 0018:ffff888014107220 EFLAGS: 00010202
+RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
+RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
+R13: ffff88800fcda588 R14: 0000000000000001 R15: 0000000000000000
+FS:  00007f1be4eb05c0(0000) GS:ffff88806ce80000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f1be4e766cf CR3: 000000000c33e000 CR4: 0000000000750ef0
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ ? show_regs+0x90/0xa0
+ ? die_addr+0x50/0xd0
+ ? exc_general_protection+0x148/0x220
+ ? asm_exc_general_protection+0x22/0x30
+ ? gtp_genl_dump_pdp+0x1be/0x800 [gtp]
+ ? __alloc_skb+0x1dd/0x350
+ ? __pfx___alloc_skb+0x10/0x10
+ genl_dumpit+0x11d/0x230
+ netlink_dump+0x5b9/0xce0
+ ? lockdep_hardirqs_on_prepare+0x253/0x430
+ ? __pfx_netlink_dump+0x10/0x10
+ ? kasan_save_track+0x10/0x40
+ ? __kasan_kmalloc+0x9b/0xa0
+ ? genl_start+0x675/0x970
+ __netlink_dump_start+0x6fc/0x9f0
+ genl_family_rcv_msg_dumpit+0x1bb/0x2d0
+ ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10
+ ? genl_op_from_small+0x2a/0x440
+ ? cap_capable+0x1d0/0x240
+ ? __pfx_genl_start+0x10/0x10
+ ? __pfx_genl_dumpit+0x10/0x10
+ ? __pfx_genl_done+0x10/0x10
+ ? security_capable+0x9d/0xe0
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
+Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
+Link: https://lore.kernel.org/r/20240214162733.34214-1-kovalev@altlinux.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/gtp.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -1385,20 +1385,20 @@ static int __init gtp_init(void)
+       if (err < 0)
+               goto error_out;
+ 
+-      err = genl_register_family(&gtp_genl_family);
++      err = register_pernet_subsys(&gtp_net_ops);
+       if (err < 0)
+               goto unreg_rtnl_link;
+ 
+-      err = register_pernet_subsys(&gtp_net_ops);
++      err = genl_register_family(&gtp_genl_family);
+       if (err < 0)
+-              goto unreg_genl_family;
++              goto unreg_pernet_subsys;
+ 
+       pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
+               sizeof(struct pdp_ctx));
+       return 0;
+ 
+-unreg_genl_family:
+-      genl_unregister_family(&gtp_genl_family);
++unreg_pernet_subsys:
++      unregister_pernet_subsys(&gtp_net_ops);
+ unreg_rtnl_link:
+       rtnl_link_unregister(&gtp_link_ops);
+ error_out:

diff --git a/queue-4.19/series b/queue-4.19/series
index cd2fef46409a559b4ebeb4b444d4465c714681e1..57f8c7da0921ce869097d22d992c49688e8d2c37 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -26,3 +26,5 @@ s390-qeth-fix-potential-loss-of-l3-ip-in-case-of-net.patch
 pmdomain-renesas-r8a77980-sysc-cr7-must-be-always-on.patch
 ib-hfi1-fix-sdma.h-tx-num_descs-off-by-one-error.patch
 mm-memcontrol-switch-to-rcu-protection-in-drain_all_stock.patch
+dm-crypt-don-t-modify-the-data-when-using-authenticated-encryption.patch
+gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_genl_dump_pdp.patch