From: Greg Kroah-Hartman Date: Wed, 27 Mar 2024 14:48:26 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v6.7.12~208 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=662bcedac5c0bf8b4f566c4da89cd0517bed3c07;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch netfilter-nf_tables-reject-constant-set-with-timeout.patch xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch --- diff --git a/queue-4.19/netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch b/queue-4.19/netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch new file mode 100644 index 00000000000..43efec3cd10 --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch @@ -0,0 +1,33 @@ +From 16603605b667b70da974bea8216c93e7db043bf1 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 1 Mar 2024 00:11:10 +0100 +Subject: netfilter: nf_tables: disallow anonymous set with timeout flag + +From: Pablo Neira Ayuso + +commit 16603605b667b70da974bea8216c93e7db043bf1 upstream. + +Anonymous sets are never used with timeout from userspace, reject this. +Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work. + +Cc: stable@vger.kernel.org +Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") +Reported-by: lonial con +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3560,6 +3560,9 @@ static int nf_tables_newset(struct net * + if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == + (NFT_SET_EVAL | NFT_SET_OBJECT)) + return -EOPNOTSUPP; ++ if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == ++ (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) ++ return -EOPNOTSUPP; + } + + dtype = 0; diff --git a/queue-4.19/netfilter-nf_tables-reject-constant-set-with-timeout.patch b/queue-4.19/netfilter-nf_tables-reject-constant-set-with-timeout.patch new file mode 100644 index 00000000000..3a0561b7773 --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-reject-constant-set-with-timeout.patch @@ -0,0 +1,34 @@ +From 5f4fc4bd5cddb4770ab120ce44f02695c4505562 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 1 Mar 2024 01:04:11 +0100 +Subject: netfilter: nf_tables: reject constant set with timeout + +From: Pablo Neira Ayuso + +commit 5f4fc4bd5cddb4770ab120ce44f02695c4505562 upstream. + +This set combination is weird: it allows for elements to be +added/deleted, but once bound to the rule it cannot be updated anymore. +Eventually, all elements expire, leading to an empty set which cannot +be updated anymore. Reject this flags combination. + +Cc: stable@vger.kernel.org +Fixes: 761da2935d6e ("netfilter: nf_tables: add set timeout API support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3563,6 +3563,9 @@ static int nf_tables_newset(struct net * + if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == + (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) + return -EOPNOTSUPP; ++ if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) == ++ (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) ++ return -EOPNOTSUPP; + } + + dtype = 0; diff --git a/queue-4.19/series b/queue-4.19/series index db01d3bb979..88c2a0c2d04 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -67,3 +67,6 @@ x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch ahci-asm1064-correct-count-of-reported-ports.patch ahci-asm1064-asm1166-don-t-limit-reported-ports.patch comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch +netfilter-nf_tables-disallow-anonymous-set-with-timeout-flag.patch +netfilter-nf_tables-reject-constant-set-with-timeout.patch +xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch diff --git a/queue-4.19/xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch b/queue-4.19/xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch new file mode 100644 index 00000000000..c4fbb1f3fb2 --- /dev/null +++ b/queue-4.19/xfrm-avoid-clang-fortify-warning-in-copy_to_user_tmpl.patch @@ -0,0 +1,56 @@ +From 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 21 Feb 2024 14:46:21 -0700 +Subject: xfrm: Avoid clang fortify warning in copy_to_user_tmpl() + +From: Nathan Chancellor + +commit 1a807e46aa93ebad1dfbed4f82dc3bf779423a6e upstream. + +After a couple recent changes in LLVM, there is a warning (or error with +CONFIG_WERROR=y or W=e) from the compile time fortify source routines, +specifically the memset() in copy_to_user_tmpl(). + + In file included from net/xfrm/xfrm_user.c:14: + ... + include/linux/fortify-string.h:438:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] + 438 | __write_overflow_field(p_size_field, size); + | ^ + 1 error generated. + +While ->xfrm_nr has been validated against XFRM_MAX_DEPTH when its value +is first assigned in copy_templates() by calling validate_tmpl() first +(so there should not be any issue in practice), LLVM/clang cannot really +deduce that across the boundaries of these functions. Without that +knowledge, it cannot assume that the loop stops before i is greater than +XFRM_MAX_DEPTH, which would indeed result a stack buffer overflow in the +memset(). + +To make the bounds of ->xfrm_nr clear to the compiler and add additional +defense in case copy_to_user_tmpl() is ever used in a path where +->xfrm_nr has not been properly validated against XFRM_MAX_DEPTH first, +add an explicit bound check and early return, which clears up the +warning. + +Cc: stable@vger.kernel.org +Link: https://github.com/ClangBuiltLinux/linux/issues/1985 +Signed-off-by: Nathan Chancellor +Reviewed-by: Kees Cook +Signed-off-by: Steffen Klassert +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_user.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1703,6 +1703,9 @@ static int copy_to_user_tmpl(struct xfrm + if (xp->xfrm_nr == 0) + return 0; + ++ if (xp->xfrm_nr > XFRM_MAX_DEPTH) ++ return -ENOBUFS; ++ + for (i = 0; i < xp->xfrm_nr; i++) { + struct xfrm_user_tmpl *up = &vec[i]; + struct xfrm_tmpl *kp = &xp->xfrm_vec[i];