From cabf30d446117d34dd39550130d5984766bb090c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 17 Dec 2019 20:26:47 +0100 Subject: [PATCH] drop queue-5.3/net_sched-validate-tca_kind-attribute-in-tc_chain_tmplt_add.patch --- ...kind-attribute-in-tc_chain_tmplt_add.patch | 114 ------------------ queue-5.3/series | 1 - 2 files changed, 115 deletions(-) delete mode 100644 queue-5.3/net_sched-validate-tca_kind-attribute-in-tc_chain_tmplt_add.patch diff --git a/queue-5.3/net_sched-validate-tca_kind-attribute-in-tc_chain_tmplt_add.patch b/queue-5.3/net_sched-validate-tca_kind-attribute-in-tc_chain_tmplt_add.patch deleted file mode 100644 index 3e2739b3be6..00000000000 --- a/queue-5.3/net_sched-validate-tca_kind-attribute-in-tc_chain_tmplt_add.patch +++ /dev/null @@ -1,114 +0,0 @@ -From foo@baz Tue 17 Dec 2019 08:14:58 PM CET -From: Eric Dumazet -Date: Sat, 7 Dec 2019 11:34:45 -0800 -Subject: net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add() - -From: Eric Dumazet - -[ Upstream commit 2dd5616ecdcebdf5a8d007af64e040d4e9214efe ] - -Use the new tcf_proto_check_kind() helper to make sure user -provided value is well formed. - -BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:606 [inline] -BUG: KMSAN: uninit-value in string+0x4be/0x600 lib/vsprintf.c:668 -CPU: 0 PID: 12358 Comm: syz-executor.1 Not tainted 5.4.0-rc8-syzkaller #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 -Call Trace: - __dump_stack lib/dump_stack.c:77 [inline] - dump_stack+0x1c9/0x220 lib/dump_stack.c:118 - kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 - __msan_warning+0x64/0xc0 mm/kmsan/kmsan_instr.c:245 - string_nocheck lib/vsprintf.c:606 [inline] - string+0x4be/0x600 lib/vsprintf.c:668 - vsnprintf+0x218f/0x3210 lib/vsprintf.c:2510 - __request_module+0x2b1/0x11c0 kernel/kmod.c:143 - tcf_proto_lookup_ops+0x171/0x700 net/sched/cls_api.c:139 - tc_chain_tmplt_add net/sched/cls_api.c:2730 [inline] - tc_ctl_chain+0x1904/0x38a0 net/sched/cls_api.c:2850 - rtnetlink_rcv_msg+0x115a/0x1580 net/core/rtnetlink.c:5224 - netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2477 - rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5242 - netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] - netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1328 - netlink_sendmsg+0x110f/0x1330 net/netlink/af_netlink.c:1917 - sock_sendmsg_nosec net/socket.c:637 [inline] - sock_sendmsg net/socket.c:657 [inline] - ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311 - __sys_sendmsg net/socket.c:2356 [inline] - __do_sys_sendmsg net/socket.c:2365 [inline] - __se_sys_sendmsg+0x305/0x460 net/socket.c:2363 - __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363 - do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 - entry_SYSCALL_64_after_hwframe+0x44/0xa9 -RIP: 0033:0x45a649 -Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 -RSP: 002b:00007f0790795c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e -RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a649 -RDX: 0000000000000000 RSI: 0000000020000300 RDI: 0000000000000006 -RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 -R10: 0000000000000000 R11: 0000000000000246 R12: 00007f07907966d4 -R13: 00000000004c8db5 R14: 00000000004df630 R15: 00000000ffffffff - -Uninit was created at: - kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline] - kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132 - kmsan_slab_alloc+0x97/0x100 mm/kmsan/kmsan_hooks.c:86 - slab_alloc_node mm/slub.c:2773 [inline] - __kmalloc_node_track_caller+0xe27/0x11a0 mm/slub.c:4381 - __kmalloc_reserve net/core/skbuff.c:141 [inline] - __alloc_skb+0x306/0xa10 net/core/skbuff.c:209 - alloc_skb include/linux/skbuff.h:1049 [inline] - netlink_alloc_large_skb net/netlink/af_netlink.c:1174 [inline] - netlink_sendmsg+0x783/0x1330 net/netlink/af_netlink.c:1892 - sock_sendmsg_nosec net/socket.c:637 [inline] - sock_sendmsg net/socket.c:657 [inline] - ___sys_sendmsg+0x14ff/0x1590 net/socket.c:2311 - __sys_sendmsg net/socket.c:2356 [inline] - __do_sys_sendmsg net/socket.c:2365 [inline] - __se_sys_sendmsg+0x305/0x460 net/socket.c:2363 - __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2363 - do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 - entry_SYSCALL_64_after_hwframe+0x44/0xa9 - -Fixes: 6f96c3c6904c ("net_sched: fix backward compatibility for TCA_KIND") -Signed-off-by: Eric Dumazet -Reported-by: syzbot -Acked-by: Cong Wang -Cc: Marcelo Ricardo Leitner -Cc: Jamal Hadi Salim -Cc: Jiri Pirko -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/sched/cls_api.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 5c1769999a92..758ca7e5304c 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -2854,13 +2854,19 @@ static int tc_chain_tmplt_add(struct tcf_chain *chain, struct net *net, - struct netlink_ext_ack *extack) - { - const struct tcf_proto_ops *ops; -+ char name[IFNAMSIZ]; - void *tmplt_priv; - - /* If kind is not set, user did not specify template. */ - if (!tca[TCA_KIND]) - return 0; - -- ops = tcf_proto_lookup_ops(nla_data(tca[TCA_KIND]), true, extack); -+ if (tcf_proto_check_kind(tca[TCA_KIND], name)) { -+ NL_SET_ERR_MSG(extack, "Specified TC chain template name too long"); -+ return -EINVAL; -+ } -+ -+ ops = tcf_proto_lookup_ops(name, true, extack); - if (IS_ERR(ops)) - return PTR_ERR(ops); - if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump) { --- -2.20.1 - diff --git a/queue-5.3/series b/queue-5.3/series index 576379f0d07..b1d677d2e53 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -23,4 +23,3 @@ net-fixed-updating-of-ethertype-in-skb_mpls_push.patch net-mlx5e-fix-txq-indices-to-be-sequential.patch page_pool-do-not-release-pool-until-inflight-0.patch xdp-obtain-the-mem_id-mutex-before-trying-to-remove-an-entry.patch -net_sched-validate-tca_kind-attribute-in-tc_chain_tmplt_add.patch -- 2.47.3