android_kernel_asus_sm8350/net
Peter Delevoryas ef75f3c56b net/ncsi: Fix netlink major/minor version numbers
[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ]

The netlink interface for major and minor version numbers doesn't actually
return the major and minor version numbers.

It reports a u32 that contains the (major, minor, update, alpha1)
components as the major version number, and then alpha2 as the minor
version number.

For whatever reason, the u32 byte order was reversed (ntohl): maybe it was
assumed that the encoded value was a single big-endian u32, and alpha2 was
the minor version.

The correct way to get the supported NC-SI version from the network
controller is to parse the Get Version ID response as described in 8.4.44
of the NC-SI spec[1].

    Get Version ID Response Packet Format

              Bits
            +--------+--------+--------+--------+
     Bytes  | 31..24 | 23..16 | 15..8  | 7..0   |
    +-------+--------+--------+--------+--------+
    | 0..15 | NC-SI Header                      |
    +-------+--------+--------+--------+--------+
    | 16..19| Response code   | Reason code     |
    +-------+--------+--------+--------+--------+
    |20..23 | Major  | Minor  | Update | Alpha1 |
    +-------+--------+--------+--------+--------+
    |24..27 |         reserved         | Alpha2 |
    +-------+--------+--------+--------+--------+
    |            .... other stuff ....          |

The major, minor, and update fields are all binary-coded decimal (BCD)
encoded [2]. The spec provides examples below the Get Version ID response
format in section 8.4.44.1, but for practical purposes, this is an example
from a live network card:

    root@bmc:~# ncsi-util 0x15
    NC-SI Command Response:
    cmd: GET_VERSION_ID(0x15)
    Response: COMMAND_COMPLETED(0x0000)  Reason: NO_ERROR(0x0000)
    Payload length = 40

    20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1)
    24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2)

    28: 0x6d 0x6c 0x78 0x30
    32: 0x2e 0x31 0x00 0x00
    36: 0x00 0x00 0x00 0x00
    40: 0x16 0x1d 0x07 0xd2
    44: 0x10 0x1d 0x15 0xb3
    48: 0x00 0x17 0x15 0xb3
    52: 0x00 0x00 0x81 0x19

This should be parsed as "1.1.0".

"f" in the upper-nibble means to ignore it, contributing zero.

If both nibbles are "f", I think the whole field is supposed to be ignored.
Major and minor are "required", meaning they're not supposed to be "ff",
but the update field is "optional" so I think it can be ff. I think the
simplest thing to do is just set the major and minor to zero instead of
juggling some conditional logic or something.

bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9,
so I've provided a custom BCD decoding function.

Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII
characters as far as I can tell, although the full encoding table for
non-alphabetic characters is slightly different (I think).

I imagine the alpha fields are just supposed to be alphabetic characters,
but I haven't seen any network cards actually report a non-zero value for
either.

If people wrote software against this netlink behavior, and were parsing
the major and minor versions themselves from the u32, then this would
definitely break their code.

[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf
[2] https://en.wikipedia.org/wiki/Binary-coded_decimal
[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Fixes: 138635cc27 ("net/ncsi: NCSI response packet handler")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-01-25 14:34:25 -08:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-09-15 09:47:31 +02:00
9p net: 9p: avoid freeing uninit memory in p9pdu_vreadf 2024-01-08 11:29:47 +01:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2023-01-18 11:41:37 +01:00
8021q net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() 2024-01-08 11:29:44 +01:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2023-12-20 15:41:18 +01:00
atm atm: Fix Use-After-Free in do_vcc_ioctl 2023-12-20 15:41:15 +01:00
ax25 ax25: Fix UAF bugs in ax25 timers 2022-04-20 09:19:40 +02:00
batman-adv batman-adv: Hold rtnl lock during MTU update via netlink 2023-08-30 16:27:25 +02:00
bluetooth Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent 2024-01-08 11:29:47 +01:00
bpf bpf: Move skb->len == 0 checks into __bpf_redirect 2023-01-18 11:41:04 +01:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-07-14 16:53:33 +02:00
bridge netfilter: nf_conntrack_bridge: initialize err to 0 2023-11-28 16:50:17 +00:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:32:51 +01:00
can can: raw: add support for SO_MARK 2024-01-15 18:25:25 +01:00
ceph libceph: use kernel_connect() 2023-10-25 11:53:19 +02:00
core neighbour: Don't let neigh_forced_gc() disable preemption for long 2024-01-25 14:34:20 -08:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 11:53:57 +02:00
dccp dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 10:30:15 +01:00
decnet Remove DECnet support from kernel 2023-06-21 15:44:10 +02:00
dns_resolver KEYS: Don't write out to userspace while holding key semaphore 2020-04-23 10:36:45 +02:00
dsa net: dsa: tag_sja1105: fix MAC DA patching from meta frames 2023-07-27 08:37:24 +02:00
ethernet net: add annotations on hh->hh_len lockless accesses 2020-01-09 10:20:06 +01:00
hsr hsr: Avoid double remove of a node. 2023-01-18 11:41:09 +01:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-11-03 23:56:54 +09:00
ife net: sched: ife: fix potential use-after-free 2024-01-08 11:29:44 +01:00
ipv4 net-timestamp: extend SOF_TIMESTAMPING_OPT_ID to HW timestamps 2024-01-15 18:25:26 +01:00
ipv6 ipv6: remove max_size check inline with ipv4 2024-01-15 18:25:29 +01:00
iucv treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() 2023-04-20 12:07:32 +02:00
kcm kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). 2023-09-23 11:00:02 +02:00
key net: af_key: fix sadb_x_filter validation 2023-08-30 16:27:16 +02:00
l2tp ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() 2023-10-10 21:46:44 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 13:50:47 +02:00
lapb net: lapb: Copy the skb before sending a packet 2021-02-10 09:25:28 +01:00
llc llc: verify mac len before reading mac header 2023-11-20 10:30:15 +01:00
mac80211 wifi: mac80211: mesh_plink: fix matches_local logic 2024-01-08 11:29:43 +01:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-14 11:30:45 +01:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:50:41 +01:00
ncsi net/ncsi: Fix netlink major/minor version numbers 2024-01-25 14:34:25 -08:00
netfilter netfilter: nf_tables: Reject tables of unsupported family 2024-01-15 18:25:29 +01:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-01-25 14:34:23 -08:00
netlink drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group 2023-12-13 18:18:17 +01:00
netrom netrom: Deny concurrent connect(). 2023-09-23 10:59:43 +02:00
nfc nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local 2024-01-15 18:25:25 +01:00
nsh net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() 2023-05-30 12:44:05 +01:00
openvswitch net: openvswitch: fix flow memory leak in ovs_flow_cmd_new 2023-02-22 12:50:25 +01:00
packet packet: Move reference count in packet_sock to atomic_long_t 2023-12-13 18:18:14 +01:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:23:33 +01:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:18:17 +01:00
qrtr net: qrtr: fix another OOB Read in qrtr_endpoint_post 2021-09-03 10:08:12 +02:00
rds net: prevent address rewrite in kernel_bind() 2023-10-25 11:53:18 +02:00
rfkill net: rfkill: gpio: set GPIO direction 2024-01-08 11:29:47 +01:00
rose net/rose: fix races in rose_kill_by_device() 2024-01-08 11:29:44 +01:00
rxrpc rxrpc: Fix hard call timeout units 2023-05-17 11:35:59 +02:00
sched net: sched: em_text: fix possible memory leak in em_text_destroy() 2024-01-15 18:25:25 +01:00
sctp sctp: update hb timer immediately after users change hb_interval 2023-10-10 21:46:45 +02:00
smc net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT 2023-11-20 10:30:16 +01:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-17 09:48:48 +01:00
sunrpc SUNRPC: Mark the cred for revalidation if the server rejects it 2023-10-10 21:46:35 +02:00
switchdev net: switchdev: do not propagate bridge updates across bridges 2021-10-27 09:54:24 +02:00
tipc tipc: Fix kernel-infoleak due to uninitialized TLV value 2023-11-28 16:50:16 +00:00
tls net: tls, update curr on splice as well 2024-01-15 18:25:29 +01:00
unix af_unix: Fix data-race around unix_tot_inflight. 2023-09-23 10:59:58 +02:00
vmw_vsock vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() 2023-12-20 15:41:17 +01:00
wimax wimax: no need to check return value of debugfs_create functions 2019-08-10 15:25:47 -07:00
wireless wifi: cfg80211: fix certs build to not depend on file order 2024-01-08 11:29:46 +01:00
x25 net/x25: Fix to not accept on connected socket 2023-02-22 12:50:26 +01:00
xdp xsk: Honor SO_BINDTODEVICE on bind 2023-07-27 08:37:23 +02:00
xfrm xfrm: interface: use DEV_STATS_INC() 2023-10-25 11:53:21 +02:00
compat.c net: Return the correct errno code 2021-06-18 09:59:00 +02:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:44:10 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:44:10 +02:00
socket.c net: Save and restore msg_namelen in sock_sendmsg 2024-01-15 18:25:26 +01:00
sysctl_net.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00