From: Greg Kroah-Hartman Date: Sat, 31 Oct 2020 09:49:16 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v5.4.74~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=93e163d0657006bf69505eaceab3473ec8ab5740;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch tipc-fix-memory-leak-caused-by-tipc_buf_append.patch --- diff --git a/queue-4.9/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch b/queue-4.9/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch new file mode 100644 index 00000000000..9a84a92f8f4 --- /dev/null +++ b/queue-4.9/ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch @@ -0,0 +1,69 @@ +From foo@baz Sat Oct 31 10:48:31 AM CET 2020 +From: Andrew Gabbasov +Date: Mon, 26 Oct 2020 05:21:30 -0500 +Subject: ravb: Fix bit fields checking in ravb_hwtstamp_get() + +From: Andrew Gabbasov + +[ Upstream commit 68b9f0865b1ef545da180c57d54b82c94cb464a4 ] + +In the function ravb_hwtstamp_get() in ravb_main.c with the existing +values for RAVB_RXTSTAMP_TYPE_V2_L2_EVENT (0x2) and RAVB_RXTSTAMP_TYPE_ALL +(0x6) + +if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT) + config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; +else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL) + config.rx_filter = HWTSTAMP_FILTER_ALL; + +if the test on RAVB_RXTSTAMP_TYPE_ALL should be true, +it will never be reached. + +This issue can be verified with 'hwtstamp_config' testing program +(tools/testing/selftests/net/hwtstamp_config.c). Setting filter type +to ALL and subsequent retrieving it gives incorrect value: + +$ hwtstamp_config eth0 OFF ALL +flags = 0 +tx_type = OFF +rx_filter = ALL +$ hwtstamp_config eth0 +flags = 0 +tx_type = OFF +rx_filter = PTP_V2_L2_EVENT + +Correct this by converting if-else's to switch. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Reported-by: Julia Lawall +Signed-off-by: Andrew Gabbasov +Reviewed-by: Sergei Shtylyov +Link: https://lore.kernel.org/r/20201026102130.29368-1-andrew_gabbasov@mentor.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/ravb_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1729,12 +1729,16 @@ static int ravb_hwtstamp_get(struct net_ + config.flags = 0; + config.tx_type = priv->tstamp_tx_ctrl ? HWTSTAMP_TX_ON : + HWTSTAMP_TX_OFF; +- if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT) ++ switch (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE) { ++ case RAVB_RXTSTAMP_TYPE_V2_L2_EVENT: + config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; +- else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL) ++ break; ++ case RAVB_RXTSTAMP_TYPE_ALL: + config.rx_filter = HWTSTAMP_FILTER_ALL; +- else ++ break; ++ default: + config.rx_filter = HWTSTAMP_FILTER_NONE; ++ } + + return copy_to_user(req->ifr_data, &config, sizeof(config)) ? + -EFAULT : 0; diff --git a/queue-4.9/series b/queue-4.9/series index 8e061647c55..068533b2184 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -2,3 +2,5 @@ sunrpc-econnrefused-should-cause-a-rebind.patch scripts-setlocalversion-make-git-describe-output-more-reliable.patch powerpc-powernv-opal-dump-use-irq_handled-instead-of-numbers-in-interrupt-handler.patch efivarfs-replace-invalid-slashes-with-exclamation-marks-in-dentries.patch +ravb-fix-bit-fields-checking-in-ravb_hwtstamp_get.patch +tipc-fix-memory-leak-caused-by-tipc_buf_append.patch diff --git a/queue-4.9/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch b/queue-4.9/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch new file mode 100644 index 00000000000..857629627b4 --- /dev/null +++ b/queue-4.9/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch @@ -0,0 +1,72 @@ +From foo@baz Sat Oct 31 10:48:31 AM CET 2020 +From: Tung Nguyen +Date: Tue, 27 Oct 2020 10:24:03 +0700 +Subject: tipc: fix memory leak caused by tipc_buf_append() + +From: Tung Nguyen + +[ Upstream commit ceb1eb2fb609c88363e06618b8d4bbf7815a4e03 ] + +Commit ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") +replaced skb_unshare() with skb_copy() to not reduce the data reference +counter of the original skb intentionally. This is not the correct +way to handle the cloned skb because it causes memory leak in 2 +following cases: + 1/ Sending multicast messages via broadcast link + The original skb list is cloned to the local skb list for local + destination. After that, the data reference counter of each skb + in the original list has the value of 2. This causes each skb not + to be freed after receiving ACK: + tipc_link_advance_transmq() + { + ... + /* release skb */ + __skb_unlink(skb, &l->transmq); + kfree_skb(skb); <-- memory exists after being freed + } + + 2/ Sending multicast messages via replicast link + Similar to the above case, each skb cannot be freed after purging + the skb list: + tipc_mcast_xmit() + { + ... + __skb_queue_purge(pkts); <-- memory exists after being freed + } + +This commit fixes this issue by using skb_unshare() instead. Besides, +to avoid use-after-free error reported by KASAN, the pointer to the +fragment is set to NULL before calling skb_unshare() to make sure that +the original skb is not freed after freeing the fragment 2 times in +case skb_unshare() returns NULL. + +Fixes: ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") +Acked-by: Jon Maloy +Reported-by: Thang Hoang Ngo +Signed-off-by: Tung Nguyen +Reviewed-by: Xin Long +Acked-by: Cong Wang +Link: https://lore.kernel.org/r/20201027032403.1823-1-tung.q.nguyen@dektech.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/msg.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/net/tipc/msg.c ++++ b/net/tipc/msg.c +@@ -140,12 +140,11 @@ int tipc_buf_append(struct sk_buff **hea + if (fragid == FIRST_FRAGMENT) { + if (unlikely(head)) + goto err; +- if (skb_cloned(frag)) +- frag = skb_copy(frag, GFP_ATOMIC); ++ *buf = NULL; ++ frag = skb_unshare(frag, GFP_ATOMIC); + if (unlikely(!frag)) + goto err; + head = *headbuf = frag; +- *buf = NULL; + TIPC_SKB_CB(head)->tail = NULL; + if (skb_is_nonlinear(head)) { + skb_walk_frags(head, tail) {