From: Greg Kroah-Hartman Date: Thu, 9 Jul 2026 14:33:47 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9b0f7b72ffcab6031fc62c184ed6f69dc22b6f70;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch --- diff --git a/queue-5.10/bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch b/queue-5.10/bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch new file mode 100644 index 0000000000..12847fc6fe --- /dev/null +++ b/queue-5.10/bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch @@ -0,0 +1,42 @@ +From eff9704f5332a13b08fbdbe0f84059c9e7051d5f Mon Sep 17 00:00:00 2001 +From: Krishna chaitanya chundru +Date: Tue, 31 Oct 2023 15:21:05 +0530 +Subject: bus: mhi: host: Add alignment check for event ring read pointer + +From: Krishna chaitanya chundru + +commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f upstream. + +Though we do check the event ring read pointer by "is_valid_ring_ptr" +to make sure it is in the buffer range, but there is another risk the +pointer may be not aligned. Since we are expecting event ring elements +are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer +could lead to multiple issues like DoS or ring buffer memory corruption. + +So add a alignment check for event ring read pointer. + +Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") +cc: stable@vger.kernel.org +Signed-off-by: Krishna chaitanya chundru +Reviewed-by: Jeffrey Hugo +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicinc.com +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Alexander Martyniuk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/bus/mhi/host/main.c ++++ b/drivers/bus/mhi/host/main.c +@@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct + + static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) + { +- return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; ++ return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && ++ !(addr & (sizeof(struct mhi_tre) - 1)); + } + + int mhi_destroy_device(struct device *dev, void *data) diff --git a/queue-5.10/netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch b/queue-5.10/netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch new file mode 100644 index 0000000000..61b45ae8cd --- /dev/null +++ b/queue-5.10/netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch @@ -0,0 +1,80 @@ +From a84b6fedbc97078788be78dbdd7517d143ad1a77 Mon Sep 17 00:00:00 2001 +From: Xiang Mei +Date: Tue, 9 Jun 2026 15:55:02 -0700 +Subject: netfilter: nf_log: validate MAC header was set before dumping it + +From: Xiang Mei + +commit a84b6fedbc97078788be78dbdd7517d143ad1a77 upstream. + +The fallback path of dump_mac_header() guards the MAC header access +only with "skb->mac_header != skb->network_header", without checking +skb_mac_header_was_set(). When the MAC header is unset, mac_header is +0xffff, so the test passes and skb_mac_header(skb) returns +skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads +dev->hard_header_len bytes out of bounds into the kernel log. + +This is reachable via the netdev logger: nf_log_unknown_packet() calls +dump_mac_header() unconditionally, and an skb sent through AF_PACKET +with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still +unset (__dev_queue_xmit(), which would reset it, is bypassed). + +Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already +uses, and replace the open-coded MAC header length test with +skb_mac_header_len(). Only skbs with an unset MAC header are affected; +valid ones are dumped as before. + + BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) + Read of size 1 at addr ffff88800ea49d3f by task exploit/148 + Call Trace: + kasan_report (mm/kasan/report.c:595) + dump_mac_header (net/netfilter/nf_log_syslog.c:831) + nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) + nf_log_packet (net/netfilter/nf_log.c:260) + nft_log_eval (net/netfilter/nft_log.c:60) + nft_do_chain (net/netfilter/nf_tables_core.c:285) + nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) + nf_hook_slow (net/netfilter/core.c:619) + nf_hook_direct_egress (net/packet/af_packet.c:257) + packet_xmit (net/packet/af_packet.c:280) + packet_sendmsg (net/packet/af_packet.c:3114) + __sys_sendto (net/socket.c:2265) + +Fixes: 7eb9282cd0ef ("netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header") +Reported-by: Weiming Shi +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Xiang Mei +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Alexander Martyniuk +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/netfilter/nf_log_ipv4.c | 4 ++-- + net/ipv6/netfilter/nf_log_ipv6.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/net/ipv4/netfilter/nf_log_ipv4.c ++++ b/net/ipv4/netfilter/nf_log_ipv4.c +@@ -296,8 +296,8 @@ static void dump_ipv4_mac_header(struct + + fallback: + nf_log_buf_add(m, "MAC="); +- if (dev->hard_header_len && +- skb->mac_header != skb->network_header) { ++ if (dev->hard_header_len && skb_mac_header_was_set(skb) && ++ skb_mac_header_len(skb) != 0) { + const unsigned char *p = skb_mac_header(skb); + unsigned int i; + +--- a/net/ipv6/netfilter/nf_log_ipv6.c ++++ b/net/ipv6/netfilter/nf_log_ipv6.c +@@ -309,8 +309,8 @@ static void dump_ipv6_mac_header(struct + + fallback: + nf_log_buf_add(m, "MAC="); +- if (dev->hard_header_len && +- skb->mac_header != skb->network_header) { ++ if (dev->hard_header_len && skb_mac_header_was_set(skb) && ++ skb_mac_header_len(skb) != 0) { + const unsigned char *p = skb_mac_header(skb); + unsigned int len = dev->hard_header_len; + unsigned int i; diff --git a/queue-5.10/series b/queue-5.10/series index 536e445eb7..7fcf346a6c 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -8,3 +8,5 @@ nfsd-change-nfs4_client_to_reclaim-to-allocate-data.patch mmc-renesas_sdhi-add-quirk-entry-for-rz-g2h-soc.patch kvm-replace-guest-triggerable-bug_on-in-ioeventfd-da.patch perf-trace-beauty-fcntl-fix-build-with-older-kernel-headers.patch +bus-mhi-host-add-alignment-check-for-event-ring-read-pointer.patch +netfilter-nf_log-validate-mac-header-was-set-before-dumping-it.patch