From: Greg Kroah-Hartman Date: Sat, 10 Apr 2021 14:16:09 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.19.187~64 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=be38a1a3fab6707f3dc1882458d5335f7b579d4b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: batman-adv-initialize-struct-batadv_tvlv_tt_vlan_data-reserved-field.patch ice-increase-control-queue-timeout.patch net-ensure-mac-header-is-set-in-virtio_net_hdr_to_skb.patch net-hso-fix-null-ptr-deref-during-tty-device-unregistration.patch --- diff --git a/queue-4.19/batman-adv-initialize-struct-batadv_tvlv_tt_vlan_data-reserved-field.patch b/queue-4.19/batman-adv-initialize-struct-batadv_tvlv_tt_vlan_data-reserved-field.patch new file mode 100644 index 00000000000..5b747fbe452 --- /dev/null +++ b/queue-4.19/batman-adv-initialize-struct-batadv_tvlv_tt_vlan_data-reserved-field.patch @@ -0,0 +1,48 @@ +From 08c27f3322fec11950b8f1384aa0f3b11d028528 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 5 Apr 2021 19:16:50 +0900 +Subject: batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field + +From: Tetsuo Handa + +commit 08c27f3322fec11950b8f1384aa0f3b11d028528 upstream. + +KMSAN found uninitialized value at batadv_tt_prepare_tvlv_local_data() +[1], for commit ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16 +in TT code") inserted 'reserved' field into "struct batadv_tvlv_tt_data" +and commit 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN +specific") moved that field to "struct batadv_tvlv_tt_vlan_data" but left +that field uninitialized. + +[1] https://syzkaller.appspot.com/bug?id=07f3e6dba96f0eb3cabab986adcd8a58b9bdbe9d + +Reported-by: syzbot +Tested-by: syzbot +Signed-off-by: Tetsuo Handa +Fixes: ced72933a5e8ab52 ("batman-adv: use CRC32C instead of CRC16 in TT code") +Fixes: 7ea7b4a142758dea ("batman-adv: make the TT CRC logic VLAN specific") +Acked-by: Sven Eckelmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/translation-table.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -904,6 +904,7 @@ batadv_tt_prepare_tvlv_global_data(struc + hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { + tt_vlan->vid = htons(vlan->vid); + tt_vlan->crc = htonl(vlan->tt.crc); ++ tt_vlan->reserved = 0; + + tt_vlan++; + } +@@ -987,6 +988,7 @@ batadv_tt_prepare_tvlv_local_data(struct + + tt_vlan->vid = htons(vlan->vid); + tt_vlan->crc = htonl(vlan->tt.crc); ++ tt_vlan->reserved = 0; + + tt_vlan++; + } diff --git a/queue-4.19/ice-increase-control-queue-timeout.patch b/queue-4.19/ice-increase-control-queue-timeout.patch new file mode 100644 index 00000000000..1ec6c350328 --- /dev/null +++ b/queue-4.19/ice-increase-control-queue-timeout.patch @@ -0,0 +1,34 @@ +From f88c529ac77b3c21819d2cf1dfcfae1937849743 Mon Sep 17 00:00:00 2001 +From: Fabio Pricoco +Date: Fri, 26 Feb 2021 13:19:24 -0800 +Subject: ice: Increase control queue timeout + +From: Fabio Pricoco + +commit f88c529ac77b3c21819d2cf1dfcfae1937849743 upstream. + +250 msec timeout is insufficient for some AQ commands. Advice from FW +team was to increase the timeout. Increase to 1 second. + +Fixes: 7ec59eeac804 ("ice: Add support for control queues") +Signed-off-by: Fabio Pricoco +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_controlq.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_controlq.h ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.h +@@ -30,8 +30,8 @@ enum ice_ctl_q { + ICE_CTL_Q_ADMIN, + }; + +-/* Control Queue timeout settings - max delay 250ms */ +-#define ICE_CTL_Q_SQ_CMD_TIMEOUT 2500 /* Count 2500 times */ ++/* Control Queue timeout settings - max delay 1s */ ++#define ICE_CTL_Q_SQ_CMD_TIMEOUT 10000 /* Count 10000 times */ + #define ICE_CTL_Q_SQ_CMD_USEC 100 /* Check every 100usec */ + + struct ice_ctl_q_ring { diff --git a/queue-4.19/net-ensure-mac-header-is-set-in-virtio_net_hdr_to_skb.patch b/queue-4.19/net-ensure-mac-header-is-set-in-virtio_net_hdr_to_skb.patch new file mode 100644 index 00000000000..001b98e2fe8 --- /dev/null +++ b/queue-4.19/net-ensure-mac-header-is-set-in-virtio_net_hdr_to_skb.patch @@ -0,0 +1,77 @@ +From 61431a5907fc36d0738e9a547c7e1556349a03e9 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 30 Mar 2021 16:43:43 -0700 +Subject: net: ensure mac header is set in virtio_net_hdr_to_skb() + +From: Eric Dumazet + +commit 61431a5907fc36d0738e9a547c7e1556349a03e9 upstream. + +Commit 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") +added a call to dev_parse_header_protocol() but mac_header is not yet set. + +This means that eth_hdr() reads complete garbage, and syzbot complained about it [1] + +This patch resets mac_header earlier, to get more coverage about this change. + +Audit of virtio_net_hdr_to_skb() callers shows that this change should be safe. + +[1] + +BUG: KASAN: use-after-free in eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282 +Read of size 2 at addr ffff888017a6200b by task syz-executor313/8409 + +CPU: 1 PID: 8409 Comm: syz-executor313 Not tainted 5.12.0-rc2-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x141/0x1d7 lib/dump_stack.c:120 + print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 + __kasan_report mm/kasan/report.c:399 [inline] + kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 + eth_header_parse_protocol+0xdc/0xe0 net/ethernet/eth.c:282 + dev_parse_header_protocol include/linux/netdevice.h:3177 [inline] + virtio_net_hdr_to_skb.constprop.0+0x99d/0xcd0 include/linux/virtio_net.h:83 + packet_snd net/packet/af_packet.c:2994 [inline] + packet_sendmsg+0x2325/0x52b0 net/packet/af_packet.c:3031 + sock_sendmsg_nosec net/socket.c:654 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:674 + sock_no_sendpage+0xf3/0x130 net/core/sock.c:2860 + kernel_sendpage.part.0+0x1ab/0x350 net/socket.c:3631 + kernel_sendpage net/socket.c:3628 [inline] + sock_sendpage+0xe5/0x140 net/socket.c:947 + pipe_to_sendpage+0x2ad/0x380 fs/splice.c:364 + splice_from_pipe_feed fs/splice.c:418 [inline] + __splice_from_pipe+0x43e/0x8a0 fs/splice.c:562 + splice_from_pipe fs/splice.c:597 [inline] + generic_splice_sendpage+0xd4/0x140 fs/splice.c:746 + do_splice_from fs/splice.c:767 [inline] + do_splice+0xb7e/0x1940 fs/splice.c:1079 + __do_splice+0x134/0x250 fs/splice.c:1144 + __do_sys_splice fs/splice.c:1350 [inline] + __se_sys_splice fs/splice.c:1332 [inline] + __x64_sys_splice+0x198/0x250 fs/splice.c:1332 + do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 + +Fixes: 924a9bc362a5 ("net: check if protocol extracted by virtio_net_hdr_set_proto is correct") +Signed-off-by: Eric Dumazet +Cc: Balazs Nemeth +Cc: Willem de Bruijn +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/virtio_net.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -62,6 +62,8 @@ static inline int virtio_net_hdr_to_skb( + return -EINVAL; + } + ++ skb_reset_mac_header(skb); ++ + if (hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) { + u16 start = __virtio16_to_cpu(little_endian, hdr->csum_start); + u16 off = __virtio16_to_cpu(little_endian, hdr->csum_offset); diff --git a/queue-4.19/net-hso-fix-null-ptr-deref-during-tty-device-unregistration.patch b/queue-4.19/net-hso-fix-null-ptr-deref-during-tty-device-unregistration.patch new file mode 100644 index 00000000000..ab40374841d --- /dev/null +++ b/queue-4.19/net-hso-fix-null-ptr-deref-during-tty-device-unregistration.patch @@ -0,0 +1,143 @@ +From 8a12f8836145ffe37e9c8733dce18c22fb668b66 Mon Sep 17 00:00:00 2001 +From: Anirudh Rayabharam +Date: Wed, 7 Apr 2021 22:57:22 +0530 +Subject: net: hso: fix null-ptr-deref during tty device unregistration + +From: Anirudh Rayabharam + +commit 8a12f8836145ffe37e9c8733dce18c22fb668b66 upstream. + +Multiple ttys try to claim the same the minor number causing a double +unregistration of the same device. The first unregistration succeeds +but the next one results in a null-ptr-deref. + +The get_free_serial_index() function returns an available minor number +but doesn't assign it immediately. The assignment is done by the caller +later. But before this assignment, calls to get_free_serial_index() +would return the same minor number. + +Fix this by modifying get_free_serial_index to assign the minor number +immediately after one is found to be and rename it to obtain_minor() +to better reflect what it does. Similary, rename set_serial_by_index() +to release_minor() and modify it to free up the minor number of the +given hso_serial. Every obtain_minor() should have corresponding +release_minor() call. + +Fixes: 72dc1c096c705 ("HSO: add option hso driver") +Reported-by: syzbot+c49fe6089f295a05e6f8@syzkaller.appspotmail.com +Tested-by: syzbot+c49fe6089f295a05e6f8@syzkaller.appspotmail.com +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Anirudh Rayabharam +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/hso.c | 33 ++++++++++++--------------------- + 1 file changed, 12 insertions(+), 21 deletions(-) + +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -625,7 +625,7 @@ static struct hso_serial *get_serial_by_ + return serial; + } + +-static int get_free_serial_index(void) ++static int obtain_minor(struct hso_serial *serial) + { + int index; + unsigned long flags; +@@ -633,8 +633,10 @@ static int get_free_serial_index(void) + spin_lock_irqsave(&serial_table_lock, flags); + for (index = 0; index < HSO_SERIAL_TTY_MINORS; index++) { + if (serial_table[index] == NULL) { ++ serial_table[index] = serial->parent; ++ serial->minor = index; + spin_unlock_irqrestore(&serial_table_lock, flags); +- return index; ++ return 0; + } + } + spin_unlock_irqrestore(&serial_table_lock, flags); +@@ -643,15 +645,12 @@ static int get_free_serial_index(void) + return -1; + } + +-static void set_serial_by_index(unsigned index, struct hso_serial *serial) ++static void release_minor(struct hso_serial *serial) + { + unsigned long flags; + + spin_lock_irqsave(&serial_table_lock, flags); +- if (serial) +- serial_table[index] = serial->parent; +- else +- serial_table[index] = NULL; ++ serial_table[serial->minor] = NULL; + spin_unlock_irqrestore(&serial_table_lock, flags); + } + +@@ -2244,6 +2243,7 @@ static int hso_stop_serial_device(struct + static void hso_serial_tty_unregister(struct hso_serial *serial) + { + tty_unregister_device(tty_drv, serial->minor); ++ release_minor(serial); + } + + static void hso_serial_common_free(struct hso_serial *serial) +@@ -2267,24 +2267,22 @@ static void hso_serial_common_free(struc + static int hso_serial_common_create(struct hso_serial *serial, int num_urbs, + int rx_size, int tx_size) + { +- int minor; + int i; + + tty_port_init(&serial->port); + +- minor = get_free_serial_index(); +- if (minor < 0) ++ if (obtain_minor(serial)) + goto exit2; + + /* register our minor number */ + serial->parent->dev = tty_port_register_device_attr(&serial->port, +- tty_drv, minor, &serial->parent->interface->dev, ++ tty_drv, serial->minor, &serial->parent->interface->dev, + serial->parent, hso_serial_dev_groups); +- if (IS_ERR(serial->parent->dev)) ++ if (IS_ERR(serial->parent->dev)) { ++ release_minor(serial); + goto exit2; ++ } + +- /* fill in specific data for later use */ +- serial->minor = minor; + serial->magic = HSO_SERIAL_MAGIC; + spin_lock_init(&serial->serial_lock); + serial->num_rx_urbs = num_urbs; +@@ -2677,9 +2675,6 @@ static struct hso_device *hso_create_bul + + serial->write_data = hso_std_serial_write_data; + +- /* and record this serial */ +- set_serial_by_index(serial->minor, serial); +- + /* setup the proc dirs and files if needed */ + hso_log_port(hso_dev); + +@@ -2736,9 +2731,6 @@ struct hso_device *hso_create_mux_serial + serial->shared_int->ref_count++; + mutex_unlock(&serial->shared_int->shared_int_lock); + +- /* and record this serial */ +- set_serial_by_index(serial->minor, serial); +- + /* setup the proc dirs and files if needed */ + hso_log_port(hso_dev); + +@@ -3123,7 +3115,6 @@ static void hso_free_interface(struct us + cancel_work_sync(&serial_table[i]->async_get_intf); + hso_serial_tty_unregister(serial); + kref_put(&serial_table[i]->ref, hso_serial_ref_free); +- set_serial_by_index(i, NULL); + } + } + diff --git a/queue-4.19/series b/queue-4.19/series index 52c1f581379..91bb0c6a847 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -13,3 +13,7 @@ fs-direct-io-fix-missing-sdio-boundary.patch parisc-parisc-agp-requires-sba-iommu-driver.patch parisc-avoid-a-warning-on-u8-cast-for-cmpxchg-on-u8-pointers.patch arm-dts-turris-omnia-configure-led-intn-pin-as-interrupt-pin.patch +batman-adv-initialize-struct-batadv_tvlv_tt_vlan_data-reserved-field.patch +ice-increase-control-queue-timeout.patch +net-hso-fix-null-ptr-deref-during-tty-device-unregistration.patch +net-ensure-mac-header-is-set-in-virtio_net_hdr_to_skb.patch