From: Greg Kroah-Hartman Date: Sun, 24 Oct 2021 12:11:51 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.290~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=40698548744a6d4e4716e068ca50466790afed81;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch selftests-netfilter-remove-stray-bash-debug-line.patch --- diff --git a/queue-5.4/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch b/queue-5.4/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch new file mode 100644 index 00000000000..2472c7ab465 --- /dev/null +++ b/queue-5.4/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch @@ -0,0 +1,64 @@ +From 1f3e2e97c003f80c4b087092b225c8787ff91e4d Mon Sep 17 00:00:00 2001 +From: Xiaolong Huang +Date: Fri, 8 Oct 2021 14:58:30 +0800 +Subject: isdn: cpai: check ctr->cnr to avoid array index out of bound + +From: Xiaolong Huang + +commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d upstream. + +The cmtp_add_connection() would add a cmtp session to a controller +and run a kernel thread to process cmtp. + + __module_get(THIS_MODULE); + session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", + session->num); + +During this process, the kernel thread would call detach_capi_ctr() +to detach a register controller. if the controller +was not attached yet, detach_capi_ctr() would +trigger an array-index-out-bounds bug. + +[ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in +drivers/isdn/capi/kcapi.c:483:21 +[ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' +[ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted +5.15.0-rc2+ #8 +[ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, +1996), BIOS 1.14.0-2 04/01/2014 +[ 46.870107][ T6479] Call Trace: +[ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d +[ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 +[ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 +[ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 +[ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 +[ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 +[ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 +[ 46.874256][ T6479] kthread+0x147/0x170 +[ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 +[ 46.875248][ T6479] ret_from_fork+0x1f/0x30 +[ 46.875773][ T6479] + +Signed-off-by: Xiaolong Huang +Acked-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/isdn/capi/kcapi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/isdn/capi/kcapi.c ++++ b/drivers/isdn/capi/kcapi.c +@@ -565,6 +565,11 @@ int detach_capi_ctr(struct capi_ctr *ctr + + ctr_down(ctr, CAPI_CTR_DETACHED); + ++ if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) { ++ err = -EINVAL; ++ goto unlock_out; ++ } ++ + if (capi_controller[ctr->cnr - 1] != ctr) { + err = -EINVAL; + goto unlock_out; diff --git a/queue-5.4/netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch b/queue-5.4/netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch new file mode 100644 index 00000000000..d95847d7156 --- /dev/null +++ b/queue-5.4/netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch @@ -0,0 +1,30 @@ +From 77076934afdcd46516caf18ed88b2f88025c9ddb Mon Sep 17 00:00:00 2001 +From: Vegard Nossum +Date: Tue, 5 Oct 2021 22:54:54 +0200 +Subject: netfilter: Kconfig: use 'default y' instead of 'm' for bool config option + +From: Vegard Nossum + +commit 77076934afdcd46516caf18ed88b2f88025c9ddb upstream. + +This option, NF_CONNTRACK_SECMARK, is a bool, so it can never be 'm'. + +Fixes: 33b8e77605620 ("[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option") +Signed-off-by: Vegard Nossum +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -94,7 +94,7 @@ config NF_CONNTRACK_MARK + config NF_CONNTRACK_SECMARK + bool 'Connection tracking security mark support' + depends on NETWORK_SECMARK +- default m if NETFILTER_ADVANCED=n ++ default y if NETFILTER_ADVANCED=n + help + This option enables security markings to be applied to + connections. Typically they are copied to connections from diff --git a/queue-5.4/nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch b/queue-5.4/nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch new file mode 100644 index 00000000000..2a2545aa4a8 --- /dev/null +++ b/queue-5.4/nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch @@ -0,0 +1,34 @@ +From 1b1499a817c90fd1ce9453a2c98d2a01cca0e775 Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Thu, 7 Oct 2021 19:44:30 +0200 +Subject: nfc: nci: fix the UAF of rf_conn_info object + +From: Lin Ma + +commit 1b1499a817c90fd1ce9453a2c98d2a01cca0e775 upstream. + +The nci_core_conn_close_rsp_packet() function will release the conn_info +with given conn_id. However, it needs to set the rf_conn_info to NULL to +prevent other routines like nci_rf_intf_activated_ntf_packet() to trigger +the UAF. + +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Lin Ma +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/nfc/nci/rsp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/nfc/nci/rsp.c ++++ b/net/nfc/nci/rsp.c +@@ -277,6 +277,8 @@ static void nci_core_conn_close_rsp_pack + ndev->cur_conn_id); + if (conn_info) { + list_del(&conn_info->list); ++ if (conn_info == ndev->rf_conn_info) ++ ndev->rf_conn_info = NULL; + devm_kfree(&ndev->nfc_dev->dev, conn_info); + } + } diff --git a/queue-5.4/selftests-netfilter-remove-stray-bash-debug-line.patch b/queue-5.4/selftests-netfilter-remove-stray-bash-debug-line.patch new file mode 100644 index 00000000000..6fed4a6d737 --- /dev/null +++ b/queue-5.4/selftests-netfilter-remove-stray-bash-debug-line.patch @@ -0,0 +1,29 @@ +From 3e6ed7703dae6838c104d73d3e76e9b79f5c0528 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 12 Oct 2021 18:37:09 +0200 +Subject: selftests: netfilter: remove stray bash debug line + +From: Florian Westphal + +commit 3e6ed7703dae6838c104d73d3e76e9b79f5c0528 upstream. + +This should not be there. + +Fixes: 2de03b45236f ("selftests: netfilter: add flowtable test script") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/netfilter/nft_flowtable.sh | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/testing/selftests/netfilter/nft_flowtable.sh ++++ b/tools/testing/selftests/netfilter/nft_flowtable.sh +@@ -174,7 +174,6 @@ fi + ip netns exec ns1 ping -c 1 -q 10.0.2.99 > /dev/null + if [ $? -ne 0 ];then + echo "ERROR: ns1 cannot reach ns2" 1>&2 +- bash + exit 1 + fi + diff --git a/queue-5.4/series b/queue-5.4/series index 3da7dcf2146..84025d25474 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -38,3 +38,7 @@ kvm-ppc-book3s-hv-make-idle_kvm_start_guest-return-0-if-it-went-to-guest.patch powerpc-idle-don-t-corrupt-back-chain-when-going-idle.patch mm-slub-fix-mismatch-between-reconstructed-freelist-depth-and-cnt.patch mm-slub-fix-potential-memoryleak-in-kmem_cache_open.patch +nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch +isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch +netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch +selftests-netfilter-remove-stray-bash-debug-line.patch