From f0abdec25e7b0b9b9a7f306640ac04559d1d24af Mon Sep 17 00:00:00 2001 From: Oscar Salvador Date: Apr 25 2024 08:24:16 +0000 Subject: Merge remote-tracking branch 'origin/users/tiwai/cve/linux-5.14-LTSS/for-next' into cve/linux-5.14-LTSS Pull wifi fixes from Takashi Iwai --- diff --git a/patches.suse/wifi-iwlwifi-fix-a-memory-corruption.patch b/patches.suse/wifi-iwlwifi-fix-a-memory-corruption.patch new file mode 100644 index 0000000..989f582 --- /dev/null +++ b/patches.suse/wifi-iwlwifi-fix-a-memory-corruption.patch @@ -0,0 +1,44 @@ +From cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Thu, 11 Jan 2024 15:07:25 +0200 +Subject: [PATCH] wifi: iwlwifi: fix a memory corruption +Git-commit: cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d +Patch-mainline: v6.8-rc2 +References: CVE-2024-26610 bsc#1221299 + +iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that +if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in +bytes, we'll write past the buffer. + +Cc: stable@vger.kernel.org +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218233 +Fixes: cf29c5b66b9f ("iwlwifi: dbg_ini: implement time point handling") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240111150610.2d2b8b870194.I14ed76505a5cf87304e0c9cc05cc0ae85ed3bf91@changeid +Signed-off-by: Johannes Berg +Acked-by: Takashi Iwai + +--- + drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause + /* +- * Copyright (C) 2018-2022 Intel Corporation ++ * Copyright (C) 2018-2024 Intel Corporation + */ + #include + #include "iwl-drv.h" +@@ -1082,7 +1082,7 @@ static int iwl_dbg_tlv_override_trig_nod + node_trig = (void *)node_tlv->data; + } + +- memcpy(node_trig->data + offset, trig->data, trig_data_len); ++ memcpy((u8 *)node_trig->data + offset, trig->data, trig_data_len); + node_tlv->length = cpu_to_le32(size); + + if (policy & IWL_FW_INI_APPLY_POLICY_OVERRIDE_CFG) { diff --git a/series.conf b/series.conf index dc9fe92..4d1c09e 100644 --- a/series.conf +++ b/series.conf @@ -23543,6 +23543,7 @@ patches.suse/tcp-make-sure-init-the-accept_queue-s-spinlocks-once.patch patches.suse/net-rds-Fix-UBSAN-array-index-out-of-bounds-in-rds_c.patch patches.suse/ipv6-init-the-accept_queue-s-spinlocks-in-inet6_crea.patch + patches.suse/wifi-iwlwifi-fix-a-memory-corruption.patch patches.suse/netfilter-nf_tables-reject-QUEUE-DROP-verdict-parame.patch patches.suse/drm-bridge-sii902x-Fix-probing-race-issue.patch patches.suse/dm-limit-the-number-of-targets-and-parameter-size-ar.patch