From: Greg Kroah-Hartman Date: Sun, 18 Aug 2019 05:31:51 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.19.68~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dd1b2356c619aadb5769d0ee86f11364290c9ba2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: hid-hiddev-avoid-opening-a-disconnected-device.patch hid-hiddev-do-cleanup-in-failure-of-opening-a-device.patch hid-holtek-test-for-sanity-of-intfdata.patch input-iforce-add-sanity-checks.patch input-kbtab-sanity-check-for-endpoint-type.patch net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch netfilter-ebtables-also-count-base-chain-policies.patch --- diff --git a/queue-4.19/hid-hiddev-avoid-opening-a-disconnected-device.patch b/queue-4.19/hid-hiddev-avoid-opening-a-disconnected-device.patch new file mode 100644 index 00000000000..cf07013c483 --- /dev/null +++ b/queue-4.19/hid-hiddev-avoid-opening-a-disconnected-device.patch @@ -0,0 +1,212 @@ +From 9c09b214f30e3c11f9b0b03f89442df03643794d Mon Sep 17 00:00:00 2001 +From: Hillf Danton +Date: Tue, 6 Aug 2019 16:38:58 +0800 +Subject: HID: hiddev: avoid opening a disconnected device + +From: Hillf Danton + +commit 9c09b214f30e3c11f9b0b03f89442df03643794d upstream. + +syzbot found the following crash on: + +HEAD commit: e96407b4 usb-fuzzer: main usb gadget fuzzer driver +git tree: https://github.com/google/kasan.git usb-fuzzer +console output: https://syzkaller.appspot.com/x/log.txt?x=147ac20c600000 +kernel config: https://syzkaller.appspot.com/x/.config?x=792eb47789f57810 +dashboard link: https://syzkaller.appspot.com/bug?extid=62a1e04fd3ec2abf099e +compiler: gcc (GCC) 9.0.0 20181231 (experimental) + +================================================================== +BUG: KASAN: use-after-free in __lock_acquire+0x302a/0x3b50 +kernel/locking/lockdep.c:3753 +Read of size 8 at addr ffff8881cf591a08 by task syz-executor.1/26260 + +CPU: 1 PID: 26260 Comm: syz-executor.1 Not tainted 5.3.0-rc2+ #24 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xca/0x13e lib/dump_stack.c:113 + print_address_description+0x6a/0x32c mm/kasan/report.c:351 + __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 + kasan_report+0xe/0x12 mm/kasan/common.c:612 + __lock_acquire+0x302a/0x3b50 kernel/locking/lockdep.c:3753 + lock_acquire+0x127/0x320 kernel/locking/lockdep.c:4412 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0x32/0x50 kernel/locking/spinlock.c:159 + hiddev_release+0x82/0x520 drivers/hid/usbhid/hiddev.c:221 + __fput+0x2d7/0x840 fs/file_table.c:280 + task_work_run+0x13f/0x1c0 kernel/task_work.c:113 + exit_task_work include/linux/task_work.h:22 [inline] + do_exit+0x8ef/0x2c50 kernel/exit.c:878 + do_group_exit+0x125/0x340 kernel/exit.c:982 + get_signal+0x466/0x23d0 kernel/signal.c:2728 + do_signal+0x88/0x14e0 arch/x86/kernel/signal.c:815 + exit_to_usermode_loop+0x1a2/0x200 arch/x86/entry/common.c:159 + prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] + syscall_return_slowpath arch/x86/entry/common.c:274 [inline] + do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x459829 +Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 +48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff +ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 +RSP: 002b:00007f75b2a6ccf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca +RAX: fffffffffffffe00 RBX: 000000000075c078 RCX: 0000000000459829 +RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075c078 +RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075c07c +R13: 00007ffcdfe1023f R14: 00007f75b2a6d9c0 R15: 000000000075c07c + +Allocated by task 104: + save_stack+0x1b/0x80 mm/kasan/common.c:69 + set_track mm/kasan/common.c:77 [inline] + __kasan_kmalloc mm/kasan/common.c:487 [inline] + __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460 + kmalloc include/linux/slab.h:552 [inline] + kzalloc include/linux/slab.h:748 [inline] + hiddev_connect+0x242/0x5b0 drivers/hid/usbhid/hiddev.c:900 + hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882 + hid_hw_start drivers/hid/hid-core.c:1981 [inline] + hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972 + appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308 + hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209 + really_probe+0x281/0x650 drivers/base/dd.c:548 + driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:882 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2114 + hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365 + usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386 + usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 + really_probe+0x281/0x650 drivers/base/dd.c:548 + driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:882 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2114 + usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 + generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 + usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 + really_probe+0x281/0x650 drivers/base/dd.c:548 + driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:882 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2114 + usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 + hub_port_connect drivers/usb/core/hub.c:5098 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] + port_event drivers/usb/core/hub.c:5359 [inline] + hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 + process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 + worker_thread+0x96/0xe20 kernel/workqueue.c:2415 + kthread+0x318/0x420 kernel/kthread.c:255 + ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 + +Freed by task 104: + save_stack+0x1b/0x80 mm/kasan/common.c:69 + set_track mm/kasan/common.c:77 [inline] + __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449 + slab_free_hook mm/slub.c:1423 [inline] + slab_free_freelist_hook mm/slub.c:1470 [inline] + slab_free mm/slub.c:3012 [inline] + kfree+0xe4/0x2f0 mm/slub.c:3953 + hiddev_connect.cold+0x45/0x5c drivers/hid/usbhid/hiddev.c:914 + hid_connect+0x239/0xbb0 drivers/hid/hid-core.c:1882 + hid_hw_start drivers/hid/hid-core.c:1981 [inline] + hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:1972 + appleir_probe+0x13e/0x1a0 drivers/hid/hid-appleir.c:308 + hid_device_probe+0x2be/0x3f0 drivers/hid/hid-core.c:2209 + really_probe+0x281/0x650 drivers/base/dd.c:548 + driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:882 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2114 + hid_add_device+0x33c/0x990 drivers/hid/hid-core.c:2365 + usbhid_probe+0xa81/0xfa0 drivers/hid/usbhid/hid-core.c:1386 + usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361 + really_probe+0x281/0x650 drivers/base/dd.c:548 + driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:882 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2114 + usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023 + generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210 + usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266 + really_probe+0x281/0x650 drivers/base/dd.c:548 + driver_probe_device+0x101/0x1b0 drivers/base/dd.c:709 + __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:816 + bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454 + __device_attach+0x217/0x360 drivers/base/dd.c:882 + bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514 + device_add+0xae6/0x16f0 drivers/base/core.c:2114 + usb_new_device.cold+0x6a4/0xe79 drivers/usb/core/hub.c:2536 + hub_port_connect drivers/usb/core/hub.c:5098 [inline] + hub_port_connect_change drivers/usb/core/hub.c:5213 [inline] + port_event drivers/usb/core/hub.c:5359 [inline] + hub_event+0x1b5c/0x3640 drivers/usb/core/hub.c:5441 + process_one_work+0x92b/0x1530 kernel/workqueue.c:2269 + worker_thread+0x96/0xe20 kernel/workqueue.c:2415 + kthread+0x318/0x420 kernel/kthread.c:255 + ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 + +The buggy address belongs to the object at ffff8881cf591900 + which belongs to the cache kmalloc-512 of size 512 +The buggy address is located 264 bytes inside of + 512-byte region [ffff8881cf591900, ffff8881cf591b00) +The buggy address belongs to the page: +page:ffffea00073d6400 refcount:1 mapcount:0 mapping:ffff8881da002500 +index:0x0 compound_mapcount: 0 +flags: 0x200000000010200(slab|head) +raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da002500 +raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff8881cf591900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff8881cf591980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +> ffff8881cf591a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff8881cf591a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff8881cf591b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +================================================================== + +In order to avoid opening a disconnected device, we need to check exist +again after acquiring the existance lock, and bail out if necessary. + +Reported-by: syzbot +Cc: Andrey Konovalov +Signed-off-by: Hillf Danton +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hiddev.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -297,6 +297,14 @@ static int hiddev_open(struct inode *ino + spin_unlock_irq(&list->hiddev->list_lock); + + mutex_lock(&hiddev->existancelock); ++ /* ++ * recheck exist with existance lock held to ++ * avoid opening a disconnected device ++ */ ++ if (!list->hiddev->exist) { ++ res = -ENODEV; ++ goto bail_unlock; ++ } + if (!list->hiddev->open++) + if (list->hiddev->exist) { + struct hid_device *hid = hiddev->hid; diff --git a/queue-4.19/hid-hiddev-do-cleanup-in-failure-of-opening-a-device.patch b/queue-4.19/hid-hiddev-do-cleanup-in-failure-of-opening-a-device.patch new file mode 100644 index 00000000000..e26fe38f866 --- /dev/null +++ b/queue-4.19/hid-hiddev-do-cleanup-in-failure-of-opening-a-device.patch @@ -0,0 +1,34 @@ +From 6d4472d7bec39917b54e4e80245784ea5d60ce49 Mon Sep 17 00:00:00 2001 +From: Hillf Danton +Date: Tue, 6 Aug 2019 16:40:15 +0800 +Subject: HID: hiddev: do cleanup in failure of opening a device + +From: Hillf Danton + +commit 6d4472d7bec39917b54e4e80245784ea5d60ce49 upstream. + +Undo what we did for opening before releasing the memory slice. + +Reported-by: syzbot +Cc: Andrey Konovalov +Signed-off-by: Hillf Danton +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/usbhid/hiddev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -321,6 +321,10 @@ bail_normal_power: + hid_hw_power(hid, PM_HINT_NORMAL); + bail_unlock: + mutex_unlock(&hiddev->existancelock); ++ ++ spin_lock_irq(&list->hiddev->list_lock); ++ list_del(&list->node); ++ spin_unlock_irq(&list->hiddev->list_lock); + bail: + file->private_data = NULL; + vfree(list); diff --git a/queue-4.19/hid-holtek-test-for-sanity-of-intfdata.patch b/queue-4.19/hid-holtek-test-for-sanity-of-intfdata.patch new file mode 100644 index 00000000000..9a1a9adb9e6 --- /dev/null +++ b/queue-4.19/hid-holtek-test-for-sanity-of-intfdata.patch @@ -0,0 +1,42 @@ +From 01ec0a5f19c8c82960a07f6c7410fc9e01d7fb51 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 25 Jul 2019 15:13:33 +0200 +Subject: HID: holtek: test for sanity of intfdata + +From: Oliver Neukum + +commit 01ec0a5f19c8c82960a07f6c7410fc9e01d7fb51 upstream. + +The ioctl handler uses the intfdata of a second interface, +which may not be present in a broken or malicious device, hence +the intfdata needs to be checked for NULL. + +[jkosina@suse.cz: fix newly added spurious space] +Reported-by: syzbot+965152643a75a56737be@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-holtek-kbd.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-holtek-kbd.c ++++ b/drivers/hid/hid-holtek-kbd.c +@@ -126,9 +126,14 @@ static int holtek_kbd_input_event(struct + + /* Locate the boot interface, to receive the LED change events */ + struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0); ++ struct hid_device *boot_hid; ++ struct hid_input *boot_hid_input; + +- struct hid_device *boot_hid = usb_get_intfdata(boot_interface); +- struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs, ++ if (unlikely(boot_interface == NULL)) ++ return -ENODEV; ++ ++ boot_hid = usb_get_intfdata(boot_interface); ++ boot_hid_input = list_first_entry(&boot_hid->inputs, + struct hid_input, list); + + return boot_hid_input->input->event(boot_hid_input->input, type, code, diff --git a/queue-4.19/input-iforce-add-sanity-checks.patch b/queue-4.19/input-iforce-add-sanity-checks.patch new file mode 100644 index 00000000000..e424ddac4f2 --- /dev/null +++ b/queue-4.19/input-iforce-add-sanity-checks.patch @@ -0,0 +1,36 @@ +From 849f5ae3a513c550cad741c68dd3d7eb2bcc2a2c Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 6 Aug 2019 09:05:55 -0700 +Subject: Input: iforce - add sanity checks + +From: Oliver Neukum + +commit 849f5ae3a513c550cad741c68dd3d7eb2bcc2a2c upstream. + +The endpoint type should also be checked before a device +is accepted. + +Reported-by: syzbot+5efc10c005014d061a74@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joystick/iforce/iforce-usb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/input/joystick/iforce/iforce-usb.c ++++ b/drivers/input/joystick/iforce/iforce-usb.c +@@ -141,7 +141,12 @@ static int iforce_usb_probe(struct usb_i + return -ENODEV; + + epirq = &interface->endpoint[0].desc; ++ if (!usb_endpoint_is_int_in(epirq)) ++ return -ENODEV; ++ + epout = &interface->endpoint[1].desc; ++ if (!usb_endpoint_is_int_out(epout)) ++ return -ENODEV; + + if (!(iforce = kzalloc(sizeof(struct iforce) + 32, GFP_KERNEL))) + goto fail; diff --git a/queue-4.19/input-kbtab-sanity-check-for-endpoint-type.patch b/queue-4.19/input-kbtab-sanity-check-for-endpoint-type.patch new file mode 100644 index 00000000000..4071150534f --- /dev/null +++ b/queue-4.19/input-kbtab-sanity-check-for-endpoint-type.patch @@ -0,0 +1,43 @@ +From c88090dfc84254fa149174eb3e6a8458de1912c4 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 1 Aug 2019 09:44:25 -0700 +Subject: Input: kbtab - sanity check for endpoint type + +From: Oliver Neukum + +commit c88090dfc84254fa149174eb3e6a8458de1912c4 upstream. + +The driver should check whether the endpoint it uses has the correct +type. + +Reported-by: syzbot+c7df50363aaff50aa363@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/tablet/kbtab.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/input/tablet/kbtab.c ++++ b/drivers/input/tablet/kbtab.c +@@ -116,6 +116,10 @@ static int kbtab_probe(struct usb_interf + if (intf->cur_altsetting->desc.bNumEndpoints < 1) + return -ENODEV; + ++ endpoint = &intf->cur_altsetting->endpoint[0].desc; ++ if (!usb_endpoint_is_int_in(endpoint)) ++ return -ENODEV; ++ + kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL); + input_dev = input_allocate_device(); + if (!kbtab || !input_dev) +@@ -154,8 +158,6 @@ static int kbtab_probe(struct usb_interf + input_set_abs_params(input_dev, ABS_Y, 0, 0x1750, 4, 0); + input_set_abs_params(input_dev, ABS_PRESSURE, 0, 0xff, 0, 0); + +- endpoint = &intf->cur_altsetting->endpoint[0].desc; +- + usb_fill_int_urb(kbtab->irq, dev, + usb_rcvintpipe(dev, endpoint->bEndpointAddress), + kbtab->data, 8, diff --git a/queue-4.19/net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch b/queue-4.19/net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch new file mode 100644 index 00000000000..90e97cfc029 --- /dev/null +++ b/queue-4.19/net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch @@ -0,0 +1,32 @@ +From 224c04973db1125fcebefffd86115f99f50f8277 Mon Sep 17 00:00:00 2001 +From: Denis Kirjanov +Date: Tue, 30 Jul 2019 15:13:57 +0200 +Subject: net: usb: pegasus: fix improper read if get_registers() fail + +From: Denis Kirjanov + +commit 224c04973db1125fcebefffd86115f99f50f8277 upstream. + +get_registers() may fail with -ENOMEM and in this +case we can read a garbage from the status variable tmp. + +Reported-by: syzbot+3499a83b2d062ae409d4@syzkaller.appspotmail.com +Signed-off-by: Denis Kirjanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/pegasus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -285,7 +285,7 @@ static void mdio_write(struct net_device + static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata) + { + int i; +- __u8 tmp; ++ __u8 tmp = 0; + __le16 retdatai; + int ret; + diff --git a/queue-4.19/netfilter-ebtables-also-count-base-chain-policies.patch b/queue-4.19/netfilter-ebtables-also-count-base-chain-policies.patch new file mode 100644 index 00000000000..1aeaf7bb49e --- /dev/null +++ b/queue-4.19/netfilter-ebtables-also-count-base-chain-policies.patch @@ -0,0 +1,79 @@ +From 3b48300d5cc7c7bed63fddb006c4046549ed4aec Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Mon, 29 Jul 2019 17:58:10 +0200 +Subject: netfilter: ebtables: also count base chain policies + +From: Florian Westphal + +commit 3b48300d5cc7c7bed63fddb006c4046549ed4aec upstream. + +ebtables doesn't include the base chain policies in the rule count, +so we need to add them manually when we call into the x_tables core +to allocate space for the comapt offset table. + +This lead syzbot to trigger: +WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649 +xt_compat_add_offset.cold+0x11/0x36 net/netfilter/x_tables.c:649 + +Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com +Fixes: 2035f3ff8eaa ("netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/bridge/netfilter/ebtables.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1779,20 +1779,28 @@ static int compat_calc_entry(const struc + return 0; + } + ++static int ebt_compat_init_offsets(unsigned int number) ++{ ++ if (number > INT_MAX) ++ return -EINVAL; ++ ++ /* also count the base chain policies */ ++ number += NF_BR_NUMHOOKS; ++ ++ return xt_compat_init_offsets(NFPROTO_BRIDGE, number); ++} + + static int compat_table_info(const struct ebt_table_info *info, + struct compat_ebt_replace *newinfo) + { + unsigned int size = info->entries_size; + const void *entries = info->entries; ++ int ret; + + newinfo->entries_size = size; +- if (info->nentries) { +- int ret = xt_compat_init_offsets(NFPROTO_BRIDGE, +- info->nentries); +- if (ret) +- return ret; +- } ++ ret = ebt_compat_init_offsets(info->nentries); ++ if (ret) ++ return ret; + + return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info, + entries, newinfo); +@@ -2241,11 +2249,9 @@ static int compat_do_replace(struct net + + xt_compat_lock(NFPROTO_BRIDGE); + +- if (tmp.nentries) { +- ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); +- if (ret < 0) +- goto out_unlock; +- } ++ ret = ebt_compat_init_offsets(tmp.nentries); ++ if (ret < 0) ++ goto out_unlock; + + ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); + if (ret < 0) diff --git a/queue-4.19/series b/queue-4.19/series index c1a7d0f818d..bd4b463b185 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -15,3 +15,10 @@ alsa-hda-apply-workaround-for-another-amd-chip-1022-1487.patch alsa-hda-fix-a-memory-leak-bug.patch alsa-hda-add-a-generic-reboot_notify.patch alsa-hda-let-all-conexant-codec-enter-d3-when-rebooting.patch +hid-holtek-test-for-sanity-of-intfdata.patch +hid-hiddev-avoid-opening-a-disconnected-device.patch +hid-hiddev-do-cleanup-in-failure-of-opening-a-device.patch +input-kbtab-sanity-check-for-endpoint-type.patch +input-iforce-add-sanity-checks.patch +net-usb-pegasus-fix-improper-read-if-get_registers-fail.patch +netfilter-ebtables-also-count-base-chain-policies.patch