From 12fc96b0985402f0268504e9b36e0e8aeadf4d3e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 12 Apr 2021 09:31:36 +0200 Subject: [PATCH] 4.14-stable patches added patches: cfg80211-remove-warn_on-in-cfg80211_sme_connect.patch net-tun-set-tun-dev-addr_len-during-tunsetlink-processing.patch --- ...move-warn_on-in-cfg80211_sme_connect.patch | 36 +++++++ ...ddr_len-during-tunsetlink-processing.patch | 96 +++++++++++++++++++ queue-4.14/series | 2 + 3 files changed, 134 insertions(+) create mode 100644 queue-4.14/cfg80211-remove-warn_on-in-cfg80211_sme_connect.patch create mode 100644 queue-4.14/net-tun-set-tun-dev-addr_len-during-tunsetlink-processing.patch diff --git a/queue-4.14/cfg80211-remove-warn_on-in-cfg80211_sme_connect.patch b/queue-4.14/cfg80211-remove-warn_on-in-cfg80211_sme_connect.patch new file mode 100644 index 00000000000..b6b7034c933 --- /dev/null +++ b/queue-4.14/cfg80211-remove-warn_on-in-cfg80211_sme_connect.patch @@ -0,0 +1,36 @@ +From 1b5ab825d9acc0f27d2f25c6252f3526832a9626 Mon Sep 17 00:00:00 2001 +From: Du Cheng +Date: Thu, 8 Apr 2021 00:27:56 +0800 +Subject: cfg80211: remove WARN_ON() in cfg80211_sme_connect + +From: Du Cheng + +commit 1b5ab825d9acc0f27d2f25c6252f3526832a9626 upstream. + +A WARN_ON(wdev->conn) would trigger in cfg80211_sme_connect(), if multiple +send_msg(NL80211_CMD_CONNECT) system calls are made from the userland, which +should be anticipated and handled by the wireless driver. Remove this WARN_ON() +to prevent kernel panic if kernel is configured to "panic_on_warn". + +Bug reported by syzbot. + +Reported-by: syzbot+5f9392825de654244975@syzkaller.appspotmail.com +Signed-off-by: Du Cheng +Link: https://lore.kernel.org/r/20210407162756.6101-1-ducheng2@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/sme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -530,7 +530,7 @@ static int cfg80211_sme_connect(struct w + cfg80211_sme_free(wdev); + } + +- if (WARN_ON(wdev->conn)) ++ if (wdev->conn) + return -EINPROGRESS; + + wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL); diff --git a/queue-4.14/net-tun-set-tun-dev-addr_len-during-tunsetlink-processing.patch b/queue-4.14/net-tun-set-tun-dev-addr_len-during-tunsetlink-processing.patch new file mode 100644 index 00000000000..ca38ce7e0e1 --- /dev/null +++ b/queue-4.14/net-tun-set-tun-dev-addr_len-during-tunsetlink-processing.patch @@ -0,0 +1,96 @@ +From cca8ea3b05c972ffb5295367e6c544369b45fbdd Mon Sep 17 00:00:00 2001 +From: Phillip Potter +Date: Tue, 6 Apr 2021 18:45:54 +0100 +Subject: net: tun: set tun->dev->addr_len during TUNSETLINK processing + +From: Phillip Potter + +commit cca8ea3b05c972ffb5295367e6c544369b45fbdd upstream. + +When changing type with TUNSETLINK ioctl command, set tun->dev->addr_len +to match the appropriate type, using new tun_get_addr_len utility function +which returns appropriate address length for given type. Fixes a +KMSAN-found uninit-value bug reported by syzbot at: +https://syzkaller.appspot.com/bug?id=0766d38c656abeace60621896d705743aeefed51 + +Reported-by: syzbot+001516d86dbe88862cec@syzkaller.appspotmail.com +Diagnosed-by: Eric Dumazet +Signed-off-by: Phillip Potter +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 48 insertions(+) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -75,6 +75,14 @@ + #include + #include + #include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include + + #include + +@@ -2292,6 +2300,45 @@ unlock: + return ret; + } + ++/* Return correct value for tun->dev->addr_len based on tun->dev->type. */ ++static unsigned char tun_get_addr_len(unsigned short type) ++{ ++ switch (type) { ++ case ARPHRD_IP6GRE: ++ case ARPHRD_TUNNEL6: ++ return sizeof(struct in6_addr); ++ case ARPHRD_IPGRE: ++ case ARPHRD_TUNNEL: ++ case ARPHRD_SIT: ++ return 4; ++ case ARPHRD_ETHER: ++ return ETH_ALEN; ++ case ARPHRD_IEEE802154: ++ case ARPHRD_IEEE802154_MONITOR: ++ return IEEE802154_EXTENDED_ADDR_LEN; ++ case ARPHRD_PHONET_PIPE: ++ case ARPHRD_PPP: ++ case ARPHRD_NONE: ++ return 0; ++ case ARPHRD_6LOWPAN: ++ return EUI64_ADDR_LEN; ++ case ARPHRD_FDDI: ++ return FDDI_K_ALEN; ++ case ARPHRD_HIPPI: ++ return HIPPI_ALEN; ++ case ARPHRD_IEEE802: ++ return FC_ALEN; ++ case ARPHRD_ROSE: ++ return ROSE_ADDR_LEN; ++ case ARPHRD_NETROM: ++ return AX25_ADDR_LEN; ++ case ARPHRD_LOCALTLK: ++ return LTALK_ALEN; ++ default: ++ return 0; ++ } ++} ++ + static long __tun_chr_ioctl(struct file *file, unsigned int cmd, + unsigned long arg, int ifreq_len) + { +@@ -2434,6 +2481,7 @@ static long __tun_chr_ioctl(struct file + ret = -EBUSY; + } else { + tun->dev->type = (int) arg; ++ tun->dev->addr_len = tun_get_addr_len(tun->dev->type); + tun_debug(KERN_INFO, tun, "linktype set to %d\n", + tun->dev->type); + ret = 0; diff --git a/queue-4.14/series b/queue-4.14/series index af26c6c5dee..fd85d9325fc 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -43,3 +43,5 @@ net-ncsi-add-generic-netlink-family.patch net-ncsi-refactor-mac-vlan-filters.patch net-ncsi-avoid-gfp_kernel-in-response-handler.patch usbip-fix-vudc-usbip_sockfd_store-races-leading-to-gpf.patch +cfg80211-remove-warn_on-in-cfg80211_sme_connect.patch +net-tun-set-tun-dev-addr_len-during-tunsetlink-processing.patch -- 2.47.3