From: Greg Kroah-Hartman Date: Sat, 31 Oct 2020 09:48:03 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v5.4.74~23 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=749fcbce54e9b2cd67137926fd67197929afe7d2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: gtp-fix-an-use-before-init-in-gtp_newlink.patch ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch tipc-fix-memory-leak-caused-by-tipc_buf_append.patch --- diff --git a/queue-4.14/gtp-fix-an-use-before-init-in-gtp_newlink.patch b/queue-4.14/gtp-fix-an-use-before-init-in-gtp_newlink.patch new file mode 100644 index 00000000000..00e3a821f38 --- /dev/null +++ b/queue-4.14/gtp-fix-an-use-before-init-in-gtp_newlink.patch @@ -0,0 +1,86 @@ +From foo@baz Sat Oct 31 10:39:08 AM CET 2020 +From: Masahiro Fujiwara +Date: Tue, 27 Oct 2020 20:48:46 +0900 +Subject: gtp: fix an use-before-init in gtp_newlink() + +From: Masahiro Fujiwara + +[ Upstream commit 51467431200b91682b89d31317e35dcbca1469ce ] + +*_pdp_find() from gtp_encap_recv() would trigger a crash when a peer +sends GTP packets while creating new GTP device. + +RIP: 0010:gtp1_pdp_find.isra.0+0x68/0x90 [gtp] + +Call Trace: + + gtp_encap_recv+0xc2/0x2e0 [gtp] + ? gtp1_pdp_find.isra.0+0x90/0x90 [gtp] + udp_queue_rcv_one_skb+0x1fe/0x530 + udp_queue_rcv_skb+0x40/0x1b0 + udp_unicast_rcv_skb.isra.0+0x78/0x90 + __udp4_lib_rcv+0x5af/0xc70 + udp_rcv+0x1a/0x20 + ip_protocol_deliver_rcu+0xc5/0x1b0 + ip_local_deliver_finish+0x48/0x50 + ip_local_deliver+0xe5/0xf0 + ? ip_protocol_deliver_rcu+0x1b0/0x1b0 + +gtp_encap_enable() should be called after gtp_hastable_new() otherwise +*_pdp_find() will access the uninitialized hash table. + +Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") +Signed-off-by: Masahiro Fujiwara +Link: https://lore.kernel.org/r/20201027114846.3924-1-fujiwara.masahiro@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/gtp.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -667,10 +667,6 @@ static int gtp_newlink(struct net *src_n + + gtp = netdev_priv(dev); + +- err = gtp_encap_enable(gtp, data); +- if (err < 0) +- return err; +- + if (!data[IFLA_GTP_PDP_HASHSIZE]) { + hashsize = 1024; + } else { +@@ -681,12 +677,16 @@ static int gtp_newlink(struct net *src_n + + err = gtp_hashtable_new(gtp, hashsize); + if (err < 0) +- goto out_encap; ++ return err; ++ ++ err = gtp_encap_enable(gtp, data); ++ if (err < 0) ++ goto out_hashtable; + + err = register_netdevice(dev); + if (err < 0) { + netdev_dbg(dev, "failed to register new netdev %d\n", err); +- goto out_hashtable; ++ goto out_encap; + } + + gn = net_generic(dev_net(dev), gtp_net_id); +@@ -697,11 +697,11 @@ static int gtp_newlink(struct net *src_n + + return 0; + ++out_encap: ++ gtp_encap_disable(gtp); + out_hashtable: + kfree(gtp->addr_hash); + kfree(gtp->tid_hash); +-out_encap: +- gtp_encap_disable(gtp); + return err; + } + diff --git a/queue-4.14/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch b/queue-4.14/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch new file mode 100644 index 00000000000..8dee2c2fc32 --- /dev/null +++ b/queue-4.14/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch @@ -0,0 +1,69 @@ +From foo@baz Sat Oct 31 10:39:08 AM CET 2020 +From: Andrew Gabbasov +Date: Mon, 26 Oct 2020 05:21:30 -0500 +Subject: ravb: Fix bit fields checking in ravb_hwtstamp_get() + +From: Andrew Gabbasov + +[ Upstream commit 68b9f0865b1ef545da180c57d54b82c94cb464a4 ] + +In the function ravb_hwtstamp_get() in ravb_main.c with the existing +values for RAVB_RXTSTAMP_TYPE_V2_L2_EVENT (0x2) and RAVB_RXTSTAMP_TYPE_ALL +(0x6) + +if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT) + config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; +else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL) + config.rx_filter = HWTSTAMP_FILTER_ALL; + +if the test on RAVB_RXTSTAMP_TYPE_ALL should be true, +it will never be reached. + +This issue can be verified with 'hwtstamp_config' testing program +(tools/testing/selftests/net/hwtstamp_config.c). Setting filter type +to ALL and subsequent retrieving it gives incorrect value: + +$ hwtstamp_config eth0 OFF ALL +flags = 0 +tx_type = OFF +rx_filter = ALL +$ hwtstamp_config eth0 +flags = 0 +tx_type = OFF +rx_filter = PTP_V2_L2_EVENT + +Correct this by converting if-else's to switch. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Reported-by: Julia Lawall +Signed-off-by: Andrew Gabbasov +Reviewed-by: Sergei Shtylyov +Link: https://lore.kernel.org/r/20201026102130.29368-1-andrew_gabbasov@mentor.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/ravb_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1768,12 +1768,16 @@ static int ravb_hwtstamp_get(struct net_ + config.flags = 0; + config.tx_type = priv->tstamp_tx_ctrl ? HWTSTAMP_TX_ON : + HWTSTAMP_TX_OFF; +- if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT) ++ switch (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE) { ++ case RAVB_RXTSTAMP_TYPE_V2_L2_EVENT: + config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; +- else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL) ++ break; ++ case RAVB_RXTSTAMP_TYPE_ALL: + config.rx_filter = HWTSTAMP_FILTER_ALL; +- else ++ break; ++ default: + config.rx_filter = HWTSTAMP_FILTER_NONE; ++ } + + return copy_to_user(req->ifr_data, &config, sizeof(config)) ? + -EFAULT : 0; diff --git a/queue-4.14/series b/queue-4.14/series index f706d71f30c..1051c3f0cf3 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -1,3 +1,6 @@ scripts-setlocalversion-make-git-describe-output-more-reliable.patch arm64-link-with-z-norelro-regardless-of-config_relocatable.patch efivarfs-replace-invalid-slashes-with-exclamation-marks-in-dentries.patch +gtp-fix-an-use-before-init-in-gtp_newlink.patch +ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch +tipc-fix-memory-leak-caused-by-tipc_buf_append.patch diff --git a/queue-4.14/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch b/queue-4.14/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch new file mode 100644 index 00000000000..454f3abe779 --- /dev/null +++ b/queue-4.14/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch @@ -0,0 +1,72 @@ +From foo@baz Sat Oct 31 10:39:08 AM CET 2020 +From: Tung Nguyen +Date: Tue, 27 Oct 2020 10:24:03 +0700 +Subject: tipc: fix memory leak caused by tipc_buf_append() + +From: Tung Nguyen + +[ Upstream commit ceb1eb2fb609c88363e06618b8d4bbf7815a4e03 ] + +Commit ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") +replaced skb_unshare() with skb_copy() to not reduce the data reference +counter of the original skb intentionally. This is not the correct +way to handle the cloned skb because it causes memory leak in 2 +following cases: + 1/ Sending multicast messages via broadcast link + The original skb list is cloned to the local skb list for local + destination. After that, the data reference counter of each skb + in the original list has the value of 2. This causes each skb not + to be freed after receiving ACK: + tipc_link_advance_transmq() + { + ... + /* release skb */ + __skb_unlink(skb, &l->transmq); + kfree_skb(skb); <-- memory exists after being freed + } + + 2/ Sending multicast messages via replicast link + Similar to the above case, each skb cannot be freed after purging + the skb list: + tipc_mcast_xmit() + { + ... + __skb_queue_purge(pkts); <-- memory exists after being freed + } + +This commit fixes this issue by using skb_unshare() instead. Besides, +to avoid use-after-free error reported by KASAN, the pointer to the +fragment is set to NULL before calling skb_unshare() to make sure that +the original skb is not freed after freeing the fragment 2 times in +case skb_unshare() returns NULL. + +Fixes: ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") +Acked-by: Jon Maloy +Reported-by: Thang Hoang Ngo +Signed-off-by: Tung Nguyen +Reviewed-by: Xin Long +Acked-by: Cong Wang +Link: https://lore.kernel.org/r/20201027032403.1823-1-tung.q.nguyen@dektech.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/msg.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/net/tipc/msg.c ++++ b/net/tipc/msg.c +@@ -140,12 +140,11 @@ int tipc_buf_append(struct sk_buff **hea + if (fragid == FIRST_FRAGMENT) { + if (unlikely(head)) + goto err; +- if (skb_cloned(frag)) +- frag = skb_copy(frag, GFP_ATOMIC); ++ *buf = NULL; ++ frag = skb_unshare(frag, GFP_ATOMIC); + if (unlikely(!frag)) + goto err; + head = *headbuf = frag; +- *buf = NULL; + TIPC_SKB_CB(head)->tail = NULL; + if (skb_is_nonlinear(head)) { + skb_walk_frags(head, tail) {