linux.git, branch v5.4.163

Linux 5.4.163

2021-12-01T08:23:36+00:00

Link: https://lore.kernel.org/r/20211129181707.392764191@linuxfoundation.org
Tested-by: Shuah Khan 
Tested-by: Hulk Robot 
Tested-by: Florian Fainelli 
Tested-by: Jon Hunter 
Tested-by: Linux Kernel Functional Testing 
Tested-by: Sudip Mukherjee 
Tested-by: Guenter Roeck 
Signed-off-by: Greg Kroah-Hartman

tty: hvc: replace BUG_ON() with negative return value

2021-12-01T08:23:36+00:00

commit e679004dec37566f658a255157d3aed9d762a2b7 upstream.

Xen frontends shouldn't BUG() in case of illegal data received from
their backends. So replace the BUG_ON()s when reading illegal data from
the ring page with negative return values.

This is commit e679004dec37566f upstream.

Reviewed-by: Jan Beulich 
Signed-off-by: Juergen Gross 
Link: https://lore.kernel.org/r/20210707091045.460-1-jgross@suse.com
Signed-off-by: Greg Kroah-Hartman

xen/netfront: don't trust the backend response data blindly

2021-12-01T08:23:35+00:00

commit a884daa61a7d91650987e855464526aef219590f upstream.

Today netfront will trust the backend to send only sane response data.
In order to avoid privilege escalations or crashes in case of malicious
backends verify the data to be within expected limits. Especially make
sure that the response always references an outstanding request.

Note that only the tx queue needs special id handling, as for the rx
queue the id is equal to the index in the ring page.

Introduce a new indicator for the device whether it is broken and let
the device stop working when it is set. Set this indicator in case the
backend sets any weird data.

Signed-off-by: Juergen Gross 
Reviewed-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netfront: disentangle tx_skb_freelist

2021-12-01T08:23:35+00:00

commit 21631d2d741a64a073e167c27769e73bc7844a2f upstream.

The tx_skb_freelist elements are in a single linked list with the
request id used as link reference. The per element link field is in a
union with the skb pointer of an in use request.

Move the link reference out of the union in order to enable a later
reuse of it for requests which need a populated skb pointer.

Rename add_id_to_freelist() and get_id_from_freelist() to
add_id_to_list() and get_id_from_list() in order to prepare using
those for other lists as well. Define ~0 as value to indicate the end
of a list and place that value into the link for a request not being
on the list.

When freeing a skb zero the skb pointer in the request. Use a NULL
value of the skb pointer instead of skb_entry_is_link() for deciding
whether a request has a skb linked to it.

Remove skb_entry_set_link() and open code it instead as it is really
trivial now.

Signed-off-by: Juergen Gross 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netfront: don't read data from request on the ring page

2021-12-01T08:23:35+00:00

commit 162081ec33c2686afa29d91bf8d302824aa846c7 upstream.

In order to avoid a malicious backend being able to influence the local
processing of a request build the request locally first and then copy
it to the ring page. Any reading from the request influencing the
processing in the frontend needs to be done on the local instance.

Signed-off-by: Juergen Gross 
Reviewed-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/netfront: read response from backend only once

2021-12-01T08:23:35+00:00

commit 8446066bf8c1f9f7b7412c43fbea0fb87464d75b upstream.

In order to avoid problems in case the backend is modifying a response
on the ring page while the frontend has already seen it, just read the
response into a local buffer in one go and then operate on that buffer
only.

Signed-off-by: Juergen Gross 
Reviewed-by: Jan Beulich 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

xen/blkfront: don't trust the backend response data blindly

2021-12-01T08:23:35+00:00

commit b94e4b147fd1992ad450e1fea1fdaa3738753373 upstream.

Today blkfront will trust the backend to send only sane response data.
In order to avoid privilege escalations or crashes in case of malicious
backends verify the data to be within expected limits. Especially make
sure that the response always references an outstanding request.

Introduce a new state of the ring BLKIF_STATE_ERROR which will be
switched to in case an inconsistency is being detected. Recovering from
this state is possible only via removing and adding the virtual device
again (e.g. via a suspend/resume cycle).

Make all warning messages issued due to valid error responses rate
limited in order to avoid message floods being triggered by a malicious
backend.

Signed-off-by: Juergen Gross 
Reviewed-by: Jan Beulich 
Acked-by: Roger Pau Monné 
Link: https://lore.kernel.org/r/20210730103854.12681-4-jgross@suse.com
Signed-off-by: Juergen Gross 
Signed-off-by: Greg Kroah-Hartman

xen/blkfront: don't take local copy of a request from the ring page

2021-12-01T08:23:35+00:00

commit 8f5a695d99000fc3aa73934d7ced33cfc64dcdab upstream.

In order to avoid a malicious backend being able to influence the local
copy of a request build the request locally first and then copy it to
the ring page instead of doing it the other way round as today.

Signed-off-by: Juergen Gross 
Reviewed-by: Jan Beulich 
Acked-by: Roger Pau Monné 
Link: https://lore.kernel.org/r/20210730103854.12681-3-jgross@suse.com
Signed-off-by: Juergen Gross 
Signed-off-by: Greg Kroah-Hartman

xen/blkfront: read response from backend only once

2021-12-01T08:23:35+00:00

commit 71b66243f9898d0e54296b4e7035fb33cdcb0707 upstream.

In order to avoid problems in case the backend is modifying a response
on the ring page while the frontend has already seen it, just read the
response into a local buffer in one go and then operate on that buffer
only.

Signed-off-by: Juergen Gross 
Reviewed-by: Jan Beulich 
Acked-by: Roger Pau Monné 
Link: https://lore.kernel.org/r/20210730103854.12681-2-jgross@suse.com
Signed-off-by: Juergen Gross 
Signed-off-by: Greg Kroah-Hartman

xen: sync include/xen/interface/io/ring.h with Xen's newest version

2021-12-01T08:23:35+00:00

commit 629a5d87e26fe96bcaab44cbb81f5866af6f7008 upstream.

Sync include/xen/interface/io/ring.h with Xen's newest version in
order to get the RING_COPY_RESPONSE() and RING_RESPONSE_PROD_OVERFLOW()
macros.

Note that this will correct the wrong license info by adding the
missing original copyright notice.

Signed-off-by: Juergen Gross 
Signed-off-by: Greg Kroah-Hartman