From: Greg Kroah-Hartman Date: Fri, 27 Aug 2021 10:15:42 +0000 (+0200) Subject: 5.13-stable patches X-Git-Tag: v4.4.283~75 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b64fd629d2332b575346b3d16a0736c35d2af14a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.13-stable patches added patches: bpf-fix-ringbuf-helper-function-compatibility.patch net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch --- diff --git a/queue-5.13/bpf-fix-ringbuf-helper-function-compatibility.patch b/queue-5.13/bpf-fix-ringbuf-helper-function-compatibility.patch new file mode 100644 index 00000000000..58499673946 --- /dev/null +++ b/queue-5.13/bpf-fix-ringbuf-helper-function-compatibility.patch @@ -0,0 +1,54 @@ +From 5b029a32cfe4600f5e10e36b41778506b90fd4de Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Mon, 23 Aug 2021 21:02:09 +0200 +Subject: bpf: Fix ringbuf helper function compatibility + +From: Daniel Borkmann + +commit 5b029a32cfe4600f5e10e36b41778506b90fd4de upstream. + +Commit 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support +for it") extended check_map_func_compatibility() by enforcing map -> helper +function match, but not helper -> map type match. + +Due to this all of the bpf_ringbuf_*() helper functions could be used with +a wrong map type such as array or hash map, leading to invalid access due +to type confusion. + +Also, both BPF_FUNC_ringbuf_{submit,discard} have ARG_PTR_TO_ALLOC_MEM as +argument and not a BPF map. Therefore, their check_map_func_compatibility() +presence is incorrect since it's only for map type checking. + +Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") +Reported-by: Ryota Shiga (Flatt Security) +Signed-off-by: Daniel Borkmann +Acked-by: Alexei Starovoitov +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -5148,8 +5148,6 @@ static int check_map_func_compatibility( + case BPF_MAP_TYPE_RINGBUF: + if (func_id != BPF_FUNC_ringbuf_output && + func_id != BPF_FUNC_ringbuf_reserve && +- func_id != BPF_FUNC_ringbuf_submit && +- func_id != BPF_FUNC_ringbuf_discard && + func_id != BPF_FUNC_ringbuf_query) + goto error; + break; +@@ -5258,6 +5256,12 @@ static int check_map_func_compatibility( + if (map->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY) + goto error; + break; ++ case BPF_FUNC_ringbuf_output: ++ case BPF_FUNC_ringbuf_reserve: ++ case BPF_FUNC_ringbuf_query: ++ if (map->map_type != BPF_MAP_TYPE_RINGBUF) ++ goto error; ++ break; + case BPF_FUNC_get_stackid: + if (map->map_type != BPF_MAP_TYPE_STACK_TRACE) + goto error; diff --git a/queue-5.13/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch b/queue-5.13/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch new file mode 100644 index 00000000000..8b81b550c73 --- /dev/null +++ b/queue-5.13/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch @@ -0,0 +1,47 @@ +From 7e78c597c3ebfd0cb329aa09a838734147e4f117 Mon Sep 17 00:00:00 2001 +From: Xiaolong Huang +Date: Fri, 20 Aug 2021 03:50:34 +0800 +Subject: net: qrtr: fix another OOB Read in qrtr_endpoint_post + +From: Xiaolong Huang + +commit 7e78c597c3ebfd0cb329aa09a838734147e4f117 upstream. + +This check was incomplete, did not consider size is 0: + + if (len != ALIGN(size, 4) + hdrlen) + goto err; + +if size from qrtr_hdr is 0, the result of ALIGN(size, 4) +will be 0, In case of len == hdrlen and size == 0 +in header this check won't fail and + + if (cb->type == QRTR_TYPE_NEW_SERVER) { + /* Remote node endpoint can bridge other distant nodes */ + const struct qrtr_ctrl_pkt *pkt = data + hdrlen; + + qrtr_node_assign(node, le32_to_cpu(pkt->server.node)); + } + +will also read out of bound from data, which is hdrlen allocated block. + +Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets") +Fixes: ad9d24c9429e ("net: qrtr: fix OOB Read in qrtr_endpoint_post") +Signed-off-by: Xiaolong Huang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/qrtr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -493,7 +493,7 @@ int qrtr_endpoint_post(struct qrtr_endpo + goto err; + } + +- if (len != ALIGN(size, 4) + hdrlen) ++ if (!size || len != ALIGN(size, 4) + hdrlen) + goto err; + + if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA && diff --git a/queue-5.13/series b/queue-5.13/series index df41c568995..737806f2afb 100644 --- a/queue-5.13/series +++ b/queue-5.13/series @@ -1 +1,2 @@ net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch +bpf-fix-ringbuf-helper-function-compatibility.patch