From: Joel Savitz <jsavitz@redhat.com>
Subject: [KPATCH 7.9] netfilter: x_tables: kpatch fixes for CVE-2021-22555
Date: Wed, 28 Jul 2021 12:03:15 -0400

Kernels:
3.10.0-1160.el7
3.10.0-1160.2.1.el7
3.10.0-1160.2.2.el7
3.10.0-1160.6.1.el7
3.10.0-1160.11.1.el7
3.10.0-1160.15.2.el7
3.10.0-1160.21.1.el7
3.10.0-1160.24.1.el7
3.10.0-1160.25.1.el7
3.10.0-1160.31.1.el7
3.10.0-1160.36.2.el7

Changes since last build:
arches: x86_64 ppc64le
arp_tables.o: changed function: translate_compat_table
ip6_tables.o: changed function: translate_compat_table
ip_tables.o: changed function: translate_compat_table
x_tables.o: changed function: xt_compat_match_from_user
x_tables.o: changed function: xt_compat_target_from_user
---------------------------

Kernels:
3.10.0-1160.el7
3.10.0-1160.2.1.el7
3.10.0-1160.2.2.el7
3.10.0-1160.6.1.el7
3.10.0-1160.11.1.el7
3.10.0-1160.15.2.el7
3.10.0-1160.21.1.el7
3.10.0-1160.24.1.el7
3.10.0-1160.25.1.el7
3.10.0-1160.31.1.el7
3.10.0-1160.36.2.el7

Modifications: none

Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-7/-/merge_requests/201
KT0 test PASS: https://beaker.engineering.redhat.com/jobs/5642298
for scratch build: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=38448253

commit 06215319786b979bed0f5eb3138de0506db9d39f
Author: Florian Westphal <fwestpha@redhat.com>
Date:   Fri Jul 9 11:42:55 2021 +0200

    netfilter: x_tables: fix compat match/target pad out-of-bound write

    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1980489
    Upstream Status: commit b29c457a65114
    CVE: CVE-2021-22555

    commit b29c457a6511435960115c0f548c4360d5f4801d
    Author: Florian Westphal <fw@strlen.de>
    Date:   Wed Apr 7 21:38:57 2021 +0200

        netfilter: x_tables: fix compat match/target pad out-of-bound write

        xt_compat_match/target_from_user doesn't check that zeroing the area
        to start of next rule won't write past end of allocated ruleset blob.

        Remove this code and zero the entire blob beforehand.

        Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
        Reported-by: Andy Nguyen <theflow@google.com>
        Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
        Signed-off-by: Florian Westphal <fw@strlen.de>
        Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

    Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Signed-off-by: Joel Savitz <jsavitz@redhat.com>
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
Acked-by: Artem Savkov <asavkov@redhat.com>
Acked-by: Yannick Cote <ycote@redhat.com>
---
 net/ipv4/netfilter/arp_tables.c |  2 ++
 net/ipv4/netfilter/ip_tables.c  |  2 ++
 net/ipv6/netfilter/ip6_tables.c |  2 ++
 net/netfilter/x_tables.c        | 10 ++--------
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 602d92697038..66ad3b4e194c 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1364,6 +1364,8 @@ static int translate_compat_table(struct xt_table_info **pinfo,
 	if (!newinfo)
 		goto out_unlock;
 
+	memset(newinfo->entries, 0, size);
+
 	newinfo->number = compatr->num_entries;
 	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = info->hook_entry[i];
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 3559f7ffa430..d9de653be67e 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1622,6 +1622,8 @@ translate_compat_table(struct net *net,
 	if (!newinfo)
 		goto out_unlock;
 
+	memset(newinfo->entries, 0, size);
+
 	newinfo->number = compatr->num_entries;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = compatr->hook_entry[i];
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 1772a1797e79..d112bfc86aac 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1626,6 +1626,8 @@ translate_compat_table(struct net *net,
 	if (!newinfo)
 		goto out_unlock;
 
+	memset(newinfo->entries, 0, size);
+
 	newinfo->number = compatr->num_entries;
 	for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 		newinfo->hook_entry[i] = compatr->hook_entry[i];
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 76e40ff48b10..affd08ce7df8 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -564,7 +564,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 {
 	const struct xt_match *match = m->u.kernel.match;
 	struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
-	int pad, off = xt_compat_match_offset(match);
+	int off = xt_compat_match_offset(match);
 	u_int16_t msize = cm->u.user.match_size;
 	char name[sizeof(m->u.user.name)];
 
@@ -574,9 +574,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 		match->compat_from_user(m->data, cm->data);
 	else
 		memcpy(m->data, cm->data, msize - sizeof(*cm));
-	pad = XT_ALIGN(match->matchsize) - match->matchsize;
-	if (pad > 0)
-		memset(m->data + match->matchsize, 0, pad);
 
 	msize += off;
 	m->u.user.match_size = msize;
@@ -913,7 +910,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
 {
 	const struct xt_target *target = t->u.kernel.target;
 	struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
-	int pad, off = xt_compat_target_offset(target);
+	int off = xt_compat_target_offset(target);
 	u_int16_t tsize = ct->u.user.target_size;
 	char name[sizeof(t->u.user.name)];
 
@@ -923,9 +920,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
 		target->compat_from_user(t->data, ct->data);
 	else
 		memcpy(t->data, ct->data, tsize - sizeof(*ct));
-	pad = XT_ALIGN(target->targetsize) - target->targetsize;
-	if (pad > 0)
-		memset(t->data + target->targetsize, 0, pad);
 
 	tsize += off;
 	t->u.user.target_size = tsize;
-- 
2.27.0