4.19-stable patches

added patches:
	netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch

diff --git a/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch b/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch
index 44166efd8d1a40fac342025de0635ad154e756b1..66c1aead48e8d4774065edee287f36d039b74658 100644 (file)
--- a/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch
+++ b/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch
@@ -16,11 +16,9 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- drivers/net/phy/bcm-phy-lib.c | 11 ++++++++---
+ drivers/net/phy/bcm-phy-lib.c |   11 ++++++++---
  1 file changed, 8 insertions(+), 3 deletions(-)
 
-diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c
-index e10e7b54ec4b..7e5892597533 100644
 --- a/drivers/net/phy/bcm-phy-lib.c
 +++ b/drivers/net/phy/bcm-phy-lib.c
 @@ -198,7 +198,7 @@ EXPORT_SYMBOL_GPL(bcm_phy_enable_apd);
@@ -32,7 +30,7 @@ index e10e7b54ec4b..7e5892597533 100644
  
        /* Enable EEE at PHY level */
        val = phy_read_mmd(phydev, MDIO_MMD_AN, BRCM_CL45VEN_EEE_CONTROL);
-@@ -217,10 +217,15 @@ int bcm_phy_set_eee(struct phy_device *phydev, bool enable)
+@@ -217,10 +217,15 @@ int bcm_phy_set_eee(struct phy_device *p
        if (val < 0)
                return val;
  
@@ -50,6 +48,3 @@ index e10e7b54ec4b..7e5892597533 100644
  
        phy_write_mmd(phydev, MDIO_MMD_AN, BCM_CL45VEN_EEE_ADV, (u32)val);
  
--- 
-2.30.2
-

diff --git a/queue-4.19/netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch b/queue-4.19/netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch
new file mode 100644 (file)
index 0000000..26f8679
--- /dev/null
+++ b/queue-4.19/netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch
@@ -0,0 +1,100 @@
+From b29c457a6511435960115c0f548c4360d5f4801d Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 7 Apr 2021 21:38:57 +0200
+Subject: netfilter: x_tables: fix compat match/target pad out-of-bound write
+
+From: Florian Westphal <fw@strlen.de>
+
+commit b29c457a6511435960115c0f548c4360d5f4801d upstream.
+
+xt_compat_match/target_from_user doesn't check that zeroing the area
+to start of next rule won't write past end of allocated ruleset blob.
+
+Remove this code and zero the entire blob beforehand.
+
+Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
+Reported-by: Andy Nguyen <theflow@google.com>
+Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/netfilter/arp_tables.c |    2 ++
+ net/ipv4/netfilter/ip_tables.c  |    2 ++
+ net/ipv6/netfilter/ip6_tables.c |    2 ++
+ net/netfilter/x_tables.c        |   10 ++--------
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -1195,6 +1195,8 @@ static int translate_compat_table(struct
+       if (!newinfo)
+               goto out_unlock;
+ 
++      memset(newinfo->entries, 0, size);
++
+       newinfo->number = compatr->num_entries;
+       for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
+               newinfo->hook_entry[i] = compatr->hook_entry[i];
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1433,6 +1433,8 @@ translate_compat_table(struct net *net,
+       if (!newinfo)
+               goto out_unlock;
+ 
++      memset(newinfo->entries, 0, size);
++
+       newinfo->number = compatr->num_entries;
+       for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+               newinfo->hook_entry[i] = compatr->hook_entry[i];
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1448,6 +1448,8 @@ translate_compat_table(struct net *net,
+       if (!newinfo)
+               goto out_unlock;
+ 
++      memset(newinfo->entries, 0, size);
++
+       newinfo->number = compatr->num_entries;
+       for (i = 0; i < NF_INET_NUMHOOKS; i++) {
+               newinfo->hook_entry[i] = compatr->hook_entry[i];
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -738,7 +738,7 @@ void xt_compat_match_from_user(struct xt
+ {
+       const struct xt_match *match = m->u.kernel.match;
+       struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
+-      int pad, off = xt_compat_match_offset(match);
++      int off = xt_compat_match_offset(match);
+       u_int16_t msize = cm->u.user.match_size;
+       char name[sizeof(m->u.user.name)];
+ 
+@@ -748,9 +748,6 @@ void xt_compat_match_from_user(struct xt
+               match->compat_from_user(m->data, cm->data);
+       else
+               memcpy(m->data, cm->data, msize - sizeof(*cm));
+-      pad = XT_ALIGN(match->matchsize) - match->matchsize;
+-      if (pad > 0)
+-              memset(m->data + match->matchsize, 0, pad);
+ 
+       msize += off;
+       m->u.user.match_size = msize;
+@@ -1121,7 +1118,7 @@ void xt_compat_target_from_user(struct x
+ {
+       const struct xt_target *target = t->u.kernel.target;
+       struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
+-      int pad, off = xt_compat_target_offset(target);
++      int off = xt_compat_target_offset(target);
+       u_int16_t tsize = ct->u.user.target_size;
+       char name[sizeof(t->u.user.name)];
+ 
+@@ -1131,9 +1128,6 @@ void xt_compat_target_from_user(struct x
+               target->compat_from_user(t->data, ct->data);
+       else
+               memcpy(t->data, ct->data, tsize - sizeof(*ct));
+-      pad = XT_ALIGN(target->targetsize) - target->targetsize;
+-      if (pad > 0)
+-              memset(t->data + target->targetsize, 0, pad);
+ 
+       tsize += off;
+       t->u.user.target_size = tsize;

diff --git a/queue-4.19/series b/queue-4.19/series
index a84f7b110c0d63070916970993f1e47a7a0ca2c5..e0691bb152666cb3d3e267265aef34e8cb8f0882 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -7,3 +7,4 @@ block-only-update-parent-bi_status-when-bio-fail.patch
 riscv-entry-fix-misaligned-base-for-excp_vect_table.patch
 net-phy-broadcom-only-advertise-eee-for-supported-mo.patch
 staging-m57621-mmc-delete-driver-from-the-tree.patch
+netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch