From 90262250dc68957800df23e0d1964b51e7750b18 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 23 Oct 2023 10:52:20 +0200 Subject: [PATCH] 5.4-stable patches added patches: bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch xfrm6-fix-inet6_dev-refcount-underflow-problem.patch --- ...check-and-pad-hci_mon_new_index-name.patch | 65 +++++++++++++++++++ ...lab-oob-read-in-create_monitor_event.patch | 31 +++++++++ queue-5.4/series | 3 + ...inet6_dev-refcount-underflow-problem.patch | 56 ++++++++++++++++ 4 files changed, 155 insertions(+) create mode 100644 queue-5.4/bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch create mode 100644 queue-5.4/bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch create mode 100644 queue-5.4/xfrm6-fix-inet6_dev-refcount-underflow-problem.patch diff --git a/queue-5.4/bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch b/queue-5.4/bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch new file mode 100644 index 00000000000..d10d8620e86 --- /dev/null +++ b/queue-5.4/bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch @@ -0,0 +1,65 @@ +From cb3871b1cd135a6662b732fbc6b3db4afcdb4a64 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 11 Oct 2023 09:31:44 -0700 +Subject: Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name + +From: Kees Cook + +commit cb3871b1cd135a6662b732fbc6b3db4afcdb4a64 upstream. + +The code pattern of memcpy(dst, src, strlen(src)) is almost always +wrong. In this case it is wrong because it leaves memory uninitialized +if it is less than sizeof(ni->name), and overflows ni->name when longer. + +Normally strtomem_pad() could be used here, but since ni->name is a +trailing array in struct hci_mon_new_index, compilers that don't support +-fstrict-flex-arrays=3 can't tell how large this array is via +__builtin_object_size(). Instead, open-code the helper and use sizeof() +since it will work correctly. + +Additionally mark ni->name as __nonstring since it appears to not be a +%NUL terminated C string. + +Cc: Luiz Augusto von Dentz +Cc: Edward AD +Cc: Marcel Holtmann +Cc: Johan Hedberg +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: linux-bluetooth@vger.kernel.org +Cc: netdev@vger.kernel.org +Fixes: 18f547f3fc07 ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event") +Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/ +Signed-off-by: Kees Cook +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + include/net/bluetooth/hci_mon.h | 2 +- + net/bluetooth/hci_sock.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/include/net/bluetooth/hci_mon.h ++++ b/include/net/bluetooth/hci_mon.h +@@ -54,7 +54,7 @@ struct hci_mon_new_index { + __u8 type; + __u8 bus; + bdaddr_t bdaddr; +- char name[8]; ++ char name[8] __nonstring; + } __packed; + #define HCI_MON_NEW_INDEX_SIZE 16 + +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -430,7 +430,8 @@ static struct sk_buff *create_monitor_ev + ni->type = hdev->dev_type; + ni->bus = hdev->bus; + bacpy(&ni->bdaddr, &hdev->bdaddr); +- memcpy(ni->name, hdev->name, strlen(hdev->name)); ++ memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name, ++ strnlen(hdev->name, sizeof(ni->name)), '\0'); + + opcode = cpu_to_le16(HCI_MON_NEW_INDEX); + break; diff --git a/queue-5.4/bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch b/queue-5.4/bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch new file mode 100644 index 00000000000..80cdddd2bcf --- /dev/null +++ b/queue-5.4/bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch @@ -0,0 +1,31 @@ +From 18f547f3fc074500ab5d419cf482240324e73a7e Mon Sep 17 00:00:00 2001 +From: Edward AD +Date: Tue, 10 Oct 2023 13:36:57 +0800 +Subject: Bluetooth: hci_sock: fix slab oob read in create_monitor_event + +From: Edward AD + +commit 18f547f3fc074500ab5d419cf482240324e73a7e upstream. + +When accessing hdev->name, the actual string length should prevail + +Reported-by: syzbot+c90849c50ed209d77689@syzkaller.appspotmail.com +Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings") +Signed-off-by: Edward AD +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_sock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -430,7 +430,7 @@ static struct sk_buff *create_monitor_ev + ni->type = hdev->dev_type; + ni->bus = hdev->bus; + bacpy(&ni->bdaddr, &hdev->bdaddr); +- memcpy(ni->name, hdev->name, 8); ++ memcpy(ni->name, hdev->name, strlen(hdev->name)); + + opcode = cpu_to_le16(HCI_MON_NEW_INDEX); + break; diff --git a/queue-5.4/series b/queue-5.4/series index 961ec343b6a..aa2c52610bf 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -119,3 +119,6 @@ gpio-vf610-mask-the-gpio-irq-in-system-suspend-and-s.patch phy-mapphone-mdm6600-fix-runtime-disable-on-probe.patch phy-mapphone-mdm6600-fix-runtime-pm-for-remove.patch phy-mapphone-mdm6600-fix-pinctrl_pm-handling-for-sle.patch +bluetooth-hci_sock-fix-slab-oob-read-in-create_monitor_event.patch +bluetooth-hci_sock-correctly-bounds-check-and-pad-hci_mon_new_index-name.patch +xfrm6-fix-inet6_dev-refcount-underflow-problem.patch diff --git a/queue-5.4/xfrm6-fix-inet6_dev-refcount-underflow-problem.patch b/queue-5.4/xfrm6-fix-inet6_dev-refcount-underflow-problem.patch new file mode 100644 index 00000000000..9e745c9e529 --- /dev/null +++ b/queue-5.4/xfrm6-fix-inet6_dev-refcount-underflow-problem.patch @@ -0,0 +1,56 @@ +From e18f0e6509ebb2ed91524ab5b591218445998b92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Sep 2023 19:20:41 +0800 +Subject: xfrm6: fix inet6_dev refcount underflow problem + +From: Zhang Changzhong + +[ Upstream commit cc9b364bb1d58d3dae270c7a931a8cc717dc2b3b ] + +There are race conditions that may lead to inet6_dev refcount underflow +in xfrm6_dst_destroy() and rt6_uncached_list_flush_dev(). + +One of the refcount underflow bugs is shown below: + (cpu 1) | (cpu 2) +xfrm6_dst_destroy() | + ... | + in6_dev_put() | + | rt6_uncached_list_flush_dev() + ... | ... + | in6_dev_put() + rt6_uncached_list_del() | ... + ... | + +xfrm6_dst_destroy() calls rt6_uncached_list_del() after in6_dev_put(), +so rt6_uncached_list_flush_dev() has a chance to call in6_dev_put() +again for the same inet6_dev. + +Fix it by moving in6_dev_put() after rt6_uncached_list_del() in +xfrm6_dst_destroy(). + +Fixes: 510c321b5571 ("xfrm: reuse uncached_list to track xdsts") +Signed-off-by: Zhang Changzhong +Reviewed-by: Xin Long +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/xfrm6_policy.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/ipv6/xfrm6_policy.c ++++ b/net/ipv6/xfrm6_policy.c +@@ -120,11 +120,11 @@ static void xfrm6_dst_destroy(struct dst + { + struct xfrm_dst *xdst = (struct xfrm_dst *)dst; + +- if (likely(xdst->u.rt6.rt6i_idev)) +- in6_dev_put(xdst->u.rt6.rt6i_idev); + dst_destroy_metrics_generic(dst); + if (xdst->u.rt6.rt6i_uncached_list) + rt6_uncached_list_del(&xdst->u.rt6); ++ if (likely(xdst->u.rt6.rt6i_idev)) ++ in6_dev_put(xdst->u.rt6.rt6i_idev); + xfrm_dst_destroy(xdst); + } + -- 2.47.3