From: Greg Kroah-Hartman Date: Sat, 4 Dec 2021 10:44:52 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.294~49 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6aae06df49fc98a4232491572bba94e174e03ebe;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: kprobes-limit-max-data_size-of-the-kretprobe-instances.patch sata_fsl-fix-uaf-in-sata_fsl_port_stop-when-rmmod-sata_fsl.patch sata_fsl-fix-warning-in-remove_proc_entry-when-rmmod-sata_fsl.patch vrf-reset-ipcb-ip6cb-when-processing-outbound-pkts-in-vrf-dev-xmit.patch --- diff --git a/queue-4.9/kprobes-limit-max-data_size-of-the-kretprobe-instances.patch b/queue-4.9/kprobes-limit-max-data_size-of-the-kretprobe-instances.patch new file mode 100644 index 00000000000..2c2469f9eaf --- /dev/null +++ b/queue-4.9/kprobes-limit-max-data_size-of-the-kretprobe-instances.patch @@ -0,0 +1,55 @@ +From 6bbfa44116689469267f1a6e3d233b52114139d2 Mon Sep 17 00:00:00 2001 +From: Masami Hiramatsu +Date: Wed, 1 Dec 2021 23:45:50 +0900 +Subject: kprobes: Limit max data_size of the kretprobe instances + +From: Masami Hiramatsu + +commit 6bbfa44116689469267f1a6e3d233b52114139d2 upstream. + +The 'kprobe::data_size' is unsigned, thus it can not be negative. But if +user sets it enough big number (e.g. (size_t)-8), the result of 'data_size ++ sizeof(struct kretprobe_instance)' becomes smaller than sizeof(struct +kretprobe_instance) or zero. In result, the kretprobe_instance are +allocated without enough memory, and kretprobe accesses outside of +allocated memory. + +To avoid this issue, introduce a max limitation of the +kretprobe::data_size. 4KB per instance should be OK. + +Link: https://lkml.kernel.org/r/163836995040.432120.10322772773821182925.stgit@devnote2 + +Cc: stable@vger.kernel.org +Fixes: f47cd9b553aa ("kprobes: kretprobe user entry-handler") +Reported-by: zhangyue +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/kprobes.h | 2 ++ + kernel/kprobes.c | 3 +++ + 2 files changed, 5 insertions(+) + +--- a/include/linux/kprobes.h ++++ b/include/linux/kprobes.h +@@ -192,6 +192,8 @@ struct kretprobe { + raw_spinlock_t lock; + }; + ++#define KRETPROBE_MAX_DATA_SIZE 4096 ++ + struct kretprobe_instance { + struct hlist_node hlist; + struct kretprobe *rp; +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1899,6 +1899,9 @@ int register_kretprobe(struct kretprobe + } + } + ++ if (rp->data_size > KRETPROBE_MAX_DATA_SIZE) ++ return -E2BIG; ++ + rp->kp.pre_handler = pre_handler_kretprobe; + rp->kp.post_handler = NULL; + rp->kp.fault_handler = NULL; diff --git a/queue-4.9/sata_fsl-fix-uaf-in-sata_fsl_port_stop-when-rmmod-sata_fsl.patch b/queue-4.9/sata_fsl-fix-uaf-in-sata_fsl_port_stop-when-rmmod-sata_fsl.patch new file mode 100644 index 00000000000..5033c5bba6a --- /dev/null +++ b/queue-4.9/sata_fsl-fix-uaf-in-sata_fsl_port_stop-when-rmmod-sata_fsl.patch @@ -0,0 +1,98 @@ +From 6c8ad7e8cf29eb55836e7a0215f967746ab2b504 Mon Sep 17 00:00:00 2001 +From: Baokun Li +Date: Fri, 26 Nov 2021 10:03:06 +0800 +Subject: sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl + +From: Baokun Li + +commit 6c8ad7e8cf29eb55836e7a0215f967746ab2b504 upstream. + +When the `rmmod sata_fsl.ko` command is executed in the PPC64 GNU/Linux, +a bug is reported: + ================================================================== + BUG: Unable to handle kernel data access on read at 0x80000800805b502c + Oops: Kernel access of bad area, sig: 11 [#1] + NIP [c0000000000388a4] .ioread32+0x4/0x20 + LR [80000000000c6034] .sata_fsl_port_stop+0x44/0xe0 [sata_fsl] + Call Trace: + .free_irq+0x1c/0x4e0 (unreliable) + .ata_host_stop+0x74/0xd0 [libata] + .release_nodes+0x330/0x3f0 + .device_release_driver_internal+0x178/0x2c0 + .driver_detach+0x64/0xd0 + .bus_remove_driver+0x70/0xf0 + .driver_unregister+0x38/0x80 + .platform_driver_unregister+0x14/0x30 + .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl] + .__se_sys_delete_module+0x1ec/0x2d0 + .system_call_exception+0xfc/0x1f0 + system_call_common+0xf8/0x200 + ================================================================== + +The triggering of the BUG is shown in the following stack: + +driver_detach + device_release_driver_internal + __device_release_driver + drv->remove(dev) --> platform_drv_remove/platform_remove + drv->remove(dev) --> sata_fsl_remove + iounmap(host_priv->hcr_base); <---- unmap + kfree(host_priv); <---- free + devres_release_all + release_nodes + dr->node.release(dev, dr->data) --> ata_host_stop + ap->ops->port_stop(ap) --> sata_fsl_port_stop + ioread32(hcr_base + HCONTROL) <---- UAF + host->ops->host_stop(host) + +The iounmap(host_priv->hcr_base) and kfree(host_priv) functions should +not be executed in drv->remove. These functions should be executed in +host_stop after port_stop. Therefore, we move these functions to the +new function sata_fsl_host_stop and bind the new function to host_stop. + +Fixes: faf0b2e5afe7 ("drivers/ata: add support to Freescale 3.0Gbps SATA Controller") +Cc: stable@vger.kernel.org +Reported-by: Hulk Robot +Signed-off-by: Baokun Li +Reviewed-by: Sergei Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/sata_fsl.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/ata/sata_fsl.c ++++ b/drivers/ata/sata_fsl.c +@@ -1406,6 +1406,14 @@ static int sata_fsl_init_controller(stru + return 0; + } + ++static void sata_fsl_host_stop(struct ata_host *host) ++{ ++ struct sata_fsl_host_priv *host_priv = host->private_data; ++ ++ iounmap(host_priv->hcr_base); ++ kfree(host_priv); ++} ++ + /* + * scsi mid-layer and libata interface structures + */ +@@ -1438,6 +1446,8 @@ static struct ata_port_operations sata_f + .port_start = sata_fsl_port_start, + .port_stop = sata_fsl_port_stop, + ++ .host_stop = sata_fsl_host_stop, ++ + .pmp_attach = sata_fsl_pmp_attach, + .pmp_detach = sata_fsl_pmp_detach, + }; +@@ -1572,8 +1582,6 @@ static int sata_fsl_remove(struct platfo + ata_host_detach(host); + + irq_dispose_mapping(host_priv->irq); +- iounmap(host_priv->hcr_base); +- kfree(host_priv); + + return 0; + } diff --git a/queue-4.9/sata_fsl-fix-warning-in-remove_proc_entry-when-rmmod-sata_fsl.patch b/queue-4.9/sata_fsl-fix-warning-in-remove_proc_entry-when-rmmod-sata_fsl.patch new file mode 100644 index 00000000000..b1d745a0541 --- /dev/null +++ b/queue-4.9/sata_fsl-fix-warning-in-remove_proc_entry-when-rmmod-sata_fsl.patch @@ -0,0 +1,78 @@ +From 6f48394cf1f3e8486591ad98c11cdadb8f1ef2ad Mon Sep 17 00:00:00 2001 +From: Baokun Li +Date: Fri, 26 Nov 2021 10:03:07 +0800 +Subject: sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl + +From: Baokun Li + +commit 6f48394cf1f3e8486591ad98c11cdadb8f1ef2ad upstream. + +Trying to remove the fsl-sata module in the PPC64 GNU/Linux +leads to the following warning: + ------------[ cut here ]------------ + remove_proc_entry: removing non-empty directory 'irq/69', + leaking at least 'fsl-sata[ff0221000.sata]' + WARNING: CPU: 3 PID: 1048 at fs/proc/generic.c:722 + .remove_proc_entry+0x20c/0x220 + IRQMASK: 0 + NIP [c00000000033826c] .remove_proc_entry+0x20c/0x220 + LR [c000000000338268] .remove_proc_entry+0x208/0x220 + Call Trace: + .remove_proc_entry+0x208/0x220 (unreliable) + .unregister_irq_proc+0x104/0x140 + .free_desc+0x44/0xb0 + .irq_free_descs+0x9c/0xf0 + .irq_dispose_mapping+0x64/0xa0 + .sata_fsl_remove+0x58/0xa0 [sata_fsl] + .platform_drv_remove+0x40/0x90 + .device_release_driver_internal+0x160/0x2c0 + .driver_detach+0x64/0xd0 + .bus_remove_driver+0x70/0xf0 + .driver_unregister+0x38/0x80 + .platform_driver_unregister+0x14/0x30 + .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl] + ---[ end trace 0ea876d4076908f5 ]--- + +The driver creates the mapping by calling irq_of_parse_and_map(), +so it also has to dispose the mapping. But the easy way out is to +simply use platform_get_irq() instead of irq_of_parse_map(). Also +we should adapt return value checking and propagate error values. + +In this case the mapping is not managed by the device but by +the of core, so the device has not to dispose the mapping. + +Fixes: faf0b2e5afe7 ("drivers/ata: add support to Freescale 3.0Gbps SATA Controller") +Cc: stable@vger.kernel.org +Reported-by: Hulk Robot +Signed-off-by: Baokun Li +Reviewed-by: Sergei Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/sata_fsl.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/ata/sata_fsl.c ++++ b/drivers/ata/sata_fsl.c +@@ -1502,9 +1502,9 @@ static int sata_fsl_probe(struct platfor + host_priv->ssr_base = ssr_base; + host_priv->csr_base = csr_base; + +- irq = irq_of_parse_and_map(ofdev->dev.of_node, 0); +- if (!irq) { +- dev_err(&ofdev->dev, "invalid irq from platform\n"); ++ irq = platform_get_irq(ofdev, 0); ++ if (irq < 0) { ++ retval = irq; + goto error_exit_with_cleanup; + } + host_priv->irq = irq; +@@ -1581,8 +1581,6 @@ static int sata_fsl_remove(struct platfo + + ata_host_detach(host); + +- irq_dispose_mapping(host_priv->irq); +- + return 0; + } + diff --git a/queue-4.9/series b/queue-4.9/series index 413f3e27e64..2ddcd60d002 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -45,3 +45,7 @@ scsi-iscsi-unblock-session-then-wake-up-error-handle.patch ethernet-hisilicon-hns-hns_dsaf_misc-fix-a-possible-.patch net-tulip-de4x5-fix-the-problem-that-the-array-lp-ph.patch net-ethernet-dec-tulip-de4x5-fix-possible-array-over.patch +vrf-reset-ipcb-ip6cb-when-processing-outbound-pkts-in-vrf-dev-xmit.patch +kprobes-limit-max-data_size-of-the-kretprobe-instances.patch +sata_fsl-fix-uaf-in-sata_fsl_port_stop-when-rmmod-sata_fsl.patch +sata_fsl-fix-warning-in-remove_proc_entry-when-rmmod-sata_fsl.patch diff --git a/queue-4.9/vrf-reset-ipcb-ip6cb-when-processing-outbound-pkts-in-vrf-dev-xmit.patch b/queue-4.9/vrf-reset-ipcb-ip6cb-when-processing-outbound-pkts-in-vrf-dev-xmit.patch new file mode 100644 index 00000000000..fd4c800ffbe --- /dev/null +++ b/queue-4.9/vrf-reset-ipcb-ip6cb-when-processing-outbound-pkts-in-vrf-dev-xmit.patch @@ -0,0 +1,51 @@ +From ee201011c1e1563c114a55c86eb164b236f18e84 Mon Sep 17 00:00:00 2001 +From: Stephen Suryaputra +Date: Tue, 30 Nov 2021 11:26:37 -0500 +Subject: vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit + +From: Stephen Suryaputra + +commit ee201011c1e1563c114a55c86eb164b236f18e84 upstream. + +IPCB/IP6CB need to be initialized when processing outbound v4 or v6 pkts +in the codepath of vrf device xmit function so that leftover garbage +doesn't cause futher code that uses the CB to incorrectly process the +pkt. + +One occasion of the issue might occur when MPLS route uses the vrf +device as the outgoing device such as when the route is added using "ip +-f mpls route add