Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 9c472cc1 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'ASB-2023-11-05_11-5.4' of... 

Merge tag 'ASB-2023-11-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

https://source.android.com/docs/security/bulletin/2023-11-01

* tag 'ASB-2023-11-05_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
  BACKPORT: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
  UPSTREAM: ravb: Fix up dma_free_coherent() call in ravb_remove()
  UPSTREAM: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
  UPSTREAM: net: xfrm: Fix xfrm_address_filter OOB read
  UPSTREAM: igb: set max size RX buffer when store bad packet is enabled
  UPSTREAM: netfilter: xt_sctp: validate the flag_info count
  UPSTREAM: netfilter: xt_u32: validate user space input
  UPSTREAM: netfilter: nfnetlink_osf: avoid OOB read
  UPSTREAM: net/sched: Retire rsvp classifier
  UPSTREAM: ipv4: fix null-deref in ipv4_link_failure

Change-Id: I26b182a8dd67864a2a4421feb25b878e98478a62
parents 9d8c4da6 49de253f

drivers/net/ethernet/intel/igb/igb_main.c

+7 −4
Original line number Diff line number Diff line
@@ -4552,6 +4552,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter, 
static void igb_set_rx_buffer_len(struct igb_adapter *adapter,

				  struct igb_ring *rx_ring)

{

#if (PAGE_SIZE < 8192)

	struct e1000_hw *hw = &adapter->hw;

#endif



	/* set build_skb and buffer size flags */

	clear_ring_build_skb_enabled(rx_ring);

	clear_ring_uses_large_buffer(rx_ring);
@@ -4562,9 +4566,8 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter, 
	set_ring_build_skb_enabled(rx_ring);



#if (PAGE_SIZE < 8192)

	if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB)

		return;



	if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||

	    rd32(E1000_RCTL) & E1000_RCTL_SBP)

		set_ring_uses_large_buffer(rx_ring);

#endif

}

drivers/net/ethernet/renesas/ravb_main.c

+4 −2
Original line number Diff line number Diff line
@@ -1703,6 +1703,8 @@ static int ravb_close(struct net_device *ndev) 
			of_phy_deregister_fixed_link(np);

	}



	cancel_work_sync(&priv->work);



	if (priv->chip_id != RCAR_GEN2) {

		free_irq(priv->tx_irqs[RAVB_NC], ndev);

		free_irq(priv->rx_irqs[RAVB_NC], ndev);
@@ -2212,14 +2214,14 @@ static int ravb_remove(struct platform_device *pdev) 
	if (priv->chip_id != RCAR_GEN2)

		ravb_ptp_stop(ndev);



	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,

			  priv->desc_bat_dma);

	/* Set reset mode */

	ravb_write(ndev, CCC_OPC_RESET, CCC);

	unregister_netdev(ndev);

	netif_napi_del(&priv->napi[RAVB_NC]);

	netif_napi_del(&priv->napi[RAVB_BE]);

	ravb_mdio_release(priv);

	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,

			  priv->desc_bat_dma);

	pm_runtime_put_sync(&pdev->dev);

	pm_runtime_disable(&pdev->dev);

	free_netdev(ndev);

net/ipv4/route.c

+3 −1
Original line number Diff line number Diff line
@@ -1221,6 +1221,7 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie) 


static void ipv4_send_dest_unreach(struct sk_buff *skb)

{

	struct net_device *dev;

	struct ip_options opt;

	int res;
@@ -1238,7 +1239,8 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb) 
		opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr);



		rcu_read_lock();

		res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);

		dev = skb->dev ? skb->dev : skb_rtable(skb)->dst.dev;

		res = __ip_options_compile(dev_net(dev), &opt, skb, NULL);

		rcu_read_unlock();



		if (res)

net/netfilter/ipset/ip_set_core.c

+10 −2
Original line number Diff line number Diff line
@@ -530,6 +530,14 @@ __ip_set_put(struct ip_set *set) 
/* set->ref can be swapped out by ip_set_swap, netlink events (like dump) need

 * a separate reference counter

 */

static void

__ip_set_get_netlink(struct ip_set *set)

{

	write_lock_bh(&ip_set_ref_lock);

	set->ref_netlink++;

	write_unlock_bh(&ip_set_ref_lock);

}



static inline void

__ip_set_put_netlink(struct ip_set *set)

{
@@ -1529,11 +1537,11 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set, 


	do {

		if (retried) {

			__ip_set_get(set);

			__ip_set_get_netlink(set);

			nfnl_unlock(NFNL_SUBSYS_IPSET);

			cond_resched();

			nfnl_lock(NFNL_SUBSYS_IPSET);

			__ip_set_put(set);

			__ip_set_put_netlink(set);

		}



		ip_set_lock(set);

net/netfilter/ipset/ip_set_hash_netportnet.c

+1 −0
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net"); 
#define IP_SET_HASH_WITH_PROTO

#define IP_SET_HASH_WITH_NETS

#define IPSET_NET_COUNT 2

#define IP_SET_HASH_WITH_NET0



/* IPv4 variant */