From 87d29d4963823553d208f21c245474a452216348 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 13 Jun 2024 09:42:04 +0200 Subject: [PATCH] 5.15-stable patches added patches: net-9p-fix-uninit-value-in-p9_client_rpc.patch net-ipv6-fix-route-deleting-failure-when-metric-equals-0.patch --- ...9p-fix-uninit-value-in-p9_client_rpc.patch | 90 +++++++++++++++++++ ...eleting-failure-when-metric-equals-0.patch | 81 +++++++++++++++++ queue-5.15/series | 2 + 3 files changed, 173 insertions(+) create mode 100644 queue-5.15/net-9p-fix-uninit-value-in-p9_client_rpc.patch create mode 100644 queue-5.15/net-ipv6-fix-route-deleting-failure-when-metric-equals-0.patch diff --git a/queue-5.15/net-9p-fix-uninit-value-in-p9_client_rpc.patch b/queue-5.15/net-9p-fix-uninit-value-in-p9_client_rpc.patch new file mode 100644 index 00000000000..fa143dcf551 --- /dev/null +++ b/queue-5.15/net-9p-fix-uninit-value-in-p9_client_rpc.patch @@ -0,0 +1,90 @@ +From 25460d6f39024cc3b8241b14c7ccf0d6f11a736a Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Mon, 8 Apr 2024 07:10:39 -0700 +Subject: net/9p: fix uninit-value in p9_client_rpc() + +From: Nikita Zhandarovich + +commit 25460d6f39024cc3b8241b14c7ccf0d6f11a736a upstream. + +Syzbot with the help of KMSAN reported the following error: + +BUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline] +BUG: KMSAN: uninit-value in p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 + trace_9p_client_res include/trace/events/9p.h:146 [inline] + p9_client_rpc+0x1314/0x1340 net/9p/client.c:754 + p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 + v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410 + v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122 + legacy_get_tree+0x114/0x290 fs/fs_context.c:662 + vfs_get_tree+0xa7/0x570 fs/super.c:1797 + do_new_mount+0x71f/0x15e0 fs/namespace.c:3352 + path_mount+0x742/0x1f20 fs/namespace.c:3679 + do_mount fs/namespace.c:3692 [inline] + __do_sys_mount fs/namespace.c:3898 [inline] + __se_sys_mount+0x725/0x810 fs/namespace.c:3875 + __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875 + do_syscall_64+0xd5/0x1f0 + entry_SYSCALL_64_after_hwframe+0x6d/0x75 + +Uninit was created at: + __alloc_pages+0x9d6/0xe70 mm/page_alloc.c:4598 + __alloc_pages_node include/linux/gfp.h:238 [inline] + alloc_pages_node include/linux/gfp.h:261 [inline] + alloc_slab_page mm/slub.c:2175 [inline] + allocate_slab mm/slub.c:2338 [inline] + new_slab+0x2de/0x1400 mm/slub.c:2391 + ___slab_alloc+0x1184/0x33d0 mm/slub.c:3525 + __slab_alloc mm/slub.c:3610 [inline] + __slab_alloc_node mm/slub.c:3663 [inline] + slab_alloc_node mm/slub.c:3835 [inline] + kmem_cache_alloc+0x6d3/0xbe0 mm/slub.c:3852 + p9_tag_alloc net/9p/client.c:278 [inline] + p9_client_prepare_req+0x20a/0x1770 net/9p/client.c:641 + p9_client_rpc+0x27e/0x1340 net/9p/client.c:688 + p9_client_create+0x1551/0x1ff0 net/9p/client.c:1031 + v9fs_session_init+0x1b9/0x28e0 fs/9p/v9fs.c:410 + v9fs_mount+0xe2/0x12b0 fs/9p/vfs_super.c:122 + legacy_get_tree+0x114/0x290 fs/fs_context.c:662 + vfs_get_tree+0xa7/0x570 fs/super.c:1797 + do_new_mount+0x71f/0x15e0 fs/namespace.c:3352 + path_mount+0x742/0x1f20 fs/namespace.c:3679 + do_mount fs/namespace.c:3692 [inline] + __do_sys_mount fs/namespace.c:3898 [inline] + __se_sys_mount+0x725/0x810 fs/namespace.c:3875 + __x64_sys_mount+0xe4/0x150 fs/namespace.c:3875 + do_syscall_64+0xd5/0x1f0 + entry_SYSCALL_64_after_hwframe+0x6d/0x75 + +If p9_check_errors() fails early in p9_client_rpc(), req->rc.tag +will not be properly initialized. However, trace_9p_client_res() +ends up trying to print it out anyway before p9_client_rpc() +finishes. + +Fix this issue by assigning default values to p9_fcall fields +such as 'tag' and (just in case KMSAN unearths something new) 'id' +during the tag allocation stage. + +Reported-and-tested-by: syzbot+ff14db38f56329ef68df@syzkaller.appspotmail.com +Fixes: 348b59012e5c ("net/9p: Convert net/9p protocol dumps to tracepoints") +Signed-off-by: Nikita Zhandarovich +Reviewed-by: Christian Schoenebeck +Cc: stable@vger.kernel.org +Message-ID: <20240408141039.30428-1-n.zhandarovich@fintech.ru> +Signed-off-by: Dominique Martinet +Signed-off-by: Greg Kroah-Hartman +--- + net/9p/client.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -233,6 +233,8 @@ static int p9_fcall_init(struct p9_clien + if (!fc->sdata) + return -ENOMEM; + fc->capacity = alloc_msize; ++ fc->id = 0; ++ fc->tag = P9_NOTAG; + return 0; + } + diff --git a/queue-5.15/net-ipv6-fix-route-deleting-failure-when-metric-equals-0.patch b/queue-5.15/net-ipv6-fix-route-deleting-failure-when-metric-equals-0.patch new file mode 100644 index 00000000000..40ad1762030 --- /dev/null +++ b/queue-5.15/net-ipv6-fix-route-deleting-failure-when-metric-equals-0.patch @@ -0,0 +1,81 @@ +From bb487272380d120295e955ad8acfcbb281b57642 Mon Sep 17 00:00:00 2001 +From: xu xin +Date: Tue, 14 May 2024 20:11:02 +0800 +Subject: net/ipv6: Fix route deleting failure when metric equals 0 + +From: xu xin + +commit bb487272380d120295e955ad8acfcbb281b57642 upstream. + +Problem +========= +After commit 67f695134703 ("ipv6: Move setting default metric for routes"), +we noticed that the logic of assigning the default value of fc_metirc +changed in the ioctl process. That is, when users use ioctl(fd, SIOCADDRT, +rt) with a non-zero metric to add a route, then they may fail to delete a +route with passing in a metric value of 0 to the kernel by ioctl(fd, +SIOCDELRT, rt). But iproute can succeed in deleting it. + +As a reference, when using iproute tools by netlink to delete routes with +a metric parameter equals 0, like the command as follows: + + ip -6 route del fe80::/64 via fe81::5054:ff:fe11:3451 dev eth0 metric 0 + +the user can still succeed in deleting the route entry with the smallest +metric. + +Root Reason +=========== +After commit 67f695134703 ("ipv6: Move setting default metric for routes"), +When ioctl() pass in SIOCDELRT with a zero metric, rtmsg_to_fib6_config() +will set a defalut value (1024) to cfg->fc_metric in kernel, and in +ip6_route_del() and the line 4074 at net/ipv3/route.c, it will check by + + if (cfg->fc_metric && cfg->fc_metric != rt->fib6_metric) + continue; + +and the condition is true and skip the later procedure (deleting route) +because cfg->fc_metric != rt->fib6_metric. But before that commit, +cfg->fc_metric is still zero there, so the condition is false and it +will do the following procedure (deleting). + +Solution +======== +In order to keep a consistent behaviour across netlink() and ioctl(), we +should allow to delete a route with a metric value of 0. So we only do +the default setting of fc_metric in route adding. + +CC: stable@vger.kernel.org # 5.4+ +Fixes: 67f695134703 ("ipv6: Move setting default metric for routes") +Co-developed-by: Fan Yu +Signed-off-by: Fan Yu +Signed-off-by: xu xin +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20240514201102055dD2Ba45qKbLlUMxu_DTHP@zte.com.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/route.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -4456,7 +4456,7 @@ static void rtmsg_to_fib6_config(struct + .fc_table = l3mdev_fib_table_by_index(net, rtmsg->rtmsg_ifindex) ? + : RT6_TABLE_MAIN, + .fc_ifindex = rtmsg->rtmsg_ifindex, +- .fc_metric = rtmsg->rtmsg_metric ? : IP6_RT_PRIO_USER, ++ .fc_metric = rtmsg->rtmsg_metric, + .fc_expires = rtmsg->rtmsg_info, + .fc_dst_len = rtmsg->rtmsg_dst_len, + .fc_src_len = rtmsg->rtmsg_src_len, +@@ -4486,6 +4486,9 @@ int ipv6_route_ioctl(struct net *net, un + rtnl_lock(); + switch (cmd) { + case SIOCADDRT: ++ /* Only do the default setting of fc_metric in route adding */ ++ if (cfg.fc_metric == 0) ++ cfg.fc_metric = IP6_RT_PRIO_USER; + err = ip6_route_add(&cfg, GFP_KERNEL, NULL); + break; + case SIOCDELRT: diff --git a/queue-5.15/series b/queue-5.15/series index 02ffff13b7e..2fb49d11726 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -378,3 +378,5 @@ kvm-arm64-allow-aarch32-pstate.m-to-be-restored-as-system-mode.patch crypto-ecdsa-fix-module-auto-load-on-add-key.patch crypto-ecrdsa-fix-module-auto-load-on-add_key.patch crypto-qat-fix-adf_dev_reset_sync-memory-leak.patch +net-ipv6-fix-route-deleting-failure-when-metric-equals-0.patch +net-9p-fix-uninit-value-in-p9_client_rpc.patch -- 2.47.3