From: Greg Kroah-Hartman Date: Thu, 22 Jul 2021 15:25:51 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.4.135~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4a5b7004c712b2eecf9ba8dd049bebf94fadd2c0;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: dma-buf-sync_file-don-t-leak-fences-on-merge-failure.patch net-bcmgenet-ensure-all-tx-rx-queues-dmas-are-disabled.patch net-bridge-sync-fdb-to-new-unicast-filtering-ports.patch net-ipv6-fix-return-value-of-ip6_skb_dst_mtu.patch net-moxa-fix-uaf-in-moxart_mac_probe.patch net-qcom-emac-fix-uaf-in-emac_remove.patch net-send-synack-packet-with-accepted-fwmark.patch net-ti-fix-uaf-in-tlan_remove_one.patch net-validate-lwtstate-data-before-returning-from-skb_tunnel_info.patch netfilter-ctnetlink-suspicious-rcu-usage-in-ctnetlink_dump_helpinfo.patch --- diff --git a/queue-4.14/dma-buf-sync_file-don-t-leak-fences-on-merge-failure.patch b/queue-4.14/dma-buf-sync_file-don-t-leak-fences-on-merge-failure.patch new file mode 100644 index 00000000000..706a262c0e6 --- /dev/null +++ b/queue-4.14/dma-buf-sync_file-don-t-leak-fences-on-merge-failure.patch @@ -0,0 +1,73 @@ +From ffe000217c5068c5da07ccb1c0f8cce7ad767435 Mon Sep 17 00:00:00 2001 +From: Jason Ekstrand +Date: Thu, 24 Jun 2021 12:47:32 -0500 +Subject: dma-buf/sync_file: Don't leak fences on merge failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jason Ekstrand + +commit ffe000217c5068c5da07ccb1c0f8cce7ad767435 upstream. + +Each add_fence() call does a dma_fence_get() on the relevant fence. In +the error path, we weren't calling dma_fence_put() so all those fences +got leaked. Also, in the krealloc_array failure case, we weren't +freeing the fences array. Instead, ensure that i and fences are always +zero-initialized and dma_fence_put() all the fences and kfree(fences) on +every error path. + +Signed-off-by: Jason Ekstrand +Reviewed-by: Christian König +Fixes: a02b9dc90d84 ("dma-buf/sync_file: refactor fence storage in struct sync_file") +Cc: Gustavo Padovan +Cc: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20210624174732.1754546-1-jason@jlekstrand.net +Signed-off-by: Christian König +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma-buf/sync_file.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/dma-buf/sync_file.c ++++ b/drivers/dma-buf/sync_file.c +@@ -220,8 +220,8 @@ static struct sync_file *sync_file_merge + struct sync_file *b) + { + struct sync_file *sync_file; +- struct dma_fence **fences, **nfences, **a_fences, **b_fences; +- int i, i_a, i_b, num_fences, a_num_fences, b_num_fences; ++ struct dma_fence **fences = NULL, **nfences, **a_fences, **b_fences; ++ int i = 0, i_a, i_b, num_fences, a_num_fences, b_num_fences; + + sync_file = sync_file_alloc(); + if (!sync_file) +@@ -245,7 +245,7 @@ static struct sync_file *sync_file_merge + * If a sync_file can only be created with sync_file_merge + * and sync_file_create, this is a reasonable assumption. + */ +- for (i = i_a = i_b = 0; i_a < a_num_fences && i_b < b_num_fences; ) { ++ for (i_a = i_b = 0; i_a < a_num_fences && i_b < b_num_fences; ) { + struct dma_fence *pt_a = a_fences[i_a]; + struct dma_fence *pt_b = b_fences[i_b]; + +@@ -286,15 +286,16 @@ static struct sync_file *sync_file_merge + fences = nfences; + } + +- if (sync_file_set_fence(sync_file, fences, i) < 0) { +- kfree(fences); ++ if (sync_file_set_fence(sync_file, fences, i) < 0) + goto err; +- } + + strlcpy(sync_file->user_name, name, sizeof(sync_file->user_name)); + return sync_file; + + err: ++ while (i) ++ dma_fence_put(fences[--i]); ++ kfree(fences); + fput(sync_file->file); + return NULL; + diff --git a/queue-4.14/net-bcmgenet-ensure-all-tx-rx-queues-dmas-are-disabled.patch b/queue-4.14/net-bcmgenet-ensure-all-tx-rx-queues-dmas-are-disabled.patch new file mode 100644 index 00000000000..86fe7a23659 --- /dev/null +++ b/queue-4.14/net-bcmgenet-ensure-all-tx-rx-queues-dmas-are-disabled.patch @@ -0,0 +1,46 @@ +From 2b452550a203d88112eaf0ba9fc4b750a000b496 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Thu, 8 Jul 2021 18:55:32 -0700 +Subject: net: bcmgenet: Ensure all TX/RX queues DMAs are disabled + +From: Florian Fainelli + +commit 2b452550a203d88112eaf0ba9fc4b750a000b496 upstream. + +Make sure that we disable each of the TX and RX queues in the TDMA and +RDMA control registers. This is a correctness change to be symmetrical +with the code that enables the TX and RX queues. + +Tested-by: Maxime Ripard +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2789,15 +2789,21 @@ static void bcmgenet_set_hw_addr(struct + /* Returns a reusable dma control register value */ + static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv) + { ++ unsigned int i; + u32 reg; + u32 dma_ctrl; + + /* disable DMA */ + dma_ctrl = 1 << (DESC_INDEX + DMA_RING_BUF_EN_SHIFT) | DMA_EN; ++ for (i = 0; i < priv->hw_params->tx_queues; i++) ++ dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT)); + reg = bcmgenet_tdma_readl(priv, DMA_CTRL); + reg &= ~dma_ctrl; + bcmgenet_tdma_writel(priv, reg, DMA_CTRL); + ++ dma_ctrl = 1 << (DESC_INDEX + DMA_RING_BUF_EN_SHIFT) | DMA_EN; ++ for (i = 0; i < priv->hw_params->rx_queues; i++) ++ dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT)); + reg = bcmgenet_rdma_readl(priv, DMA_CTRL); + reg &= ~dma_ctrl; + bcmgenet_rdma_writel(priv, reg, DMA_CTRL); diff --git a/queue-4.14/net-bridge-sync-fdb-to-new-unicast-filtering-ports.patch b/queue-4.14/net-bridge-sync-fdb-to-new-unicast-filtering-ports.patch new file mode 100644 index 00000000000..0861a71e601 --- /dev/null +++ b/queue-4.14/net-bridge-sync-fdb-to-new-unicast-filtering-ports.patch @@ -0,0 +1,73 @@ +From a019abd8022061b917da767cd1a66ed823724eab Mon Sep 17 00:00:00 2001 +From: Wolfgang Bumiller +Date: Fri, 2 Jul 2021 14:07:36 +0200 +Subject: net: bridge: sync fdb to new unicast-filtering ports + +From: Wolfgang Bumiller + +commit a019abd8022061b917da767cd1a66ed823724eab upstream. + +Since commit 2796d0c648c9 ("bridge: Automatically manage +port promiscuous mode.") +bridges with `vlan_filtering 1` and only 1 auto-port don't +set IFF_PROMISC for unicast-filtering-capable ports. + +Normally on port changes `br_manage_promisc` is called to +update the promisc flags and unicast filters if necessary, +but it cannot distinguish between *new* ports and ones +losing their promisc flag, and new ports end up not +receiving the MAC address list. + +Fix this by calling `br_fdb_sync_static` in `br_add_if` +after the port promisc flags are updated and the unicast +filter was supposed to have been filled. + +Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.") +Signed-off-by: Wolfgang Bumiller +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/bridge/br_if.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/net/bridge/br_if.c ++++ b/net/bridge/br_if.c +@@ -485,7 +485,7 @@ int br_add_if(struct net_bridge *br, str + struct net_bridge_port *p; + int err = 0; + unsigned br_hr, dev_hr; +- bool changed_addr; ++ bool changed_addr, fdb_synced = false; + + /* Don't allow bridging non-ethernet like devices, or DSA-enabled + * master network devices since the bridge layer rx_handler prevents +@@ -555,6 +555,19 @@ int br_add_if(struct net_bridge *br, str + list_add_rcu(&p->list, &br->port_list); + + nbp_update_port_count(br); ++ if (!br_promisc_port(p) && (p->dev->priv_flags & IFF_UNICAST_FLT)) { ++ /* When updating the port count we also update all ports' ++ * promiscuous mode. ++ * A port leaving promiscuous mode normally gets the bridge's ++ * fdb synced to the unicast filter (if supported), however, ++ * `br_port_clear_promisc` does not distinguish between ++ * non-promiscuous ports and *new* ports, so we need to ++ * sync explicitly here. ++ */ ++ fdb_synced = br_fdb_sync_static(br, p) == 0; ++ if (!fdb_synced) ++ netdev_err(dev, "failed to sync bridge static fdb addresses to this port\n"); ++ } + + netdev_update_features(br->dev); + +@@ -595,6 +608,8 @@ int br_add_if(struct net_bridge *br, str + return 0; + + err7: ++ if (fdb_synced) ++ br_fdb_unsync_static(br, p); + list_del_rcu(&p->list); + br_fdb_delete_by_port(br, p, 0, 1); + nbp_update_port_count(br); diff --git a/queue-4.14/net-ipv6-fix-return-value-of-ip6_skb_dst_mtu.patch b/queue-4.14/net-ipv6-fix-return-value-of-ip6_skb_dst_mtu.patch new file mode 100644 index 00000000000..48c8aa8c79b --- /dev/null +++ b/queue-4.14/net-ipv6-fix-return-value-of-ip6_skb_dst_mtu.patch @@ -0,0 +1,49 @@ +From 40fc3054b45820c28ea3c65e2c86d041dc244a8a Mon Sep 17 00:00:00 2001 +From: Vadim Fedorenko +Date: Fri, 2 Jul 2021 02:47:00 +0300 +Subject: net: ipv6: fix return value of ip6_skb_dst_mtu + +From: Vadim Fedorenko + +commit 40fc3054b45820c28ea3c65e2c86d041dc244a8a upstream. + +Commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE") introduced +ip6_skb_dst_mtu with return value of signed int which is inconsistent +with actually returned values. Also 2 users of this function actually +assign its value to unsigned int variable and only __xfrm6_output +assigns result of this function to signed variable but actually uses +as unsigned in further comparisons and calls. Change this function +to return unsigned int value. + +Fixes: 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE") +Reviewed-by: David Ahern +Signed-off-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/ip6_route.h | 2 +- + net/ipv6/xfrm6_output.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -214,7 +214,7 @@ static inline bool ipv6_anycast_destinat + int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + int (*output)(struct net *, struct sock *, struct sk_buff *)); + +-static inline int ip6_skb_dst_mtu(struct sk_buff *skb) ++static inline unsigned int ip6_skb_dst_mtu(struct sk_buff *skb) + { + struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? + inet6_sk(skb->sk) : NULL; +--- a/net/ipv6/xfrm6_output.c ++++ b/net/ipv6/xfrm6_output.c +@@ -146,7 +146,7 @@ static int __xfrm6_output(struct net *ne + { + struct dst_entry *dst = skb_dst(skb); + struct xfrm_state *x = dst->xfrm; +- int mtu; ++ unsigned int mtu; + bool toobig; + + #ifdef CONFIG_NETFILTER diff --git a/queue-4.14/net-moxa-fix-uaf-in-moxart_mac_probe.patch b/queue-4.14/net-moxa-fix-uaf-in-moxart_mac_probe.patch new file mode 100644 index 00000000000..549aa8f07dc --- /dev/null +++ b/queue-4.14/net-moxa-fix-uaf-in-moxart_mac_probe.patch @@ -0,0 +1,45 @@ +From c78eaeebe855fd93f2e77142ffd0404a54070d84 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Fri, 9 Jul 2021 17:09:53 +0300 +Subject: net: moxa: fix UAF in moxart_mac_probe + +From: Pavel Skripkin + +commit c78eaeebe855fd93f2e77142ffd0404a54070d84 upstream. + +In case of netdev registration failure the code path will +jump to init_fail label: + +init_fail: + netdev_err(ndev, "init failed\n"); + moxart_mac_free_memory(ndev); +irq_map_fail: + free_netdev(ndev); + return ret; + +So, there is no need to call free_netdev() before jumping +to error handling path, since it can cause UAF or double-free +bug. + +Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/moxa/moxart_ether.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/ethernet/moxa/moxart_ether.c ++++ b/drivers/net/ethernet/moxa/moxart_ether.c +@@ -538,10 +538,8 @@ static int moxart_mac_probe(struct platf + SET_NETDEV_DEV(ndev, &pdev->dev); + + ret = register_netdev(ndev); +- if (ret) { +- free_netdev(ndev); ++ if (ret) + goto init_fail; +- } + + netdev_dbg(ndev, "%s: IRQ=%d address=%pM\n", + __func__, ndev->irq, ndev->dev_addr); diff --git a/queue-4.14/net-qcom-emac-fix-uaf-in-emac_remove.patch b/queue-4.14/net-qcom-emac-fix-uaf-in-emac_remove.patch new file mode 100644 index 00000000000..4da3b486b33 --- /dev/null +++ b/queue-4.14/net-qcom-emac-fix-uaf-in-emac_remove.patch @@ -0,0 +1,39 @@ +From ad297cd2db8953e2202970e9504cab247b6c7cb4 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Fri, 9 Jul 2021 17:24:18 +0300 +Subject: net: qcom/emac: fix UAF in emac_remove + +From: Pavel Skripkin + +commit ad297cd2db8953e2202970e9504cab247b6c7cb4 upstream. + +adpt is netdev private data and it cannot be +used after free_netdev() call. Using adpt after free_netdev() +can cause UAF bug. Fix it by moving free_netdev() at the end of the +function. + +Fixes: 54e19bc74f33 ("net: qcom/emac: do not use devm on internal phy pdev") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/emac/emac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qualcomm/emac/emac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac.c +@@ -765,12 +765,13 @@ static int emac_remove(struct platform_d + + put_device(&adpt->phydev->mdio.dev); + mdiobus_unregister(adpt->mii_bus); +- free_netdev(netdev); + + if (adpt->phy.digital) + iounmap(adpt->phy.digital); + iounmap(adpt->phy.base); + ++ free_netdev(netdev); ++ + return 0; + } + diff --git a/queue-4.14/net-send-synack-packet-with-accepted-fwmark.patch b/queue-4.14/net-send-synack-packet-with-accepted-fwmark.patch new file mode 100644 index 00000000000..2d61b035ee0 --- /dev/null +++ b/queue-4.14/net-send-synack-packet-with-accepted-fwmark.patch @@ -0,0 +1,36 @@ +From 43b90bfad34bcb81b8a5bc7dc650800f4be1787e Mon Sep 17 00:00:00 2001 +From: Alexander Ovechkin +Date: Fri, 9 Jul 2021 18:28:23 +0300 +Subject: net: send SYNACK packet with accepted fwmark + +From: Alexander Ovechkin + +commit 43b90bfad34bcb81b8a5bc7dc650800f4be1787e upstream. + +commit e05a90ec9e16 ("net: reflect mark on tcp syn ack packets") +fixed IPv4 only. + +This part is for the IPv6 side. + +Fixes: e05a90ec9e16 ("net: reflect mark on tcp syn ack packets") +Signed-off-by: Alexander Ovechkin +Acked-by: Dmitry Yakunin +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/tcp_ipv6.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -486,7 +486,8 @@ static int tcp_v6_send_synack(const stru + opt = ireq->ipv6_opt; + if (!opt) + opt = rcu_dereference(np->opt); +- err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass); ++ err = ip6_xmit(sk, skb, fl6, skb->mark ? : sk->sk_mark, opt, ++ np->tclass); + rcu_read_unlock(); + err = net_xmit_eval(err); + } diff --git a/queue-4.14/net-ti-fix-uaf-in-tlan_remove_one.patch b/queue-4.14/net-ti-fix-uaf-in-tlan_remove_one.patch new file mode 100644 index 00000000000..620580e640f --- /dev/null +++ b/queue-4.14/net-ti-fix-uaf-in-tlan_remove_one.patch @@ -0,0 +1,35 @@ +From 0336f8ffece62f882ab3012820965a786a983f70 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Fri, 9 Jul 2021 17:58:29 +0300 +Subject: net: ti: fix UAF in tlan_remove_one + +From: Pavel Skripkin + +commit 0336f8ffece62f882ab3012820965a786a983f70 upstream. + +priv is netdev private data and it cannot be +used after free_netdev() call. Using priv after free_netdev() +can cause UAF bug. Fix it by moving free_netdev() at the end of the +function. + +Fixes: 1e0a8b13d355 ("tlan: cancel work at remove path") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/tlan.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/ti/tlan.c ++++ b/drivers/net/ethernet/ti/tlan.c +@@ -313,9 +313,8 @@ static void tlan_remove_one(struct pci_d + pci_release_regions(pdev); + #endif + +- free_netdev(dev); +- + cancel_work_sync(&priv->tlan_tqueue); ++ free_netdev(dev); + } + + static void tlan_start(struct net_device *dev) diff --git a/queue-4.14/net-validate-lwtstate-data-before-returning-from-skb_tunnel_info.patch b/queue-4.14/net-validate-lwtstate-data-before-returning-from-skb_tunnel_info.patch new file mode 100644 index 00000000000..fc369572ea9 --- /dev/null +++ b/queue-4.14/net-validate-lwtstate-data-before-returning-from-skb_tunnel_info.patch @@ -0,0 +1,62 @@ +From 67a9c94317402b826fc3db32afc8f39336803d97 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Fri, 9 Jul 2021 17:35:18 +0000 +Subject: net: validate lwtstate->data before returning from skb_tunnel_info() + +From: Taehee Yoo + +commit 67a9c94317402b826fc3db32afc8f39336803d97 upstream. + +skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info +type without validation. lwtstate->data can have various types such as +mpls_iptunnel_encap, etc and these are not compatible. +So skb_tunnel_info() should validate before returning that pointer. + +Splat looks like: +BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan] +Read of size 2 at addr ffff888106ec2698 by task ping/811 + +CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195 +Call Trace: + dump_stack_lvl+0x56/0x7b + print_address_description.constprop.8.cold.13+0x13/0x2ee + ? vxlan_get_route+0x418/0x4b0 [vxlan] + ? vxlan_get_route+0x418/0x4b0 [vxlan] + kasan_report.cold.14+0x83/0xdf + ? vxlan_get_route+0x418/0x4b0 [vxlan] + vxlan_get_route+0x418/0x4b0 [vxlan] + [ ... ] + vxlan_xmit_one+0x148b/0x32b0 [vxlan] + [ ... ] + vxlan_xmit+0x25c5/0x4780 [vxlan] + [ ... ] + dev_hard_start_xmit+0x1ae/0x6e0 + __dev_queue_xmit+0x1f39/0x31a0 + [ ... ] + neigh_xmit+0x2f9/0x940 + mpls_xmit+0x911/0x1600 [mpls_iptunnel] + lwtunnel_xmit+0x18f/0x450 + ip_finish_output2+0x867/0x2040 + [ ... ] + +Fixes: 61adedf3e3f1 ("route: move lwtunnel state to dst_entry") +Signed-off-by: Taehee Yoo +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/dst_metadata.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/include/net/dst_metadata.h ++++ b/include/net/dst_metadata.h +@@ -44,7 +44,9 @@ static inline struct ip_tunnel_info *skb + return &md_dst->u.tun_info; + + dst = skb_dst(skb); +- if (dst && dst->lwtstate) ++ if (dst && dst->lwtstate && ++ (dst->lwtstate->type == LWTUNNEL_ENCAP_IP || ++ dst->lwtstate->type == LWTUNNEL_ENCAP_IP6)) + return lwt_tun_info(dst->lwtstate); + + return NULL; diff --git a/queue-4.14/netfilter-ctnetlink-suspicious-rcu-usage-in-ctnetlink_dump_helpinfo.patch b/queue-4.14/netfilter-ctnetlink-suspicious-rcu-usage-in-ctnetlink_dump_helpinfo.patch new file mode 100644 index 00000000000..fa4d643100c --- /dev/null +++ b/queue-4.14/netfilter-ctnetlink-suspicious-rcu-usage-in-ctnetlink_dump_helpinfo.patch @@ -0,0 +1,72 @@ +From c23a9fd209bc6f8c1fa6ee303fdf037d784a1627 Mon Sep 17 00:00:00 2001 +From: Vasily Averin +Date: Thu, 1 Jul 2021 08:02:49 +0300 +Subject: netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo + +From: Vasily Averin + +commit c23a9fd209bc6f8c1fa6ee303fdf037d784a1627 upstream. + +Two patches listed below removed ctnetlink_dump_helpinfo call from under +rcu_read_lock. Now its rcu_dereference generates following warning: +============================= +WARNING: suspicious RCU usage +5.13.0+ #5 Not tainted +----------------------------- +net/netfilter/nf_conntrack_netlink.c:221 suspicious rcu_dereference_check() usage! + +other info that might help us debug this: +rcu_scheduler_active = 2, debug_locks = 1 +stack backtrace: +CPU: 1 PID: 2251 Comm: conntrack Not tainted 5.13.0+ #5 +Call Trace: + dump_stack+0x7f/0xa1 + ctnetlink_dump_helpinfo+0x134/0x150 [nf_conntrack_netlink] + ctnetlink_fill_info+0x2c2/0x390 [nf_conntrack_netlink] + ctnetlink_dump_table+0x13f/0x370 [nf_conntrack_netlink] + netlink_dump+0x10c/0x370 + __netlink_dump_start+0x1a7/0x260 + ctnetlink_get_conntrack+0x1e5/0x250 [nf_conntrack_netlink] + nfnetlink_rcv_msg+0x613/0x993 [nfnetlink] + netlink_rcv_skb+0x50/0x100 + nfnetlink_rcv+0x55/0x120 [nfnetlink] + netlink_unicast+0x181/0x260 + netlink_sendmsg+0x23f/0x460 + sock_sendmsg+0x5b/0x60 + __sys_sendto+0xf1/0x160 + __x64_sys_sendto+0x24/0x30 + do_syscall_64+0x36/0x70 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 49ca022bccc5 ("netfilter: ctnetlink: don't dump ct extensions of unconfirmed conntracks") +Fixes: 0b35f6031a00 ("netfilter: Remove duplicated rcu_read_lock.") +Signed-off-by: Vasily Averin +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_netlink.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -196,6 +196,7 @@ static int ctnetlink_dump_helpinfo(struc + if (!help) + return 0; + ++ rcu_read_lock(); + helper = rcu_dereference(help->helper); + if (!helper) + goto out; +@@ -211,9 +212,11 @@ static int ctnetlink_dump_helpinfo(struc + + nla_nest_end(skb, nest_helper); + out: ++ rcu_read_unlock(); + return 0; + + nla_put_failure: ++ rcu_read_unlock(); + return -1; + } + diff --git a/queue-4.14/series b/queue-4.14/series index d705d33e79b..da4311818f6 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -20,3 +20,13 @@ rtc-max77686-do-not-enforce-incorrect-interrupt-trig.patch scsi-aic7xxx-fix-unintentional-sign-extension-issue-.patch scsi-libfc-fix-array-index-out-of-bound-exception.patch sched-fair-fix-cfs-bandwidth-hrtimer-expiry-type.patch +net-ipv6-fix-return-value-of-ip6_skb_dst_mtu.patch +netfilter-ctnetlink-suspicious-rcu-usage-in-ctnetlink_dump_helpinfo.patch +net-bridge-sync-fdb-to-new-unicast-filtering-ports.patch +net-bcmgenet-ensure-all-tx-rx-queues-dmas-are-disabled.patch +net-moxa-fix-uaf-in-moxart_mac_probe.patch +net-qcom-emac-fix-uaf-in-emac_remove.patch +net-ti-fix-uaf-in-tlan_remove_one.patch +net-send-synack-packet-with-accepted-fwmark.patch +net-validate-lwtstate-data-before-returning-from-skb_tunnel_info.patch +dma-buf-sync_file-don-t-leak-fences-on-merge-failure.patch