From: Greg Kroah-Hartman Date: Fri, 2 Sep 2022 07:48:27 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.9.327~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e7c59c686a8d505ff9ec7889c55c87c59f557d80;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: android-binder-fix-lockdep-check-on-clearing-vma.patch net-af_packet-check-len-when-min_header_len-equals-to-0.patch --- diff --git a/queue-5.15/android-binder-fix-lockdep-check-on-clearing-vma.patch b/queue-5.15/android-binder-fix-lockdep-check-on-clearing-vma.patch new file mode 100644 index 00000000000..94c66ed6ba5 --- /dev/null +++ b/queue-5.15/android-binder-fix-lockdep-check-on-clearing-vma.patch @@ -0,0 +1,60 @@ +From b0cab80ecd54ae3b2356bb081af0bffd538c8265 Mon Sep 17 00:00:00 2001 +From: Liam Howlett +Date: Mon, 27 Jun 2022 15:18:59 +0000 +Subject: android: binder: fix lockdep check on clearing vma +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Liam Howlett + +commit b0cab80ecd54ae3b2356bb081af0bffd538c8265 upstream. + +When munmapping a vma, the mmap_lock can be degraded to a write before +calling close() on the file handle. The binder close() function calls +binder_alloc_set_vma() to clear the vma address, which now has a lock dep +check for writing on the mmap_lock. Change the lockdep check to ensure +the reading lock is held while clearing and keep the write check while +writing. + +Link: https://lkml.kernel.org/r/20220627151857.2316964-1-Liam.Howlett@oracle.com +Fixes: 472a68df605b ("android: binder: stop saving a pointer to the VMA") +Signed-off-by: Liam R. Howlett +Reported-by: syzbot+da54fa8d793ca89c741f@syzkaller.appspotmail.com +Acked-by: Todd Kjos +Cc: "Arve Hjønnevåg" +Cc: Christian Brauner (Microsoft) +Cc: Greg Kroah-Hartman +Cc: Hridya Valsaraju +Cc: Joel Fernandes +Cc: Martijn Coenen +Cc: Suren Baghdasaryan +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + drivers/android/binder_alloc.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/android/binder_alloc.c ++++ b/drivers/android/binder_alloc.c +@@ -315,12 +315,19 @@ static inline void binder_alloc_set_vma( + { + unsigned long vm_start = 0; + ++ /* ++ * Allow clearing the vma with holding just the read lock to allow ++ * munmapping downgrade of the write lock before freeing and closing the ++ * file using binder_alloc_vma_close(). ++ */ + if (vma) { + vm_start = vma->vm_start; + alloc->vma_vm_mm = vma->vm_mm; ++ mmap_assert_write_locked(alloc->vma_vm_mm); ++ } else { ++ mmap_assert_locked(alloc->vma_vm_mm); + } + +- mmap_assert_write_locked(alloc->vma_vm_mm); + alloc->vma_addr = vm_start; + } + diff --git a/queue-5.15/net-af_packet-check-len-when-min_header_len-equals-to-0.patch b/queue-5.15/net-af_packet-check-len-when-min_header_len-equals-to-0.patch new file mode 100644 index 00000000000..8e82cb069a6 --- /dev/null +++ b/queue-5.15/net-af_packet-check-len-when-min_header_len-equals-to-0.patch @@ -0,0 +1,35 @@ +From dc633700f00f726e027846a318c5ffeb8deaaeda Mon Sep 17 00:00:00 2001 +From: Zhengchao Shao +Date: Wed, 27 Jul 2022 17:33:12 +0800 +Subject: net/af_packet: check len when min_header_len equals to 0 + +From: Zhengchao Shao + +commit dc633700f00f726e027846a318c5ffeb8deaaeda upstream. + +User can use AF_PACKET socket to send packets with the length of 0. +When min_header_len equals to 0, packet_snd will call __dev_queue_xmit +to send packets, and sock->type can be any type. + +Reported-by: syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com +Fixes: fd1894224407 ("bpf: Don't redirect packets with invalid pkt_len") +Signed-off-by: Zhengchao Shao +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2989,8 +2989,8 @@ static int packet_snd(struct socket *soc + if (err) + goto out_free; + +- if (sock->type == SOCK_RAW && +- !dev_validate_header(dev, skb->data, len)) { ++ if ((sock->type == SOCK_RAW && ++ !dev_validate_header(dev, skb->data, len)) || !skb->len) { + err = -EINVAL; + goto out_free; + } diff --git a/queue-5.15/series b/queue-5.15/series index 278dc4f1ff1..af067dd099e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -68,3 +68,5 @@ btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch btrfs-tree-checker-check-for-overlapping-extent-item.patch kprobes-don-t-call-disarm_kprobe-for-disabled-kprobes.patch btrfs-fix-space-cache-corruption-and-potential-double-allocations.patch +android-binder-fix-lockdep-check-on-clearing-vma.patch +net-af_packet-check-len-when-min_header_len-equals-to-0.patch