From 24eb2c595b9d1031251874fd1214429075c88706 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 15 Apr 2021 15:40:24 +0200 Subject: [PATCH] 4.19-stable patches added patches: netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch --- ...-only-advertise-eee-for-supported-mo.patch | 9 +- ...-match-target-pad-out-of-bound-write.patch | 100 ++++++++++++++++++ queue-4.19/series | 1 + 3 files changed, 103 insertions(+), 7 deletions(-) create mode 100644 queue-4.19/netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch diff --git a/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch b/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch index 44166efd8d1..66c1aead48e 100644 --- a/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch +++ b/queue-4.19/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch @@ -16,11 +16,9 @@ Signed-off-by: David S. Miller Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin --- - drivers/net/phy/bcm-phy-lib.c | 11 ++++++++--- + drivers/net/phy/bcm-phy-lib.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) -diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c -index e10e7b54ec4b..7e5892597533 100644 --- a/drivers/net/phy/bcm-phy-lib.c +++ b/drivers/net/phy/bcm-phy-lib.c @@ -198,7 +198,7 @@ EXPORT_SYMBOL_GPL(bcm_phy_enable_apd); @@ -32,7 +30,7 @@ index e10e7b54ec4b..7e5892597533 100644 /* Enable EEE at PHY level */ val = phy_read_mmd(phydev, MDIO_MMD_AN, BRCM_CL45VEN_EEE_CONTROL); -@@ -217,10 +217,15 @@ int bcm_phy_set_eee(struct phy_device *phydev, bool enable) +@@ -217,10 +217,15 @@ int bcm_phy_set_eee(struct phy_device *p if (val < 0) return val; @@ -50,6 +48,3 @@ index e10e7b54ec4b..7e5892597533 100644 phy_write_mmd(phydev, MDIO_MMD_AN, BCM_CL45VEN_EEE_ADV, (u32)val); --- -2.30.2 - diff --git a/queue-4.19/netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch b/queue-4.19/netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch new file mode 100644 index 00000000000..26f86796953 --- /dev/null +++ b/queue-4.19/netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch @@ -0,0 +1,100 @@ +From b29c457a6511435960115c0f548c4360d5f4801d Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 7 Apr 2021 21:38:57 +0200 +Subject: netfilter: x_tables: fix compat match/target pad out-of-bound write + +From: Florian Westphal + +commit b29c457a6511435960115c0f548c4360d5f4801d upstream. + +xt_compat_match/target_from_user doesn't check that zeroing the area +to start of next rule won't write past end of allocated ruleset blob. + +Remove this code and zero the entire blob beforehand. + +Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com +Reported-by: Andy Nguyen +Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/netfilter/arp_tables.c | 2 ++ + net/ipv4/netfilter/ip_tables.c | 2 ++ + net/ipv6/netfilter/ip6_tables.c | 2 ++ + net/netfilter/x_tables.c | 10 ++-------- + 4 files changed, 8 insertions(+), 8 deletions(-) + +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -1195,6 +1195,8 @@ static int translate_compat_table(struct + if (!newinfo) + goto out_unlock; + ++ memset(newinfo->entries, 0, size); ++ + newinfo->number = compatr->num_entries; + for (i = 0; i < NF_ARP_NUMHOOKS; i++) { + newinfo->hook_entry[i] = compatr->hook_entry[i]; +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -1433,6 +1433,8 @@ translate_compat_table(struct net *net, + if (!newinfo) + goto out_unlock; + ++ memset(newinfo->entries, 0, size); ++ + newinfo->number = compatr->num_entries; + for (i = 0; i < NF_INET_NUMHOOKS; i++) { + newinfo->hook_entry[i] = compatr->hook_entry[i]; +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -1448,6 +1448,8 @@ translate_compat_table(struct net *net, + if (!newinfo) + goto out_unlock; + ++ memset(newinfo->entries, 0, size); ++ + newinfo->number = compatr->num_entries; + for (i = 0; i < NF_INET_NUMHOOKS; i++) { + newinfo->hook_entry[i] = compatr->hook_entry[i]; +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -738,7 +738,7 @@ void xt_compat_match_from_user(struct xt + { + const struct xt_match *match = m->u.kernel.match; + struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m; +- int pad, off = xt_compat_match_offset(match); ++ int off = xt_compat_match_offset(match); + u_int16_t msize = cm->u.user.match_size; + char name[sizeof(m->u.user.name)]; + +@@ -748,9 +748,6 @@ void xt_compat_match_from_user(struct xt + match->compat_from_user(m->data, cm->data); + else + memcpy(m->data, cm->data, msize - sizeof(*cm)); +- pad = XT_ALIGN(match->matchsize) - match->matchsize; +- if (pad > 0) +- memset(m->data + match->matchsize, 0, pad); + + msize += off; + m->u.user.match_size = msize; +@@ -1121,7 +1118,7 @@ void xt_compat_target_from_user(struct x + { + const struct xt_target *target = t->u.kernel.target; + struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t; +- int pad, off = xt_compat_target_offset(target); ++ int off = xt_compat_target_offset(target); + u_int16_t tsize = ct->u.user.target_size; + char name[sizeof(t->u.user.name)]; + +@@ -1131,9 +1128,6 @@ void xt_compat_target_from_user(struct x + target->compat_from_user(t->data, ct->data); + else + memcpy(t->data, ct->data, tsize - sizeof(*ct)); +- pad = XT_ALIGN(target->targetsize) - target->targetsize; +- if (pad > 0) +- memset(t->data + target->targetsize, 0, pad); + + tsize += off; + t->u.user.target_size = tsize; diff --git a/queue-4.19/series b/queue-4.19/series index a84f7b110c0..e0691bb1526 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -7,3 +7,4 @@ block-only-update-parent-bi_status-when-bio-fail.patch riscv-entry-fix-misaligned-base-for-excp_vect_table.patch net-phy-broadcom-only-advertise-eee-for-supported-mo.patch staging-m57621-mmc-delete-driver-from-the-tree.patch +netfilter-x_tables-fix-compat-match-target-pad-out-of-bound-write.patch -- 2.47.3