From: Greg Kroah-Hartman Date: Sat, 9 Sep 2023 11:45:28 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.1.53~103 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3ed1b9b173873d515d0dc61b75f05e0e6448a79d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: igmp-limit-igmpv3_newpack-packet-size-to-ip_max_mtu.patch netfilter-ipset-add-the-missing-ip_set_hash_with_net0-macro-for-ip_set_hash_netportnet.c.patch --- diff --git a/queue-5.10/igmp-limit-igmpv3_newpack-packet-size-to-ip_max_mtu.patch b/queue-5.10/igmp-limit-igmpv3_newpack-packet-size-to-ip_max_mtu.patch new file mode 100644 index 00000000000..363f12505e5 --- /dev/null +++ b/queue-5.10/igmp-limit-igmpv3_newpack-packet-size-to-ip_max_mtu.patch @@ -0,0 +1,42 @@ +From c3b704d4a4a265660e665df51b129e8425216ed1 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 5 Sep 2023 04:23:38 +0000 +Subject: igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU + +From: Eric Dumazet + +commit c3b704d4a4a265660e665df51b129e8425216ed1 upstream. + +This is a follow up of commit 915d975b2ffa ("net: deal with integer +overflows in kmalloc_reserve()") based on David Laight feedback. + +Back in 2010, I failed to realize malicious users could set dev->mtu +to arbitrary values. This mtu has been since limited to 0x7fffffff but +regardless of how big dev->mtu is, it makes no sense for igmpv3_newpack() +to allocate more than IP_MAX_MTU and risk various skb fields overflows. + +Fixes: 57e1ab6eaddc ("igmp: refine skb allocations") +Link: https://lore.kernel.org/netdev/d273628df80f45428e739274ab9ecb72@AcuMS.aculab.com/ +Signed-off-by: Eric Dumazet +Reported-by: David Laight +Cc: Kyle Zeng +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/igmp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -353,8 +353,9 @@ static struct sk_buff *igmpv3_newpack(st + struct flowi4 fl4; + int hlen = LL_RESERVED_SPACE(dev); + int tlen = dev->needed_tailroom; +- unsigned int size = mtu; ++ unsigned int size; + ++ size = min(mtu, IP_MAX_MTU); + while (1) { + skb = alloc_skb(size + hlen + tlen, + GFP_ATOMIC | __GFP_NOWARN); diff --git a/queue-5.10/netfilter-ipset-add-the-missing-ip_set_hash_with_net0-macro-for-ip_set_hash_netportnet.c.patch b/queue-5.10/netfilter-ipset-add-the-missing-ip_set_hash_with_net0-macro-for-ip_set_hash_netportnet.c.patch new file mode 100644 index 00000000000..6ae2622da7f --- /dev/null +++ b/queue-5.10/netfilter-ipset-add-the-missing-ip_set_hash_with_net0-macro-for-ip_set_hash_netportnet.c.patch @@ -0,0 +1,36 @@ +From 050d91c03b28ca479df13dfb02bcd2c60dd6a878 Mon Sep 17 00:00:00 2001 +From: Kyle Zeng +Date: Tue, 5 Sep 2023 15:04:09 -0700 +Subject: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c + +From: Kyle Zeng + +commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 upstream. + +The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can +lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, +which can lead to integer underflow. As a result, it leads to slab +out-of-bound access. +This patch adds back the IP_SET_HASH_WITH_NET0 macro to +ip_set_hash_netportnet to address the issue. + +Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net") +Suggested-by: Jozsef Kadlecsik +Signed-off-by: Kyle Zeng +Acked-by: Jozsef Kadlecsik +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipset/ip_set_hash_netportnet.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/netfilter/ipset/ip_set_hash_netportnet.c ++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c +@@ -35,6 +35,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net") + #define IP_SET_HASH_WITH_PROTO + #define IP_SET_HASH_WITH_NETS + #define IPSET_NET_COUNT 2 ++#define IP_SET_HASH_WITH_NET0 + + /* IPv4 variant */ + diff --git a/queue-5.10/series b/queue-5.10/series index 309e3303874..068f72a3308 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -267,3 +267,5 @@ um-fix-hostaudio-build-errors.patch dmaengine-ste_dma40-add-missing-irq-check-in-d40_pro.patch cpufreq-fix-the-race-condition-while-updating-the-tr.patch virtio_ring-fix-avail_wrap_counter-in-virtqueue_add_.patch +igmp-limit-igmpv3_newpack-packet-size-to-ip_max_mtu.patch +netfilter-ipset-add-the-missing-ip_set_hash_with_net0-macro-for-ip_set_hash_netportnet.c.patch