--- /dev/null
+From 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 7 Jun 2021 17:23:48 +0200
+Subject: media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream.
+
+The bounds checking in avc_ca_pmt() is not strict enough. It should
+be checking "read_pos + 4" because it's reading 5 bytes. If the
+"es_info_length" is non-zero then it reads a 6th byte so there needs to
+be an additional check for that.
+
+I also added checks for the "write_pos". I don't think these are
+required because "read_pos" and "write_pos" are tied together so
+checking one ought to be enough. But they make the code easier to
+understand for me. The check on write_pos is:
+
+ if (write_pos + 4 >= sizeof(c->operand) - 4) {
+
+The first "+ 4" is because we're writing 5 bytes and the last " - 4"
+is to leave space for the CRC.
+
+The other problem is that "length" can be invalid. It comes from
+"data_length" in fdtv_ca_pmt().
+
+Cc: stable@vger.kernel.org
+Reported-by: Luo Likang <luolikang@nsfocus.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/firewire/firedtv-avc.c | 14 +++++++++++---
+ drivers/media/firewire/firedtv-ci.c | 2 ++
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/firewire/firedtv-avc.c
++++ b/drivers/media/firewire/firedtv-avc.c
+@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, cha
+ read_pos += program_info_length;
+ write_pos += program_info_length;
+ }
+- while (read_pos < length) {
++ while (read_pos + 4 < length) {
++ if (write_pos + 4 >= sizeof(c->operand) - 4) {
++ ret = -EINVAL;
++ goto out;
++ }
+ c->operand[write_pos++] = msg[read_pos++];
+ c->operand[write_pos++] = msg[read_pos++];
+ c->operand[write_pos++] = msg[read_pos++];
+@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, cha
+ c->operand[write_pos++] = es_info_length >> 8;
+ c->operand[write_pos++] = es_info_length & 0xff;
+ if (es_info_length > 0) {
++ if (read_pos >= length) {
++ ret = -EINVAL;
++ goto out;
++ }
+ pmt_cmd_id = msg[read_pos++];
+ if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+ dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
+ pmt_cmd_id);
+
+- if (es_info_length > sizeof(c->operand) - 4 -
+- write_pos) {
++ if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
++ es_info_length > length - read_pos) {
+ ret = -EINVAL;
+ goto out;
+ }
+--- a/drivers/media/firewire/firedtv-ci.c
++++ b/drivers/media/firewire/firedtv-ci.c
+@@ -134,6 +134,8 @@ static int fdtv_ca_pmt(struct firedtv *f
+ } else {
+ data_length = msg->msg[3];
+ }
++ if (data_length > sizeof(msg->msg) - data_pos)
++ return -EINVAL;
+
+ return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
+ }
scsi-core-put-lld-module-refcnt-after-scsi-device-is-released.patch
+sfc-fix-reading-non-legacy-supported-link-modes.patch
+vrf-revert-reset-skb-conntrack-connection.patch
+media-firewire-firedtv-avc-fix-a-buffer-overflow-in-avc_ca_pmt.patch
--- /dev/null
+From 041c61488236a5a84789083e3d9f0a51139b6edf Mon Sep 17 00:00:00 2001
+From: Erik Ekman <erik@kryo.se>
+Date: Sun, 17 Oct 2021 19:16:57 +0200
+Subject: sfc: Fix reading non-legacy supported link modes
+
+From: Erik Ekman <erik@kryo.se>
+
+commit 041c61488236a5a84789083e3d9f0a51139b6edf upstream.
+
+Everything except the first 32 bits was lost when the pause flags were
+added. This makes the 50000baseCR2 mode flag (bit 34) not appear.
+
+I have tested this with a 10G card (SFN5122F-R7) by modifying it to
+return a non-legacy link mode (10000baseCR).
+
+Signed-off-by: Erik Ekman <erik@kryo.se>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/sfc/ethtool_common.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/sfc/ethtool_common.c
++++ b/drivers/net/ethernet/sfc/ethtool_common.c
+@@ -563,20 +563,14 @@ int efx_ethtool_get_link_ksettings(struc
+ {
+ struct efx_nic *efx = netdev_priv(net_dev);
+ struct efx_link_state *link_state = &efx->link_state;
+- u32 supported;
+
+ mutex_lock(&efx->mac_lock);
+ efx_mcdi_phy_get_link_ksettings(efx, cmd);
+ mutex_unlock(&efx->mac_lock);
+
+ /* Both MACs support pause frames (bidirectional and respond-only) */
+- ethtool_convert_link_mode_to_legacy_u32(&supported,
+- cmd->link_modes.supported);
+-
+- supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+-
+- ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported,
+- supported);
++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
++ ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause);
+
+ if (LOOPBACK_INTERNAL(efx)) {
+ cmd->base.speed = link_state->speed;
--- /dev/null
+From 55161e67d44fdd23900be166a81e996abd6e3be9 Mon Sep 17 00:00:00 2001
+From: Eugene Crosser <crosser@average.org>
+Date: Mon, 18 Oct 2021 20:22:50 +0200
+Subject: vrf: Revert "Reset skb conntrack connection..."
+
+From: Eugene Crosser <crosser@average.org>
+
+commit 55161e67d44fdd23900be166a81e996abd6e3be9 upstream.
+
+This reverts commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1.
+
+When an interface is enslaved in a VRF, prerouting conntrack hook is
+called twice: once in the context of the original input interface, and
+once in the context of the VRF interface. If no special precausions are
+taken, this leads to creation of two conntrack entries instead of one,
+and breaks SNAT.
+
+Commit above was intended to avoid creation of extra conntrack entries
+when input interface is enslaved in a VRF. It did so by resetting
+conntrack related data associated with the skb when it enters VRF context.
+
+However it breaks netfilter operation. Imagine a use case when conntrack
+zone must be assigned based on the original input interface, rather than
+VRF interface (that would make original interfaces indistinguishable). One
+could create netfilter rules similar to these:
+
+ chain rawprerouting {
+ type filter hook prerouting priority raw;
+ iif realiface1 ct zone set 1 return
+ iif realiface2 ct zone set 2 return
+ }
+
+This works before the mentioned commit, but not after: zone assignment
+is "forgotten", and any subsequent NAT or filtering that is dependent
+on the conntrack zone does not work.
+
+Here is a reproducer script that demonstrates the difference in behaviour.
+
+==========
+#!/bin/sh
+
+# This script demonstrates unexpected change of nftables behaviour
+# caused by commit 09e856d54bda5f28 ""vrf: Reset skb conntrack
+# connection on VRF rcv"
+# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09e856d54bda5f288ef8437a90ab2b9b3eab83d1
+#
+# Before the commit, it was possible to assign conntrack zone to a
+# packet (or mark it for `notracking`) in the prerouting chanin, raw
+# priority, based on the `iif` (interface from which the packet
+# arrived).
+# After the change, # if the interface is enslaved in a VRF, such
+# assignment is lost. Instead, assignment based on the `iif` matching
+# the VRF master interface is honored. Thus it is impossible to
+# distinguish packets based on the original interface.
+#
+# This script demonstrates this change of behaviour: conntrack zone 1
+# or 2 is assigned depending on the match with the original interface
+# or the vrf master interface. It can be observed that conntrack entry
+# appears in different zone in the kernel versions before and after
+# the commit.
+
+IPIN=172.30.30.1
+IPOUT=172.30.30.2
+PFXL=30
+
+ip li sh vein >/dev/null 2>&1 && ip li del vein
+ip li sh tvrf >/dev/null 2>&1 && ip li del tvrf
+nft list table testct >/dev/null 2>&1 && nft delete table testct
+
+ip li add vein type veth peer veout
+ip li add tvrf type vrf table 9876
+ip li set veout master tvrf
+ip li set vein up
+ip li set veout up
+ip li set tvrf up
+/sbin/sysctl -w net.ipv4.conf.veout.accept_local=1
+/sbin/sysctl -w net.ipv4.conf.veout.rp_filter=0
+ip addr add $IPIN/$PFXL dev vein
+ip addr add $IPOUT/$PFXL dev veout
+
+nft -f - <<__END__
+table testct {
+ chain rawpre {
+ type filter hook prerouting priority raw;
+ iif { veout, tvrf } meta nftrace set 1
+ iif veout ct zone set 1 return
+ iif tvrf ct zone set 2 return
+ notrack
+ }
+ chain rawout {
+ type filter hook output priority raw;
+ notrack
+ }
+}
+__END__
+
+uname -rv
+conntrack -F
+ping -W 1 -c 1 -I vein $IPOUT
+conntrack -L
+
+Signed-off-by: Eugene Crosser <crosser@average.org>
+Acked-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vrf.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -1367,8 +1367,6 @@ static struct sk_buff *vrf_ip6_rcv(struc
+ bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+ bool is_ndisc = ipv6_ndisc_frame(skb);
+
+- nf_reset_ct(skb);
+-
+ /* loopback, multicast & non-ND link-local traffic; do not push through
+ * packet taps again. Reset pkt_type for upper layers to process skb.
+ * For strict packets with a source LLA, determine the dst using the
+@@ -1431,8 +1429,6 @@ static struct sk_buff *vrf_ip_rcv(struct
+ skb->skb_iif = vrf_dev->ifindex;
+ IPCB(skb)->flags |= IPSKB_L3SLAVE;
+
+- nf_reset_ct(skb);
+-
+ if (ipv4_is_multicast(ip_hdr(skb)->daddr))
+ goto out;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
