From 98baa3cd6ae2d5761233db539d0ae9828e40b501 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 24 Mar 2022 13:56:37 +0100 Subject: [PATCH] 5.15-stable patches added patches: net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch --- ...-skb_over_panic-in-__ip6_append_data.patch | 47 ++++++++++++++++++ ...-buffer-overflows-in-evt_transaction.patch | 48 +++++++++++++++++++ queue-5.15/series | 2 + 3 files changed, 97 insertions(+) create mode 100644 queue-5.15/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch create mode 100644 queue-5.15/nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch create mode 100644 queue-5.15/series diff --git a/queue-5.15/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch b/queue-5.15/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch new file mode 100644 index 00000000000..81185604b79 --- /dev/null +++ b/queue-5.15/net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch @@ -0,0 +1,47 @@ +From 5e34af4142ffe68f01c8a9acae83300f8911e20c Mon Sep 17 00:00:00 2001 +From: Tadeusz Struk +Date: Thu, 10 Mar 2022 15:25:38 -0800 +Subject: net: ipv6: fix skb_over_panic in __ip6_append_data + +From: Tadeusz Struk + +commit 5e34af4142ffe68f01c8a9acae83300f8911e20c upstream. + +Syzbot found a kernel bug in the ipv6 stack: +LINK: https://syzkaller.appspot.com/bug?id=205d6f11d72329ab8d62a610c44c5e7e25415580 +The reproducer triggers it by sending a crafted message via sendmmsg() +call, which triggers skb_over_panic, and crashes the kernel: + +skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575 +head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0 +dev: + +Update the check that prevents an invalid packet with MTU equal +to the fregment header size to eat up all the space for payload. + +The reproducer can be found here: +LINK: https://syzkaller.appspot.com/text?tag=ReproC&x=1648c83fb00000 + +Reported-by: syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com +Signed-off-by: Tadeusz Struk +Acked-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20220310232538.1044947-1-tadeusz.struk@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_output.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1476,8 +1476,8 @@ static int __ip6_append_data(struct sock + sizeof(struct frag_hdr) : 0) + + rt->rt6i_nfheader_len; + +- if (mtu < fragheaderlen || +- ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr)) ++ if (mtu <= fragheaderlen || ++ ((mtu - fragheaderlen) & ~7) + fragheaderlen <= sizeof(struct frag_hdr)) + goto emsgsize; + + maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - diff --git a/queue-5.15/nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch b/queue-5.15/nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch new file mode 100644 index 00000000000..0eb7dfc1026 --- /dev/null +++ b/queue-5.15/nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch @@ -0,0 +1,48 @@ +From 4fbcc1a4cb20fe26ad0225679c536c80f1648221 Mon Sep 17 00:00:00 2001 +From: Jordy Zomer +Date: Tue, 11 Jan 2022 17:44:51 +0100 +Subject: nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION + +From: Jordy Zomer + +commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 upstream. + +It appears that there are some buffer overflows in EVT_TRANSACTION. +This happens because the length parameters that are passed to memcpy +come directly from skb->data and are not guarded in any way. + +Signed-off-by: Jordy Zomer +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Denis Efremov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/st21nfca/se.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/nfc/st21nfca/se.c ++++ b/drivers/nfc/st21nfca/se.c +@@ -320,6 +320,11 @@ int st21nfca_connectivity_event_received + return -ENOMEM; + + transaction->aid_len = skb->data[1]; ++ ++ /* Checking if the length of the AID is valid */ ++ if (transaction->aid_len > sizeof(transaction->aid)) ++ return -EINVAL; ++ + memcpy(transaction->aid, &skb->data[2], + transaction->aid_len); + +@@ -329,6 +334,11 @@ int st21nfca_connectivity_event_received + return -EPROTO; + + transaction->params_len = skb->data[transaction->aid_len + 3]; ++ ++ /* Total size is allocated (skb->len - 2) minus fixed array members */ ++ if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) ++ return -EINVAL; ++ + memcpy(transaction->params, skb->data + + transaction->aid_len + 4, transaction->params_len); + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..4d0b0d0004e --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,2 @@ +nfc-st21nfca-fix-potential-buffer-overflows-in-evt_transaction.patch +net-ipv6-fix-skb_over_panic-in-__ip6_append_data.patch -- 2.47.3