4.19-stable patches

added patches:
	nvme-restrict-management-ioctls-to-admin.patch
	tcp-udp-fix-memory-leak-in-ipv6_renew_options.patch

diff --git a/queue-4.19/nvme-restrict-management-ioctls-to-admin.patch b/queue-4.19/nvme-restrict-management-ioctls-to-admin.patch
new file mode 100644 (file)
index 0000000..302c6be
--- /dev/null
+++ b/queue-4.19/nvme-restrict-management-ioctls-to-admin.patch
@@ -0,0 +1,41 @@
+From 23e085b2dead13b51fe86d27069895b740f749c0 Mon Sep 17 00:00:00 2001
+From: Keith Busch <kbusch@kernel.org>
+Date: Thu, 22 Sep 2022 07:54:06 -0700
+Subject: nvme: restrict management ioctls to admin
+
+From: Keith Busch <kbusch@kernel.org>
+
+commit 23e085b2dead13b51fe86d27069895b740f749c0 upstream.
+
+The passthrough commands already have this restriction, but the other
+operations do not. Require the same capabilities for all users as all of
+these operations, which include resets and rescans, can be disruptive.
+
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ drivers/nvme/host/core.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2675,11 +2675,17 @@ static long nvme_dev_ioctl(struct file *
+       case NVME_IOCTL_IO_CMD:
+               return nvme_dev_user_cmd(ctrl, argp);
+       case NVME_IOCTL_RESET:
++              if (!capable(CAP_SYS_ADMIN))
++                      return -EACCES;
+               dev_warn(ctrl->device, "resetting controller\n");
+               return nvme_reset_ctrl_sync(ctrl);
+       case NVME_IOCTL_SUBSYS_RESET:
++              if (!capable(CAP_SYS_ADMIN))
++                      return -EACCES;
+               return nvme_reset_subsystem(ctrl);
+       case NVME_IOCTL_RESCAN:
++              if (!capable(CAP_SYS_ADMIN))
++                      return -EACCES;
+               nvme_queue_scan(ctrl);
+               return 0;
+       default:

diff --git a/queue-4.19/series b/queue-4.19/series
index 4c3770b5145b5814a11465ec5950fdb1a662b067..70f98644fb1610fde437718eb5f2e52fb9a64ef0 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -105,3 +105,5 @@ parisc-increase-frame_warn-to-2048-bytes-on-parisc.patch
 kconfig.debug-provide-a-little-extra-frame_warn-leew.patch
 tracing-add-unified-dynamic-event-framework.patch
 tracing-free-buffers-when-a-used-dynamic-event-is-re.patch
+tcp-udp-fix-memory-leak-in-ipv6_renew_options.patch
+nvme-restrict-management-ioctls-to-admin.patch

diff --git a/queue-4.19/tcp-udp-fix-memory-leak-in-ipv6_renew_options.patch b/queue-4.19/tcp-udp-fix-memory-leak-in-ipv6_renew_options.patch
new file mode 100644 (file)
index 0000000..cb3f8d8
--- /dev/null
+++ b/queue-4.19/tcp-udp-fix-memory-leak-in-ipv6_renew_options.patch
@@ -0,0 +1,100 @@
+From 3c52c6bb831f6335c176a0fc7214e26f43adbd11 Mon Sep 17 00:00:00 2001
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+Date: Thu, 6 Oct 2022 11:53:45 -0700
+Subject: tcp/udp: Fix memory leak in ipv6_renew_options().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+commit 3c52c6bb831f6335c176a0fc7214e26f43adbd11 upstream.
+
+syzbot reported a memory leak [0] related to IPV6_ADDRFORM.
+
+The scenario is that while one thread is converting an IPv6 socket into
+IPv4 with IPV6_ADDRFORM, another thread calls do_ipv6_setsockopt() and
+allocates memory to inet6_sk(sk)->XXX after conversion.
+
+Then, the converted sk with (tcp|udp)_prot never frees the IPv6 resources,
+which inet6_destroy_sock() should have cleaned up.
+
+setsockopt(IPV6_ADDRFORM)                 setsockopt(IPV6_DSTOPTS)
++-----------------------+                 +----------------------+
+- do_ipv6_setsockopt(sk, ...)
+  - sockopt_lock_sock(sk)                 - do_ipv6_setsockopt(sk, ...)
+    - lock_sock(sk)                         ^._ called via tcpv6_prot
+  - WRITE_ONCE(sk->sk_prot, &tcp_prot)          before WRITE_ONCE()
+  - xchg(&np->opt, NULL)
+  - txopt_put(opt)
+  - sockopt_release_sock(sk)
+    - release_sock(sk)                      - sockopt_lock_sock(sk)
+                                              - lock_sock(sk)
+                                            - ipv6_set_opt_hdr(sk, ...)
+                                              - ipv6_update_options(sk, opt)
+                                                - xchg(&inet6_sk(sk)->opt, opt)
+                                                  ^._ opt is never freed.
+
+                                            - sockopt_release_sock(sk)
+                                              - release_sock(sk)
+
+Since IPV6_DSTOPTS allocates options under lock_sock(), we can avoid this
+memory leak by testing whether sk_family is changed by IPV6_ADDRFORM after
+acquiring the lock.
+
+This issue exists from the initial commit between IPV6_ADDRFORM and
+IPV6_PKTOPTIONS.
+
+[0]:
+BUG: memory leak
+unreferenced object 0xffff888009ab9f80 (size 96):
+  comm "syz-executor583", pid 328, jiffies 4294916198 (age 13.034s)
+  hex dump (first 32 bytes):
+    01 00 00 00 48 00 00 00 08 00 00 00 00 00 00 00  ....H...........
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<000000002ee98ae1>] kmalloc include/linux/slab.h:605 [inline]
+    [<000000002ee98ae1>] sock_kmalloc+0xb3/0x100 net/core/sock.c:2566
+    [<0000000065d7b698>] ipv6_renew_options+0x21e/0x10b0 net/ipv6/exthdrs.c:1318
+    [<00000000a8c756d7>] ipv6_set_opt_hdr net/ipv6/ipv6_sockglue.c:354 [inline]
+    [<00000000a8c756d7>] do_ipv6_setsockopt.constprop.0+0x28b7/0x4350 net/ipv6/ipv6_sockglue.c:668
+    [<000000002854d204>] ipv6_setsockopt+0xdf/0x190 net/ipv6/ipv6_sockglue.c:1021
+    [<00000000e69fdcf8>] tcp_setsockopt+0x13b/0x2620 net/ipv4/tcp.c:3789
+    [<0000000090da4b9b>] __sys_setsockopt+0x239/0x620 net/socket.c:2252
+    [<00000000b10d192f>] __do_sys_setsockopt net/socket.c:2263 [inline]
+    [<00000000b10d192f>] __se_sys_setsockopt net/socket.c:2260 [inline]
+    [<00000000b10d192f>] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2260
+    [<000000000a80d7aa>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+    [<000000000a80d7aa>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+    [<000000004562b5c6>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ipv6_sockglue.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -166,6 +166,12 @@ static int do_ipv6_setsockopt(struct soc
+               rtnl_lock();
+       lock_sock(sk);
+ 
++      /* Another thread has converted the socket into IPv4 with
++       * IPV6_ADDRFORM concurrently.
++       */
++      if (unlikely(sk->sk_family != AF_INET6))
++              goto unlock;
++
+       switch (optname) {
+ 
+       case IPV6_ADDRFORM:
+@@ -913,6 +919,7 @@ pref_skip_coa:
+               break;
+       }
+ 
++unlock:
+       release_sock(sk);
+       if (needs_rtnl)
+               rtnl_unlock();