This is a note to let you know that I've just added the patch titled
tpm: only attempt to disable the LPC CLKRUN if is already enabled
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
tpm-only-attempt-to-disable-the-lpc-clkrun-if-is-already-enabled.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 6c9f0ce0dffe64da2204f38b0fd90f3ae2a8903c Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm(a)redhat.com>
Date: Mon, 25 Dec 2017 03:22:51 +0100
Subject: tpm: only attempt to disable the LPC CLKRUN if is already enabled
From: Javier Martinez Canillas <javierm(a)redhat.com>
commit 6c9f0ce0dffe64da2204f38b0fd90f3ae2a8903c upstream.
Commit 5e572cab92f0 ("tpm: Enable CLKRUN protocol for Braswell systems")
added logic in the TPM TIS driver to disable the Low Pin Count CLKRUN
signal during TPM transactions.
Unfortunately this breaks other devices that are attached to the LPC bus
like for example PS/2 mouse and keyboards.
One flaw with the logic is that it assumes that the CLKRUN is always
enabled, and so it unconditionally enables it after a TPM transaction.
But it could be that the CLKRUN# signal was already disabled in the LPC
bus and so after the driver probes, CLKRUN_EN will remain enabled which
may break other devices that are attached to the LPC bus but don't have
support for the CLKRUN protocol.
Fixes: 5e572cab92f0 ("tpm: Enable CLKRUN protocol for Braswell systems")
Signed-off-by: Javier Martinez Canillas <javierm(a)redhat.com>
Tested-by: James Ettle <james(a)ettle.org.uk>
Tested-by: Jeffery Miller <jmiller(a)neverware.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/tpm/tpm_tis_core.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -694,7 +694,8 @@ static void tpm_tis_clkrun_enable(struct
struct tpm_tis_data *data = dev_get_drvdata(&chip->dev);
u32 clkrun_val;
- if (!IS_ENABLED(CONFIG_X86) || !is_bsw())
+ if (!IS_ENABLED(CONFIG_X86) || !is_bsw() ||
+ !data->ilb_base_addr)
return;
if (value) {
@@ -751,6 +752,7 @@ int tpm_tis_core_init(struct device *dev
acpi_handle acpi_dev_handle)
{
u32 vendor, intfcaps, intmask;
+ u32 clkrun_val;
u8 rid;
int rc, probe;
struct tpm_chip *chip;
@@ -776,6 +778,13 @@ int tpm_tis_core_init(struct device *dev
ILB_REMAP_SIZE);
if (!priv->ilb_base_addr)
return -ENOMEM;
+
+ clkrun_val = ioread32(priv->ilb_base_addr + LPC_CNTRL_OFFSET);
+ /* Check if CLKRUN# is already not enabled in the LPC bus */
+ if (!(clkrun_val & LPC_CLKRUN_EN)) {
+ iounmap(priv->ilb_base_addr);
+ priv->ilb_base_addr = NULL;
+ }
}
if (chip->ops->clk_enable != NULL)
Patches currently in stable-queue which might be from javierm(a)redhat.com are
queue-4.15/tpm-delete-the-tpm_tis_clk_enable-flag.patch
queue-4.15/tpm-only-attempt-to-disable-the-lpc-clkrun-if-is-already-enabled.patch
This is a note to let you know that I've just added the patch titled
tpm: delete the TPM_TIS_CLK_ENABLE flag
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
tpm-delete-the-tpm_tis_clk_enable-flag.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 764325add6c2ad1641199edde7b2995495fc2d7c Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm(a)redhat.com>
Date: Mon, 25 Dec 2017 03:22:49 +0100
Subject: tpm: delete the TPM_TIS_CLK_ENABLE flag
From: Javier Martinez Canillas <javierm(a)redhat.com>
commit 764325add6c2ad1641199edde7b2995495fc2d7c upstream.
This flag is only used to warn if CLKRUN_EN wasn't disabled on Braswell
systems, but the only way this can happen is if the code is not correct.
So it's an unnecessary check that just makes the code harder to read.
Suggested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Javier Martinez Canillas <javierm(a)redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/tpm/tpm_tis.c | 15 ---------------
drivers/char/tpm/tpm_tis_core.c | 2 --
drivers/char/tpm/tpm_tis_core.h | 1 -
3 files changed, 18 deletions(-)
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -138,9 +138,6 @@ static int tpm_tcg_read_bytes(struct tpm
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
while (len--)
*result++ = ioread8(phy->iobase + addr);
@@ -152,9 +149,6 @@ static int tpm_tcg_write_bytes(struct tp
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
while (len--)
iowrite8(*value++, phy->iobase + addr);
@@ -165,9 +159,6 @@ static int tpm_tcg_read16(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
*result = ioread16(phy->iobase + addr);
return 0;
@@ -177,9 +168,6 @@ static int tpm_tcg_read32(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
*result = ioread32(phy->iobase + addr);
return 0;
@@ -189,9 +177,6 @@ static int tpm_tcg_write32(struct tpm_ti
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
iowrite32(value, phy->iobase + addr);
return 0;
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -698,7 +698,6 @@ static void tpm_tis_clkrun_enable(struct
return;
if (value) {
- data->flags |= TPM_TIS_CLK_ENABLE;
data->clkrun_enabled++;
if (data->clkrun_enabled > 1)
return;
@@ -729,7 +728,6 @@ static void tpm_tis_clkrun_enable(struct
* sure LPC clock is running before sending any TPM command.
*/
outb(0xCC, 0x80);
- data->flags &= ~TPM_TIS_CLK_ENABLE;
}
}
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -86,7 +86,6 @@ enum tis_defaults {
enum tpm_tis_flags {
TPM_TIS_ITPM_WORKAROUND = BIT(0),
- TPM_TIS_CLK_ENABLE = BIT(1),
};
struct tpm_tis_data {
Patches currently in stable-queue which might be from javierm(a)redhat.com are
queue-4.15/tpm-delete-the-tpm_tis_clk_enable-flag.patch
queue-4.15/tpm-only-attempt-to-disable-the-lpc-clkrun-if-is-already-enabled.patch
This is a note to let you know that I've just added the patch titled
tpm: remove unused variables
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
tpm-remove-unused-variables.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 68021bf4734d15c9a9ed1c1072b9ebcfda3e39cc Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd(a)arndb.de>
Date: Tue, 2 Jan 2018 11:38:54 +0100
Subject: tpm: remove unused variables
From: Arnd Bergmann <arnd(a)arndb.de>
commit 68021bf4734d15c9a9ed1c1072b9ebcfda3e39cc upstream.
The CLKRUN fix caused a few harmless compile-time warnings:
drivers/char/tpm/tpm_tis.c: In function 'tpm_tis_pnp_remove':
drivers/char/tpm/tpm_tis.c:274:23: error: unused variable 'priv' [-Werror=unused-variable]
drivers/char/tpm/tpm_tis.c: In function 'tpm_tis_plat_remove':
drivers/char/tpm/tpm_tis.c:324:23: error: unused variable 'priv' [-Werror=unused-variable]
This removes the variables that have now become unused.
Fixes: 6d0866cbc2d3 ("tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Reviewed-by: James Morris <jmorris(a)namei.org>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/tpm/tpm_tis.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -255,7 +255,6 @@ MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
static void tpm_tis_pnp_remove(struct pnp_dev *dev)
{
struct tpm_chip *chip = pnp_get_drvdata(dev);
- struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
@@ -305,7 +304,6 @@ static int tpm_tis_plat_probe(struct pla
static int tpm_tis_plat_remove(struct platform_device *pdev)
{
struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
- struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
tpm_tis_remove(chip);
Patches currently in stable-queue which might be from arnd(a)arndb.de are
queue-4.14/watchdog-hpwdt-fix-unused-variable-warning.patch
queue-4.14/arm-omap2-hide-omap3_save_secure_ram-on-non-omap3-builds.patch
queue-4.14/dm-bufio-avoid-false-positive-wmaybe-uninitialized-warning.patch
queue-4.14/objtool-fix-another-switch-table-detection-issue.patch
queue-4.14/tpm-remove-unused-variables.patch
This is a note to let you know that I've just added the patch titled
tpm: only attempt to disable the LPC CLKRUN if is already enabled
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
tpm-only-attempt-to-disable-the-lpc-clkrun-if-is-already-enabled.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 6c9f0ce0dffe64da2204f38b0fd90f3ae2a8903c Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm(a)redhat.com>
Date: Mon, 25 Dec 2017 03:22:51 +0100
Subject: tpm: only attempt to disable the LPC CLKRUN if is already enabled
From: Javier Martinez Canillas <javierm(a)redhat.com>
commit 6c9f0ce0dffe64da2204f38b0fd90f3ae2a8903c upstream.
Commit 5e572cab92f0 ("tpm: Enable CLKRUN protocol for Braswell systems")
added logic in the TPM TIS driver to disable the Low Pin Count CLKRUN
signal during TPM transactions.
Unfortunately this breaks other devices that are attached to the LPC bus
like for example PS/2 mouse and keyboards.
One flaw with the logic is that it assumes that the CLKRUN is always
enabled, and so it unconditionally enables it after a TPM transaction.
But it could be that the CLKRUN# signal was already disabled in the LPC
bus and so after the driver probes, CLKRUN_EN will remain enabled which
may break other devices that are attached to the LPC bus but don't have
support for the CLKRUN protocol.
Fixes: 5e572cab92f0 ("tpm: Enable CLKRUN protocol for Braswell systems")
Signed-off-by: Javier Martinez Canillas <javierm(a)redhat.com>
Tested-by: James Ettle <james(a)ettle.org.uk>
Tested-by: Jeffery Miller <jmiller(a)neverware.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/tpm/tpm_tis_core.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -694,7 +694,8 @@ static void tpm_tis_clkrun_enable(struct
struct tpm_tis_data *data = dev_get_drvdata(&chip->dev);
u32 clkrun_val;
- if (!IS_ENABLED(CONFIG_X86) || !is_bsw())
+ if (!IS_ENABLED(CONFIG_X86) || !is_bsw() ||
+ !data->ilb_base_addr)
return;
if (value) {
@@ -751,6 +752,7 @@ int tpm_tis_core_init(struct device *dev
acpi_handle acpi_dev_handle)
{
u32 vendor, intfcaps, intmask;
+ u32 clkrun_val;
u8 rid;
int rc, probe;
struct tpm_chip *chip;
@@ -776,6 +778,13 @@ int tpm_tis_core_init(struct device *dev
ILB_REMAP_SIZE);
if (!priv->ilb_base_addr)
return -ENOMEM;
+
+ clkrun_val = ioread32(priv->ilb_base_addr + LPC_CNTRL_OFFSET);
+ /* Check if CLKRUN# is already not enabled in the LPC bus */
+ if (!(clkrun_val & LPC_CLKRUN_EN)) {
+ iounmap(priv->ilb_base_addr);
+ priv->ilb_base_addr = NULL;
+ }
}
if (chip->ops->clk_enable != NULL)
Patches currently in stable-queue which might be from javierm(a)redhat.com are
queue-4.14/tpm-delete-the-tpm_tis_clk_enable-flag.patch
queue-4.14/tpm-only-attempt-to-disable-the-lpc-clkrun-if-is-already-enabled.patch
This is a note to let you know that I've just added the patch titled
tpm: delete the TPM_TIS_CLK_ENABLE flag
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
tpm-delete-the-tpm_tis_clk_enable-flag.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From 764325add6c2ad1641199edde7b2995495fc2d7c Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm(a)redhat.com>
Date: Mon, 25 Dec 2017 03:22:49 +0100
Subject: tpm: delete the TPM_TIS_CLK_ENABLE flag
From: Javier Martinez Canillas <javierm(a)redhat.com>
commit 764325add6c2ad1641199edde7b2995495fc2d7c upstream.
This flag is only used to warn if CLKRUN_EN wasn't disabled on Braswell
systems, but the only way this can happen is if the code is not correct.
So it's an unnecessary check that just makes the code harder to read.
Suggested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Javier Martinez Canillas <javierm(a)redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen(a)linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/char/tpm/tpm_tis.c | 15 ---------------
drivers/char/tpm/tpm_tis_core.c | 2 --
drivers/char/tpm/tpm_tis_core.h | 1 -
3 files changed, 18 deletions(-)
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -137,9 +137,6 @@ static int tpm_tcg_read_bytes(struct tpm
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
while (len--)
*result++ = ioread8(phy->iobase + addr);
@@ -151,9 +148,6 @@ static int tpm_tcg_write_bytes(struct tp
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
while (len--)
iowrite8(*value++, phy->iobase + addr);
@@ -164,9 +158,6 @@ static int tpm_tcg_read16(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
*result = ioread16(phy->iobase + addr);
return 0;
@@ -176,9 +167,6 @@ static int tpm_tcg_read32(struct tpm_tis
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
*result = ioread32(phy->iobase + addr);
return 0;
@@ -188,9 +176,6 @@ static int tpm_tcg_write32(struct tpm_ti
{
struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data);
- if (is_bsw() && !(data->flags & TPM_TIS_CLK_ENABLE))
- WARN(1, "CLKRUN not enabled!\n");
-
iowrite32(value, phy->iobase + addr);
return 0;
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -698,7 +698,6 @@ static void tpm_tis_clkrun_enable(struct
return;
if (value) {
- data->flags |= TPM_TIS_CLK_ENABLE;
data->clkrun_enabled++;
if (data->clkrun_enabled > 1)
return;
@@ -729,7 +728,6 @@ static void tpm_tis_clkrun_enable(struct
* sure LPC clock is running before sending any TPM command.
*/
outb(0xCC, 0x80);
- data->flags &= ~TPM_TIS_CLK_ENABLE;
}
}
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -86,7 +86,6 @@ enum tis_defaults {
enum tpm_tis_flags {
TPM_TIS_ITPM_WORKAROUND = BIT(0),
- TPM_TIS_CLK_ENABLE = BIT(1),
};
struct tpm_tis_data {
Patches currently in stable-queue which might be from javierm(a)redhat.com are
queue-4.14/tpm-delete-the-tpm_tis_clk_enable-flag.patch
queue-4.14/tpm-only-attempt-to-disable-the-lpc-clkrun-if-is-already-enabled.patch
A bugfix I did earlier caused a build regression on h8300, which
defines the __BIG_ENDIAN macro in a slightly different way than the
generic code:
arch/h8300/include/asm/byteorder.h:5:0: warning: "__BIG_ENDIAN" redefined
We don't need to define it here, as the same macro is already provided
by the linux/byteorder/big_endian.h, and that version does not conflict.
While this is a v4.16 regression, my earlier patch also got backported
to the 4.14 and 4.15 stable kernels, so we need the fixup there as well.
Cc: stable(a)vger.kernel.org
Fixes: 101110f6271c ("Kbuild: always define endianess in kconfig.h")
Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
---
arch/h8300/include/asm/byteorder.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/h8300/include/asm/byteorder.h b/arch/h8300/include/asm/byteorder.h
index ecff2d1ca5a3..6eaa7ad5fc2c 100644
--- a/arch/h8300/include/asm/byteorder.h
+++ b/arch/h8300/include/asm/byteorder.h
@@ -2,7 +2,6 @@
#ifndef __H8300_BYTEORDER_H__
#define __H8300_BYTEORDER_H__
-#define __BIG_ENDIAN __ORDER_BIG_ENDIAN__
#include <linux/byteorder/big_endian.h>
#endif
--
2.9.0
This is a note to let you know that I've just added the patch titled
netfilter: bridge: ebt_among: add missing match size checks
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
The filename of the patch is:
netfilter-bridge-ebt_among-add-missing-match-size-checks.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable(a)vger.kernel.org> know about it.
>From c4585a2823edf4d1326da44d1524ecbfda26bb37 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw(a)strlen.de>
Date: Mon, 19 Feb 2018 03:01:45 +0100
Subject: netfilter: bridge: ebt_among: add missing match size checks
From: Florian Westphal <fw(a)strlen.de>
commit c4585a2823edf4d1326da44d1524ecbfda26bb37 upstream.
ebt_among is special, it has a dynamic match size and is exempt
from the central size checks.
Therefore it must check that the size of the match structure
provided from userspace is sane by making sure em->match_size
is at least the minimum size of the expected structure.
The module has such a check, but its only done after accessing
a structure that might be out of bounds.
tested with: ebtables -A INPUT ... \
--among-dst fe:fe:fe:fe:fe:fe
--among-dst fe:fe:fe:fe:fe:fe --among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fb,fe:fe:fe:fe:fc:fd,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe
--among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fa,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe,fe:fe:fe:fe:fe:fe
Reported-by: <syzbot+fe0b19af568972814355(a)syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw(a)strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
net/bridge/netfilter/ebt_among.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb,
return true;
}
+static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
+{
+ return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
+}
+
static int ebt_among_mt_check(const struct xt_mtchk_param *par)
{
const struct ebt_among_info *info = par->matchinfo;
const struct ebt_entry_match *em =
container_of(par->matchinfo, const struct ebt_entry_match, data);
- int expected_length = sizeof(struct ebt_among_info);
+ unsigned int expected_length = sizeof(struct ebt_among_info);
const struct ebt_mac_wormhash *wh_dst, *wh_src;
int err;
+ if (expected_length > em->match_size)
+ return -EINVAL;
+
wh_dst = ebt_among_wh_dst(info);
- wh_src = ebt_among_wh_src(info);
+ if (poolsize_invalid(wh_dst))
+ return -EINVAL;
+
expected_length += ebt_mac_wormhash_size(wh_dst);
+ if (expected_length > em->match_size)
+ return -EINVAL;
+
+ wh_src = ebt_among_wh_src(info);
+ if (poolsize_invalid(wh_src))
+ return -EINVAL;
+
expected_length += ebt_mac_wormhash_size(wh_src);
if (em->match_size != EBT_ALIGN(expected_length)) {
Patches currently in stable-queue which might be from fw(a)strlen.de are
queue-4.14/netfilter-add-back-stackpointer-size-checks.patch
queue-4.14/netfilter-ipv6-fix-use-after-free-write-in-nf_nat_ipv6_manip_pkt.patch
queue-4.14/netfilter-ebtables-config_compat-don-t-trust-userland-offsets.patch
queue-4.14/netfilter-bridge-ebt_among-add-missing-match-size-checks.patch