Patch "net_sched: reject TCF_EM_SIMPLE case for complex ematch module" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net_sched: reject TCF_EM_SIMPLE case for complex ematch module

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net_sched-reject-tcf_em_simple-case-for-complex-emat.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c2cd887553e1326733bed86e60431df9bc0bc737
Author: Cong Wang <cong.wang@xxxxxxxxxxxxx>
Date:   Sat Dec 17 14:17:07 2022 -0800

    net_sched: reject TCF_EM_SIMPLE case for complex ematch module
    
    [ Upstream commit 9cd3fd2054c3b3055163accbf2f31a4426f10317 ]
    
    When TCF_EM_SIMPLE was introduced, it is supposed to be convenient
    for ematch implementation:
    
    https://lore.kernel.org/all/20050105110048.GO26856@xxxxxxxxxxxxxx/
    
    "You don't have to, providing a 32bit data chunk without TCF_EM_SIMPLE
    set will simply result in allocating & copy. It's an optimization,
    nothing more."
    
    So if an ematch module provides ops->datalen that means it wants a
    complex data structure (saved in its em->data) instead of a simple u32
    value. We should simply reject such a combination, otherwise this u32
    could be misinterpreted as a pointer.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-and-tested-by: syzbot+4caeae4c7103813598ae@xxxxxxxxxxxxxxxxxxxxxxxxx
    Reported-by: Jun Nie <jun.nie@xxxxxxxxxx>
    Cc: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    Cc: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Cong Wang <cong.wang@xxxxxxxxxxxxx>
    Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index dd3b8c11a2e0..43bfb33629e9 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -255,6 +255,8 @@ static int tcf_em_validate(struct tcf_proto *tp,
 			 * the value carried.
 			 */
 			if (em_hdr->flags & TCF_EM_SIMPLE) {
+				if (em->ops->datalen > 0)
+					goto errout;
 				if (data_len < sizeof(u32))
 					goto errout;
 				em->data = *(u32 *) data;