From: Greg Kroah-Hartman Date: Tue, 28 Mar 2023 12:35:27 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.15.105~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=efe785b5d7898d06da62bd783a13c67822d2cb84;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch wifi-mac80211-fix-qos-on-mesh-interfaces.patch --- diff --git a/queue-5.10/nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch b/queue-5.10/nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch new file mode 100644 index 00000000000..fc8450d3467 --- /dev/null +++ b/queue-5.10/nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch @@ -0,0 +1,86 @@ +From 003587000276f81d0114b5ce773d80c119d8cb30 Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Tue, 7 Mar 2023 17:55:48 +0900 +Subject: nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() + +From: Ryusuke Konishi + +commit 003587000276f81d0114b5ce773d80c119d8cb30 upstream. + +The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a +metadata array to/from user space, may copy uninitialized buffer regions +to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO +and NILFS_IOCTL_GET_CPINFO. + +This can occur when the element size of the user space metadata given by +the v_size member of the argument nilfs_argv structure is larger than the +size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo +structure) on the file system side. + +KMSAN-enabled kernels detect this issue as follows: + + BUG: KMSAN: kernel-infoleak in instrument_copy_to_user + include/linux/instrumented.h:121 [inline] + BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33 + instrument_copy_to_user include/linux/instrumented.h:121 [inline] + _copy_to_user+0xc0/0x100 lib/usercopy.c:33 + copy_to_user include/linux/uaccess.h:169 [inline] + nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99 + nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] + nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 + nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 + __do_compat_sys_ioctl fs/ioctl.c:968 [inline] + __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 + __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 + do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] + __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 + do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 + do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 + entry_SYSENTER_compat_after_hwframe+0x70/0x82 + + Uninit was created at: + __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572 + alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287 + __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599 + nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74 + nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] + nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 + nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 + __do_compat_sys_ioctl fs/ioctl.c:968 [inline] + __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 + __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 + do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] + __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 + do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 + do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 + entry_SYSENTER_compat_after_hwframe+0x70/0x82 + + Bytes 16-127 of 3968 are uninitialized + ... + +This eliminates the leak issue by initializing the page allocated as +buffer using get_zeroed_page(). + +Link: https://lkml.kernel.org/r/20230307085548.6290-1-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+132fdd2f1e1805fdc591@syzkaller.appspotmail.com + Link: https://lkml.kernel.org/r/000000000000a5bd2d05f63f04ae@google.com +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nilfs2/ioctl.c ++++ b/fs/nilfs2/ioctl.c +@@ -70,7 +70,7 @@ static int nilfs_ioctl_wrap_copy(struct + if (argv->v_index > ~(__u64)0 - argv->v_nmembs) + return -EINVAL; + +- buf = (void *)__get_free_pages(GFP_NOFS, 0); ++ buf = (void *)get_zeroed_page(GFP_NOFS); + if (unlikely(!buf)) + return -ENOMEM; + maxmembs = PAGE_SIZE / argv->v_size; diff --git a/queue-5.10/series b/queue-5.10/series index d0075e4cc85..c348226c92f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -85,3 +85,5 @@ usb-cdns3-fix-issue-with-using-incorrect-pci-device-function.patch usb-chipdea-core-fix-return-einval-if-request-role-is-the-same-with-current-role.patch usb-chipidea-core-fix-possible-concurrent-when-switch-role.patch usb-ucsi-fix-null-pointer-deref-in-ucsi_connector_change.patch +wifi-mac80211-fix-qos-on-mesh-interfaces.patch +nilfs2-fix-kernel-infoleak-in-nilfs_ioctl_wrap_copy.patch diff --git a/queue-5.10/wifi-mac80211-fix-qos-on-mesh-interfaces.patch b/queue-5.10/wifi-mac80211-fix-qos-on-mesh-interfaces.patch new file mode 100644 index 00000000000..162793e4c53 --- /dev/null +++ b/queue-5.10/wifi-mac80211-fix-qos-on-mesh-interfaces.patch @@ -0,0 +1,43 @@ +From 4e348c6c6e23491ae6eb5e077848a42d0562339c Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 14 Mar 2023 10:59:50 +0100 +Subject: wifi: mac80211: fix qos on mesh interfaces + +From: Felix Fietkau + +commit 4e348c6c6e23491ae6eb5e077848a42d0562339c upstream. + +When ieee80211_select_queue is called for mesh, the sta pointer is usually +NULL, since the nexthop is looked up much later in the tx path. +Explicitly check for unicast address in that case in order to make qos work +again. + +Cc: stable@vger.kernel.org +Fixes: 50e2ab392919 ("wifi: mac80211: fix queue selection for mesh/OCB interfaces") +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20230314095956.62085-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/wme.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/mac80211/wme.c ++++ b/net/mac80211/wme.c +@@ -141,12 +141,14 @@ u16 ieee80211_select_queue_80211(struct + u16 __ieee80211_select_queue(struct ieee80211_sub_if_data *sdata, + struct sta_info *sta, struct sk_buff *skb) + { ++ const struct ethhdr *eth = (void *)skb->data; + struct mac80211_qos_map *qos_map; + bool qos; + + /* all mesh/ocb stations are required to support WME */ +- if (sta && (sdata->vif.type == NL80211_IFTYPE_MESH_POINT || +- sdata->vif.type == NL80211_IFTYPE_OCB)) ++ if ((sdata->vif.type == NL80211_IFTYPE_MESH_POINT && ++ !is_multicast_ether_addr(eth->h_dest)) || ++ (sdata->vif.type == NL80211_IFTYPE_OCB && sta)) + qos = true; + else if (sta) + qos = sta->sta.wme;