kernel_samsung_smdk4412/net, branch replicant-6.0

net/wireless: add cfg80211_ref_bss() from 3.4 kernel

2019-07-24T10:28:06+00:00

mac80211 needs this function.

Signed-off-by: Wolfgang Wiedmeyer

Backport mac80211 from 3.4 kernel

2019-07-24T10:28:05+00:00

The ath9k_htc driver depends on mac80211, but mac80211 can't be
build. The reason is that net/wireless is almost completely backported
from a 3.4 kernel. To follow suit, mac80211 is also backported from
3.4, more precisely from 3.4.113. This makes mac80211 build.

Signed-off-by: Wolfgang Wiedmeyer

net: avoid signed overflows for SO_{SND|RCV}BUFFORCE

2017-01-08T12:55:35+00:00

CAP_NET_ADMIN users should not be allowed to set negative
sk_sndbuf or sk_rcvbuf values, as it can lead to various memory
corruptions, crashes, OOM...

Note that before commit 82981930125a ("net: cleanups in
sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF
and SO_RCVBUF were vulnerable.

This needs to be backported to all known linux kernels.

Again, many thanks to syzkaller team for discovering this gem.

Change-Id: I7b3a4b234eee4e3b2b2766f4d61a44d92e76095d
Signed-off-by: Eric Dumazet 
Reported-by: Andrey Konovalov 
Signed-off-by: David S. Miller

net: cleanups in sock_setsockopt()

2017-01-08T12:55:35+00:00

Use min_t()/max_t() macros, reformat two comments, use !!test_bit() to
match !!sock_flag()

Change-Id: Ie9ef0586af81908916e7df27ea3c4508982dc42c
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

netfilter: Change %p to %pK in debug messages

2016-12-12T13:14:54+00:00

The format specifier %p can leak kernel addresses
while not valuing the kptr_restrict system settings.
Use %pK instead of %p, which also evaluates whether
kptr_restrict is set.

Bug: 31796940
Change-Id: Ia2946d6b493126d68281f97778faf578247f088e
Signed-off-by: Min Chong

net: ping: Fix stack buffer overflow in ping_common_sendmsg()

2016-12-12T13:14:53+00:00

In ping_common_sendmsg(), when len < icmph_len, memcpy_fromiovec()
will access invalid memory because msg->msg_iov only has 1 element
and memcpy_fromiovec() attempts to increment it. KASAN report:

BUG: KASAN: stack-out-of-bounds in memcpy_fromiovec+0x60/0x114 at addr ffffffc071077da0
Read of size 8 by task trinity-c2/9623
page:ffffffbe034b9a08 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x0()
page dumped because: kasan: bad access detected
CPU: 0 PID: 9623 Comm: trinity-c2 Tainted: G    BU         3.18.0-dirty #15
Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT)
Call trace:
[] dump_backtrace+0x0/0x1ac arch/arm64/kernel/traps.c:90
[] show_stack+0x10/0x1c arch/arm64/kernel/traps.c:171
[<     inline     >] __dump_stack lib/dump_stack.c:15
[] dump_stack+0x7c/0xd0 lib/dump_stack.c:50
[<     inline     >] print_address_description mm/kasan/report.c:147
[<     inline     >] kasan_report_error mm/kasan/report.c:236
[] kasan_report+0x380/0x4b8 mm/kasan/report.c:259
[<     inline     >] check_memory_region mm/kasan/kasan.c:264
[] __asan_load8+0x20/0x70 mm/kasan/kasan.c:507
[] memcpy_fromiovec+0x5c/0x114 lib/iovec.c:15
[<     inline     >] memcpy_from_msg include/linux/skbuff.h:2667
[] ping_common_sendmsg+0x50/0x108 net/ipv4/ping.c:674
[] ping_v4_sendmsg+0xd8/0x698 net/ipv4/ping.c:714
[] inet_sendmsg+0xe0/0x12c net/ipv4/af_inet.c:749
[<     inline     >] __sock_sendmsg_nosec net/socket.c:624
[<     inline     >] __sock_sendmsg net/socket.c:632
[] sock_sendmsg+0x124/0x164 net/socket.c:643
[<     inline     >] SYSC_sendto net/socket.c:1797
[] SyS_sendto+0x178/0x1d8 net/socket.c:1761
Memory state around the buggy address:
 ffffffc071077c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 f1 f1
 ffffffc071077d00: f1 f1 04 f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2
>ffffffc071077d80: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00
                               ^
 ffffffc071077e00: 00 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
 ffffffc071077e80: 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00

RM-290

Bug: 31349935
Change-Id: Ib7385fc26dfe7e07e9bab42a10ff65a37cbaab54
Signed-off-by: Siqi Lin

fix infoleak in rtnetlink

2016-10-18T14:09:18+00:00

the stack object “map” has a total size of 32 bytes. Its last 4
bytes are padding generated by compiler. These padding bytes are
not initialized and sent out via “nla_put”

Bug: 28620102

Change-Id: I13da380c6fe8abca49e3cf9f05293c02b44d2e5e
Signed-off-by: kangjie

Replace %p with %pK to prevent leaking kernel address

2016-10-18T14:09:17+00:00

BUG: 27532522
Change-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4
Signed-off-by: Mohamad Ayyash

net: Fix use after free in the recvmmsg exit path

2016-10-18T13:33:03+00:00

The syzkaller fuzzer hit the following use-after-free:

  Call Trace:
   [] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295
   [] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261
   [<     inline     >] SYSC_recvmmsg net/socket.c:2281
   [] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270
   [] entry_SYSCALL_64_fastpath+0x16/0x7a
  arch/x86/entry/entry_64.S:185

And, as Dmitry rightly assessed, that is because we can drop the
reference and then touch it when the underlying recvmsg calls return
some packets and then hit an error, which will make recvmmsg to set
sock->sk->sk_err, oops, fix it.

Reported-and-Tested-by: Dmitry Vyukov 
Cc: Alexander Potapenko 
Cc: Eric Dumazet 
Cc: Kostya Serebryany 
Cc: Sasha Levin 
Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")
http://lkml.kernel.org/r/20160122211644.GC2470@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: David S. Miller 

Change-Id: Ie3b6ee89ad3e8cd3a0fe8f50f74aaa4834d0b4ca

netfilter: x_tables: make sure e->next_offset covers remaining blob size

2016-07-22T13:05:20+00:00

Otherwise this function may read data beyond the ruleset blob.

Change-Id: I22f514057d3e0403d1af61f4d9555403ab9f72ea
Signed-off-by: Florian Westphal 
Signed-off-by: Pablo Neira Ayuso