From f362a1358f395f8b75c81cfd9e4e35ef6a268536 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 24 Oct 2021 14:11:36 +0200 Subject: [PATCH] 4.19-stable patches added patches: isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch --- ...nr-to-avoid-array-index-out-of-bound.patch | 64 +++++++++++++++++++ ...-instead-of-m-for-bool-config-option.patch | 30 +++++++++ ...i-fix-the-uaf-of-rf_conn_info-object.patch | 34 ++++++++++ queue-4.19/series | 3 + 4 files changed, 131 insertions(+) create mode 100644 queue-4.19/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch create mode 100644 queue-4.19/netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch create mode 100644 queue-4.19/nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch diff --git a/queue-4.19/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch b/queue-4.19/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch new file mode 100644 index 00000000000..2472c7ab465 --- /dev/null +++ b/queue-4.19/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch @@ -0,0 +1,64 @@ +From 1f3e2e97c003f80c4b087092b225c8787ff91e4d Mon Sep 17 00:00:00 2001 +From: Xiaolong Huang +Date: Fri, 8 Oct 2021 14:58:30 +0800 +Subject: isdn: cpai: check ctr->cnr to avoid array index out of bound + +From: Xiaolong Huang + +commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d upstream. + +The cmtp_add_connection() would add a cmtp session to a controller +and run a kernel thread to process cmtp. + + __module_get(THIS_MODULE); + session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", + session->num); + +During this process, the kernel thread would call detach_capi_ctr() +to detach a register controller. if the controller +was not attached yet, detach_capi_ctr() would +trigger an array-index-out-bounds bug. + +[ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in +drivers/isdn/capi/kcapi.c:483:21 +[ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' +[ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted +5.15.0-rc2+ #8 +[ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, +1996), BIOS 1.14.0-2 04/01/2014 +[ 46.870107][ T6479] Call Trace: +[ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d +[ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 +[ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 +[ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 +[ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 +[ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 +[ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 +[ 46.874256][ T6479] kthread+0x147/0x170 +[ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 +[ 46.875248][ T6479] ret_from_fork+0x1f/0x30 +[ 46.875773][ T6479] + +Signed-off-by: Xiaolong Huang +Acked-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/isdn/capi/kcapi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/isdn/capi/kcapi.c ++++ b/drivers/isdn/capi/kcapi.c +@@ -565,6 +565,11 @@ int detach_capi_ctr(struct capi_ctr *ctr + + ctr_down(ctr, CAPI_CTR_DETACHED); + ++ if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) { ++ err = -EINVAL; ++ goto unlock_out; ++ } ++ + if (capi_controller[ctr->cnr - 1] != ctr) { + err = -EINVAL; + goto unlock_out; diff --git a/queue-4.19/netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch b/queue-4.19/netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch new file mode 100644 index 00000000000..670a029e3d7 --- /dev/null +++ b/queue-4.19/netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch @@ -0,0 +1,30 @@ +From 77076934afdcd46516caf18ed88b2f88025c9ddb Mon Sep 17 00:00:00 2001 +From: Vegard Nossum +Date: Tue, 5 Oct 2021 22:54:54 +0200 +Subject: netfilter: Kconfig: use 'default y' instead of 'm' for bool config option + +From: Vegard Nossum + +commit 77076934afdcd46516caf18ed88b2f88025c9ddb upstream. + +This option, NF_CONNTRACK_SECMARK, is a bool, so it can never be 'm'. + +Fixes: 33b8e77605620 ("[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option") +Signed-off-by: Vegard Nossum +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -93,7 +93,7 @@ config NF_CONNTRACK_MARK + config NF_CONNTRACK_SECMARK + bool 'Connection tracking security mark support' + depends on NETWORK_SECMARK +- default m if NETFILTER_ADVANCED=n ++ default y if NETFILTER_ADVANCED=n + help + This option enables security markings to be applied to + connections. Typically they are copied to connections from diff --git a/queue-4.19/nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch b/queue-4.19/nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch new file mode 100644 index 00000000000..cd6d639b430 --- /dev/null +++ b/queue-4.19/nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch @@ -0,0 +1,34 @@ +From 1b1499a817c90fd1ce9453a2c98d2a01cca0e775 Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Thu, 7 Oct 2021 19:44:30 +0200 +Subject: nfc: nci: fix the UAF of rf_conn_info object + +From: Lin Ma + +commit 1b1499a817c90fd1ce9453a2c98d2a01cca0e775 upstream. + +The nci_core_conn_close_rsp_packet() function will release the conn_info +with given conn_id. However, it needs to set the rf_conn_info to NULL to +prevent other routines like nci_rf_intf_activated_ntf_packet() to trigger +the UAF. + +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Lin Ma +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/nfc/nci/rsp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/nfc/nci/rsp.c ++++ b/net/nfc/nci/rsp.c +@@ -289,6 +289,8 @@ static void nci_core_conn_close_rsp_pack + ndev->cur_conn_id); + if (conn_info) { + list_del(&conn_info->list); ++ if (conn_info == ndev->rf_conn_info) ++ ndev->rf_conn_info = NULL; + devm_kfree(&ndev->nfc_dev->dev, conn_info); + } + } diff --git a/queue-4.19/series b/queue-4.19/series index 7ef523574e1..b713c5750e3 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -20,3 +20,6 @@ alsa-usb-audio-provide-quirk-for-sennheiser-gsp670-headset.patch alsa-hda-realtek-add-quirk-for-clevo-pc50hs.patch asoc-dapm-fix-missing-kctl-change-notifications.patch mm-slub-fix-mismatch-between-reconstructed-freelist-depth-and-cnt.patch +nfc-nci-fix-the-uaf-of-rf_conn_info-object.patch +isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch +netfilter-kconfig-use-default-y-instead-of-m-for-bool-config-option.patch -- 2.47.3