From: Greg Kroah-Hartman Date: Mon, 14 Oct 2024 08:50:10 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.10.227~51 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3a76476f919b03ac74a8e54fda1b8c2e5c39e1a9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: cdc-ncm-avoid-overflow-in-sanity-checking.patch net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch --- diff --git a/queue-4.19/cdc-ncm-avoid-overflow-in-sanity-checking.patch b/queue-4.19/cdc-ncm-avoid-overflow-in-sanity-checking.patch new file mode 100644 index 00000000000..212ef6ae8fa --- /dev/null +++ b/queue-4.19/cdc-ncm-avoid-overflow-in-sanity-checking.patch @@ -0,0 +1,53 @@ +From 8d2b1a1ec9f559d30b724877da4ce592edc41fdc Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 15 Feb 2022 11:35:47 +0100 +Subject: CDC-NCM: avoid overflow in sanity checking + +From: Oliver Neukum + +commit 8d2b1a1ec9f559d30b724877da4ce592edc41fdc upstream. + +A broken device may give an extreme offset like 0xFFF0 +and a reasonable length for a fragment. In the sanity +check as formulated now, this will create an integer +overflow, defeating the sanity check. Both offset +and offset + len need to be checked in such a manner +that no overflow can occur. +And those quantities should be unsigned. + +Signed-off-by: Oliver Neukum +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: David S. Miller +Signed-off-by: Bruno VERNAY +Signed-off-by: Hugo SIMELIERE +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_ncm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1708,10 +1708,10 @@ int cdc_ncm_rx_fixup(struct usbnet *dev, + { + struct sk_buff *skb; + struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0]; +- int len; ++ unsigned int len; + int nframes; + int x; +- int offset; ++ unsigned int offset; + union { + struct usb_cdc_ncm_ndp16 *ndp16; + struct usb_cdc_ncm_ndp32 *ndp32; +@@ -1783,8 +1783,8 @@ next_ndp: + break; + } + +- /* sanity checking */ +- if (((offset + len) > skb_in->len) || ++ /* sanity checking - watch out for integer wrap*/ ++ if ((offset > skb_in->len) || (len > skb_in->len - offset) || + (len > ctx->rx_max) || (len < ETH_HLEN)) { + netif_dbg(dev, rx_err, dev->net, + "invalid frame detected (ignored) offset[%u]=%u, length=%u, skb=%p\n", diff --git a/queue-4.19/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch b/queue-4.19/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch new file mode 100644 index 00000000000..0d2e9aede42 --- /dev/null +++ b/queue-4.19/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch @@ -0,0 +1,95 @@ +From 9995b408f17ff8c7f11bc725c8aa225ba3a63b1c Mon Sep 17 00:00:00 2001 +From: "j.nixdorf@avm.de" +Date: Thu, 24 Feb 2022 10:06:49 +0100 +Subject: net: ipv6: ensure we call ipv6_mc_down() at most once + +From: j.nixdorf@avm.de + +commit 9995b408f17ff8c7f11bc725c8aa225ba3a63b1c upstream. + +There are two reasons for addrconf_notify() to be called with NETDEV_DOWN: +either the network device is actually going down, or IPv6 was disabled +on the interface. + +If either of them stays down while the other is toggled, we repeatedly +call the code for NETDEV_DOWN, including ipv6_mc_down(), while never +calling the corresponding ipv6_mc_up() in between. This will cause a +new entry in idev->mc_tomb to be allocated for each multicast group +the interface is subscribed to, which in turn leaks one struct ifmcaddr6 +per nontrivial multicast group the interface is subscribed to. + +The following reproducer will leak at least $n objects: + +ip addr add ff2e::4242/32 dev eth0 autojoin +sysctl -w net.ipv6.conf.eth0.disable_ipv6=1 +for i in $(seq 1 $n); do + ip link set up eth0; ip link set down eth0 +done + +Joining groups with IPV6_ADD_MEMBERSHIP (unprivileged) or setting the +sysctl net.ipv6.conf.eth0.forwarding to 1 (=> subscribing to ff02::2) +can also be used to create a nontrivial idev->mc_list, which will the +leak objects with the right up-down-sequence. + +Based on both sources for NETDEV_DOWN events the interface IPv6 state +should be considered: + + - not ready if the network interface is not ready OR IPv6 is disabled + for it + - ready if the network interface is ready AND IPv6 is enabled for it + +The functions ipv6_mc_up() and ipv6_down() should only be run when this +state changes. + +Implement this by remembering when the IPv6 state is ready, and only +run ipv6_mc_down() if it actually changed from ready to not ready. + +The other direction (not ready -> ready) already works correctly, as: + + - the interface notification triggered codepath for NETDEV_UP / + NETDEV_CHANGE returns early if ipv6 is disabled, and + - the disable_ipv6=0 triggered codepath skips fully initializing the + interface as long as addrconf_link_ready(dev) returns false + - calling ipv6_mc_up() repeatedly does not leak anything + +Fixes: 3ce62a84d53c ("ipv6: exit early in addrconf_notify() if IPv6 is disabled") +Signed-off-by: Johannes Nixdorf +Signed-off-by: David S. Miller +Signed-off-by: Bruno VERNAY +Signed-off-by: Hugo SIMELIERE +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3679,6 +3679,7 @@ static int addrconf_ifdown(struct net_de + struct inet6_ifaddr *ifa; + LIST_HEAD(tmp_addr_list); + bool keep_addr = false; ++ bool was_ready; + int state, i; + + ASSERT_RTNL(); +@@ -3744,7 +3745,10 @@ restart: + + addrconf_del_rs_timer(idev); + +- /* Step 2: clear flags for stateless addrconf */ ++ /* Step 2: clear flags for stateless addrconf, repeated down ++ * detection ++ */ ++ was_ready = idev->if_flags & IF_READY; + if (!how) + idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY); + +@@ -3824,7 +3828,7 @@ restart: + if (how) { + ipv6_ac_destroy_dev(idev); + ipv6_mc_destroy_dev(idev); +- } else { ++ } else if (was_ready) { + ipv6_mc_down(idev); + } + diff --git a/queue-4.19/series b/queue-4.19/series index 796c9761af7..6d000655833 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -259,3 +259,6 @@ gpio-aspeed-use-devm_clk-api-to-manage-clock-source.patch igb-do-not-bring-the-device-up-after-non-fatal-error.patch net-ibm-emac-mal-fix-wrong-goto.patch ppp-fix-ppp_async_encode-illegal-access.patch +net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch +cdc-ncm-avoid-overflow-in-sanity-checking.patch +wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch diff --git a/queue-4.19/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch b/queue-4.19/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch new file mode 100644 index 00000000000..8091a683a6a --- /dev/null +++ b/queue-4.19/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch @@ -0,0 +1,115 @@ +From 69403bad97aa0162e3d7911b27e25abe774093df Mon Sep 17 00:00:00 2001 +From: Alexander Wetzel +Date: Fri, 30 Dec 2022 13:18:50 +0100 +Subject: wifi: mac80211: sdata can be NULL during AMPDU start + +From: Alexander Wetzel + +commit 69403bad97aa0162e3d7911b27e25abe774093df upstream. + +ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a +deauthentication is ongoing. + +Here a trace triggering the race with the hostapd test +multi_ap_fronthaul_on_ap: + +(gdb) list *drv_ampdu_action+0x46 +0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396). +391 int ret = -EOPNOTSUPP; +392 +393 might_sleep(); +394 +395 sdata = get_bss_sdata(sdata); +396 if (!check_sdata_in_driver(sdata)) +397 return -EIO; +398 +399 trace_drv_ampdu_action(local, sdata, params); +400 + +wlan0: moving STA 02:00:00:00:03:00 to state 3 +wlan0: associated +wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) +wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 +wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port) +wlan0: moving STA 02:00:00:00:03:00 to state 2 +wlan0: moving STA 02:00:00:00:03:00 to state 1 +wlan0: Removed STA 02:00:00:00:03:00 +wlan0: Destroyed STA 02:00:00:00:03:00 +BUG: unable to handle page fault for address: fffffffffffffb48 +PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 +Oops: 0000 [#1] PREEMPT SMP PTI +CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 +Workqueue: phy3 ieee80211_ba_session_work [mac80211] +RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] +Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 +RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 +RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 +RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 +RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 +R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 +R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 +FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 +Call Trace: + + ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] + ieee80211_ba_session_work+0xff/0x2e0 [mac80211] + process_one_work+0x29f/0x620 + worker_thread+0x4d/0x3d0 + ? process_one_work+0x620/0x620 + kthread+0xfb/0x120 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + + +Signed-off-by: Alexander Wetzel +Link: https://lore.kernel.org/r/20221230121850.218810-2-alexander@wetzel-home.de +Cc: stable@vger.kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Bruno VERNAY +Signed-off-by: Hugo SIMELIERE +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/agg-tx.c | 6 +++++- + net/mac80211/driver-ops.c | 3 +++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -455,7 +455,7 @@ void ieee80211_tx_ba_session_handle_star + { + struct tid_ampdu_tx *tid_tx; + struct ieee80211_local *local = sta->local; +- struct ieee80211_sub_if_data *sdata = sta->sdata; ++ struct ieee80211_sub_if_data *sdata; + struct ieee80211_ampdu_params params = { + .sta = &sta->sta, + .action = IEEE80211_AMPDU_TX_START, +@@ -486,9 +486,13 @@ void ieee80211_tx_ba_session_handle_star + */ + synchronize_net(); + ++ sdata = sta->sdata; + params.ssn = sta->tid_seq[tid] >> 4; + ret = drv_ampdu_action(local, sdata, ¶ms); + if (ret) { ++ if (!sdata) ++ return; ++ + ht_dbg(sdata, + "BA request denied - HW unavailable for %pM tid %d\n", + sta->sta.addr, tid); +--- a/net/mac80211/driver-ops.c ++++ b/net/mac80211/driver-ops.c +@@ -313,6 +313,9 @@ int drv_ampdu_action(struct ieee80211_lo + + might_sleep(); + ++ if (!sdata) ++ return -EIO; ++ + sdata = get_bss_sdata(sdata); + if (!check_sdata_in_driver(sdata)) + return -EIO;