From: Greg Kroah-Hartman Date: Fri, 11 Aug 2023 15:41:13 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.14.323~74 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1a93b91d2f500772a75cf3caa89ae9308673b714;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: ipv6-adjust-ndisc_is_useropt-to-also-return-true-for-pio.patch ksmbd-fix-wrong-next-length-validation-of-ea-buffer-in-smb2_set_ea.patch ksmbd-validate-command-request-size.patch mmc-moxart-read-scr-register-without-changing-byte-order.patch series wireguard-allowedips-expand-maximum-node-depth.patch --- diff --git a/queue-5.15/ipv6-adjust-ndisc_is_useropt-to-also-return-true-for-pio.patch b/queue-5.15/ipv6-adjust-ndisc_is_useropt-to-also-return-true-for-pio.patch new file mode 100644 index 00000000000..516947a434e --- /dev/null +++ b/queue-5.15/ipv6-adjust-ndisc_is_useropt-to-also-return-true-for-pio.patch @@ -0,0 +1,57 @@ +From 048c796beb6eb4fa3a5a647ee1c81f5c6f0f6a2a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= +Date: Mon, 7 Aug 2023 03:25:32 -0700 +Subject: ipv6: adjust ndisc_is_useropt() to also return true for PIO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Żenczykowski + +commit 048c796beb6eb4fa3a5a647ee1c81f5c6f0f6a2a upstream. + +The upcoming (and nearly finalized): + https://datatracker.ietf.org/doc/draft-collink-6man-pio-pflag/ +will update the IPv6 RA to include a new flag in the PIO field, +which will serve as a hint to perform DHCPv6-PD. + +As we don't want DHCPv6 related logic inside the kernel, this piece of +information needs to be exposed to userspace. The simplest option is to +simply expose the entire PIO through the already existing mechanism. + +Even without this new flag, the already existing PIO R (router address) +flag (from RFC6275) cannot AFAICT be handled entirely in kernel, +and provides useful information that should be exposed to userspace +(the router's global address, for use by Mobile IPv6). + +Also cc'ing stable@ for inclusion in LTS, as while technically this is +not quite a bugfix, and instead more of a feature, it is absolutely +trivial and the alternative is manually cherrypicking into all Android +Common Kernel trees - and I know Greg will ask for it to be sent in via +LTS instead... + +Cc: Jen Linkova +Cc: Lorenzo Colitti +Cc: David Ahern +Cc: YOSHIFUJI Hideaki / 吉藤英明 +Cc: stable@vger.kernel.org +Signed-off-by: Maciej Żenczykowski +Link: https://lore.kernel.org/r/20230807102533.1147559-1-maze@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ndisc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -196,7 +196,8 @@ static struct nd_opt_hdr *ndisc_next_opt + static inline int ndisc_is_useropt(const struct net_device *dev, + struct nd_opt_hdr *opt) + { +- return opt->nd_opt_type == ND_OPT_RDNSS || ++ return opt->nd_opt_type == ND_OPT_PREFIX_INFO || ++ opt->nd_opt_type == ND_OPT_RDNSS || + opt->nd_opt_type == ND_OPT_DNSSL || + opt->nd_opt_type == ND_OPT_CAPTIVE_PORTAL || + opt->nd_opt_type == ND_OPT_PREF64 || diff --git a/queue-5.15/ksmbd-fix-wrong-next-length-validation-of-ea-buffer-in-smb2_set_ea.patch b/queue-5.15/ksmbd-fix-wrong-next-length-validation-of-ea-buffer-in-smb2_set_ea.patch new file mode 100644 index 00000000000..a9f0f35d59d --- /dev/null +++ b/queue-5.15/ksmbd-fix-wrong-next-length-validation-of-ea-buffer-in-smb2_set_ea.patch @@ -0,0 +1,45 @@ +From 79ed288cef201f1f212dfb934bcaac75572fb8f6 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Sun, 6 Aug 2023 08:44:17 +0900 +Subject: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() + +From: Namjae Jeon + +commit 79ed288cef201f1f212dfb934bcaac75572fb8f6 upstream. + +There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request +from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of +current smb2_ea_info. ksmbd need to validate buffer length Before +accessing the next ea. ksmbd should check buffer length using buf_len, +not next variable. next is the start offset of current ea that got from +previous ea. + +Cc: stable@vger.kernel.org +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21598 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/smb2pdu.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -2309,9 +2309,16 @@ next: + break; + buf_len -= next; + eabuf = (struct smb2_ea_info *)((char *)eabuf + next); +- if (next < (u32)eabuf->EaNameLength + le16_to_cpu(eabuf->EaValueLength)) ++ if (buf_len < sizeof(struct smb2_ea_info)) { ++ rc = -EINVAL; + break; ++ } + ++ if (buf_len < sizeof(struct smb2_ea_info) + eabuf->EaNameLength + ++ le16_to_cpu(eabuf->EaValueLength)) { ++ rc = -EINVAL; ++ break; ++ } + } while (next != 0); + + kfree(attr_name); diff --git a/queue-5.15/ksmbd-validate-command-request-size.patch b/queue-5.15/ksmbd-validate-command-request-size.patch new file mode 100644 index 00000000000..2984f3c07f8 --- /dev/null +++ b/queue-5.15/ksmbd-validate-command-request-size.patch @@ -0,0 +1,45 @@ +From 5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c Mon Sep 17 00:00:00 2001 +From: Long Li +Date: Sat, 29 Jul 2023 11:36:18 +0800 +Subject: ksmbd: validate command request size + +From: Long Li + +commit 5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c upstream. + +In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except +for SMB2_OPLOCK_BREAK_HE command, the request size of other commands +is not checked, it's not expected. Fix it by add check for request +size of other commands. + +Cc: stable@vger.kernel.org +Fixes: 2b9b8f3b68ed ("ksmbd: validate command payload size") +Acked-by: Namjae Jeon +Signed-off-by: Long Li +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/ksmbd/smb2misc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/fs/ksmbd/smb2misc.c ++++ b/fs/ksmbd/smb2misc.c +@@ -381,13 +381,13 @@ int ksmbd_smb2_check_message(struct ksmb + } + + if (smb2_req_struct_sizes[command] != pdu->StructureSize2) { +- if (command == SMB2_OPLOCK_BREAK_HE && +- le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_20 && +- le16_to_cpu(pdu->StructureSize2) != OP_BREAK_STRUCT_SIZE_21) { ++ if (!(command == SMB2_OPLOCK_BREAK_HE && ++ (le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_20 || ++ le16_to_cpu(pdu->StructureSize2) == OP_BREAK_STRUCT_SIZE_21))) { + /* special case for SMB2.1 lease break message */ + ksmbd_debug(SMB, +- "Illegal request size %d for oplock break\n", +- le16_to_cpu(pdu->StructureSize2)); ++ "Illegal request size %u for command %d\n", ++ le16_to_cpu(pdu->StructureSize2), command); + return 1; + } + } diff --git a/queue-5.15/mmc-moxart-read-scr-register-without-changing-byte-order.patch b/queue-5.15/mmc-moxart-read-scr-register-without-changing-byte-order.patch new file mode 100644 index 00000000000..acf161cbd29 --- /dev/null +++ b/queue-5.15/mmc-moxart-read-scr-register-without-changing-byte-order.patch @@ -0,0 +1,44 @@ +From d44263222134b5635932974c6177a5cba65a07e8 Mon Sep 17 00:00:00 2001 +From: Sergei Antonov +Date: Tue, 27 Jun 2023 15:05:49 +0300 +Subject: mmc: moxart: read scr register without changing byte order + +From: Sergei Antonov + +commit d44263222134b5635932974c6177a5cba65a07e8 upstream. + +Conversion from big-endian to native is done in a common function +mmc_app_send_scr(). Converting in moxart_transfer_pio() is extra. +Double conversion on a LE system returns an incorrect SCR value, +leads to errors: + +mmc0: unrecognised SCR structure version 8 + +Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver") +Signed-off-by: Sergei Antonov +Cc: Jonas Jensen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230627120549.2400325-1-saproj@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/moxart-mmc.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/mmc/host/moxart-mmc.c ++++ b/drivers/mmc/host/moxart-mmc.c +@@ -338,13 +338,7 @@ static void moxart_transfer_pio(struct m + return; + } + for (len = 0; len < remain && len < host->fifo_width;) { +- /* SCR data must be read in big endian. */ +- if (data->mrq->cmd->opcode == SD_APP_SEND_SCR) +- *sgp = ioread32be(host->base + +- REG_DATA_WINDOW); +- else +- *sgp = ioread32(host->base + +- REG_DATA_WINDOW); ++ *sgp = ioread32(host->base + REG_DATA_WINDOW); + sgp++; + len += 4; + } diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..f1efaeb740b --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,5 @@ +ksmbd-validate-command-request-size.patch +ksmbd-fix-wrong-next-length-validation-of-ea-buffer-in-smb2_set_ea.patch +wireguard-allowedips-expand-maximum-node-depth.patch +mmc-moxart-read-scr-register-without-changing-byte-order.patch +ipv6-adjust-ndisc_is_useropt-to-also-return-true-for-pio.patch diff --git a/queue-5.15/wireguard-allowedips-expand-maximum-node-depth.patch b/queue-5.15/wireguard-allowedips-expand-maximum-node-depth.patch new file mode 100644 index 00000000000..dfb2d68c244 --- /dev/null +++ b/queue-5.15/wireguard-allowedips-expand-maximum-node-depth.patch @@ -0,0 +1,97 @@ +From 46622219aae2b67813fe31a7b8cb7da5baff5c8a Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 7 Aug 2023 15:21:27 +0200 +Subject: wireguard: allowedips: expand maximum node depth + +From: Jason A. Donenfeld + +commit 46622219aae2b67813fe31a7b8cb7da5baff5c8a upstream. + +In the allowedips self-test, nodes are inserted into the tree, but it +generated an even amount of nodes, but for checking maximum node depth, +there is of course the root node, which makes the total number +necessarily odd. With two few nodes added, it never triggered the +maximum depth check like it should have. So, add 129 nodes instead of +128 nodes, and do so with a more straightforward scheme, starting with +all the bits set, and shifting over one each time. Then increase the +maximum depth to 129, and choose a better name for that variable to +make it clear that it represents depth as opposed to bits. + +Cc: stable@vger.kernel.org +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Signed-off-by: Jason A. Donenfeld +Link: https://lore.kernel.org/r/20230807132146.2191597-2-Jason@zx2c4.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireguard/allowedips.c | 8 ++++---- + drivers/net/wireguard/selftest/allowedips.c | 16 ++++++++++------ + 2 files changed, 14 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireguard/allowedips.c ++++ b/drivers/net/wireguard/allowedips.c +@@ -6,7 +6,7 @@ + #include "allowedips.h" + #include "peer.h" + +-enum { MAX_ALLOWEDIPS_BITS = 128 }; ++enum { MAX_ALLOWEDIPS_DEPTH = 129 }; + + static struct kmem_cache *node_cache; + +@@ -42,7 +42,7 @@ static void push_rcu(struct allowedips_n + struct allowedips_node __rcu *p, unsigned int *len) + { + if (rcu_access_pointer(p)) { +- if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_BITS)) ++ if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_DEPTH)) + return; + stack[(*len)++] = rcu_dereference_raw(p); + } +@@ -55,7 +55,7 @@ static void node_free_rcu(struct rcu_hea + + static void root_free_rcu(struct rcu_head *rcu) + { +- struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS] = { ++ struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH] = { + container_of(rcu, struct allowedips_node, rcu) }; + unsigned int len = 1; + +@@ -68,7 +68,7 @@ static void root_free_rcu(struct rcu_hea + + static void root_remove_peer_lists(struct allowedips_node *root) + { +- struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS] = { root }; ++ struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH] = { root }; + unsigned int len = 1; + + while (len > 0 && (node = stack[--len])) { +--- a/drivers/net/wireguard/selftest/allowedips.c ++++ b/drivers/net/wireguard/selftest/allowedips.c +@@ -593,16 +593,20 @@ bool __init wg_allowedips_selftest(void) + wg_allowedips_remove_by_peer(&t, a, &mutex); + test_negative(4, a, 192, 168, 0, 1); + +- /* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_BITS) in free_node ++ /* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_DEPTH) in free_node + * if something goes wrong. + */ +- for (i = 0; i < MAX_ALLOWEDIPS_BITS; ++i) { +- part = cpu_to_be64(~(1LLU << (i % 64))); +- memset(&ip, 0xff, 16); +- memcpy((u8 *)&ip + (i < 64) * 8, &part, 8); ++ for (i = 0; i < 64; ++i) { ++ part = cpu_to_be64(~0LLU << i); ++ memset(&ip, 0xff, 8); ++ memcpy((u8 *)&ip + 8, &part, 8); ++ wg_allowedips_insert_v6(&t, &ip, 128, a, &mutex); ++ memcpy(&ip, &part, 8); ++ memset((u8 *)&ip + 8, 0, 8); + wg_allowedips_insert_v6(&t, &ip, 128, a, &mutex); + } +- ++ memset(&ip, 0, 16); ++ wg_allowedips_insert_v6(&t, &ip, 128, a, &mutex); + wg_allowedips_free(&t, &mutex); + + wg_allowedips_init(&t);