5.13-stable patches

added patches:
	bpf-fix-ringbuf-helper-function-compatibility.patch
	net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch

diff --git a/queue-5.13/bpf-fix-ringbuf-helper-function-compatibility.patch b/queue-5.13/bpf-fix-ringbuf-helper-function-compatibility.patch
new file mode 100644 (file)
index 0000000..5849967
--- /dev/null
+++ b/queue-5.13/bpf-fix-ringbuf-helper-function-compatibility.patch
@@ -0,0 +1,54 @@
+From 5b029a32cfe4600f5e10e36b41778506b90fd4de Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Mon, 23 Aug 2021 21:02:09 +0200
+Subject: bpf: Fix ringbuf helper function compatibility
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit 5b029a32cfe4600f5e10e36b41778506b90fd4de upstream.
+
+Commit 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support
+for it") extended check_map_func_compatibility() by enforcing map -> helper
+function match, but not helper -> map type match.
+
+Due to this all of the bpf_ringbuf_*() helper functions could be used with
+a wrong map type such as array or hash map, leading to invalid access due
+to type confusion.
+
+Also, both BPF_FUNC_ringbuf_{submit,discard} have ARG_PTR_TO_ALLOC_MEM as
+argument and not a BPF map. Therefore, their check_map_func_compatibility()
+presence is incorrect since it's only for map type checking.
+
+Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
+Reported-by: Ryota Shiga (Flatt Security)
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/verifier.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -5148,8 +5148,6 @@ static int check_map_func_compatibility(
+       case BPF_MAP_TYPE_RINGBUF:
+               if (func_id != BPF_FUNC_ringbuf_output &&
+                   func_id != BPF_FUNC_ringbuf_reserve &&
+-                  func_id != BPF_FUNC_ringbuf_submit &&
+-                  func_id != BPF_FUNC_ringbuf_discard &&
+                   func_id != BPF_FUNC_ringbuf_query)
+                       goto error;
+               break;
+@@ -5258,6 +5256,12 @@ static int check_map_func_compatibility(
+               if (map->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY)
+                       goto error;
+               break;
++      case BPF_FUNC_ringbuf_output:
++      case BPF_FUNC_ringbuf_reserve:
++      case BPF_FUNC_ringbuf_query:
++              if (map->map_type != BPF_MAP_TYPE_RINGBUF)
++                      goto error;
++              break;
+       case BPF_FUNC_get_stackid:
+               if (map->map_type != BPF_MAP_TYPE_STACK_TRACE)
+                       goto error;

diff --git a/queue-5.13/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch b/queue-5.13/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch
new file mode 100644 (file)
index 0000000..8b81b55
--- /dev/null
+++ b/queue-5.13/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch
@@ -0,0 +1,47 @@
+From 7e78c597c3ebfd0cb329aa09a838734147e4f117 Mon Sep 17 00:00:00 2001
+From: Xiaolong Huang <butterflyhuangxx@gmail.com>
+Date: Fri, 20 Aug 2021 03:50:34 +0800
+Subject: net: qrtr: fix another OOB Read in qrtr_endpoint_post
+
+From: Xiaolong Huang <butterflyhuangxx@gmail.com>
+
+commit 7e78c597c3ebfd0cb329aa09a838734147e4f117 upstream.
+
+This check was incomplete, did not consider size is 0:
+
+       if (len != ALIGN(size, 4) + hdrlen)
+                    goto err;
+
+if size from qrtr_hdr is 0, the result of ALIGN(size, 4)
+will be 0, In case of len == hdrlen and size == 0
+in header this check won't fail and
+
+       if (cb->type == QRTR_TYPE_NEW_SERVER) {
+                /* Remote node endpoint can bridge other distant nodes */
+                const struct qrtr_ctrl_pkt *pkt = data + hdrlen;
+
+                qrtr_node_assign(node, le32_to_cpu(pkt->server.node));
+        }
+
+will also read out of bound from data, which is hdrlen allocated block.
+
+Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets")
+Fixes: ad9d24c9429e ("net: qrtr: fix OOB Read in qrtr_endpoint_post")
+Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/qrtr/qrtr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -493,7 +493,7 @@ int qrtr_endpoint_post(struct qrtr_endpo
+               goto err;
+       }
+ 
+-      if (len != ALIGN(size, 4) + hdrlen)
++      if (!size || len != ALIGN(size, 4) + hdrlen)
+               goto err;
+ 
+       if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA &&

diff --git a/queue-5.13/series b/queue-5.13/series
index df41c56899537e6d9415712667a27d60ea23a2a0..737806f2afb2e8fff5d3719aae83494135df8232 100644 (file)
--- a/queue-5.13/series
+++ b/queue-5.13/series
@@ -1 +1,2 @@
 net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch
+bpf-fix-ringbuf-helper-function-compatibility.patch