[LTS 9.4] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

[pvts-mat]

[LTS 9.4]
CVE-2025-21785
VULN-54131

Problem

https://www.cve.org/CVERecord?id=CVE-2025-21785

In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).

Solution

The official fix in the mainline kernel is provided in the 875d742 commit

arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

The loop that detects/populates cache information already has a bounds
check on the array size but does not account for cache levels with
separate data/instructions cache. Fix this by incrementing the index
for any populated leaf (instead of any populated level).

The 5.15 backport (closest to ciqlts9_4 kernel version 5.14) is provided in the 88a3e6afaf002250220793df99404977d343db14 commit, and it has no differences compared to the mainline solution.

kABI check: passed

DEBUG=1 CVE=CVE-2025-21785 ./ninja.sh _kabi_checked__aarch64--test--ciqlts9_4-CVE-2025-21785

ninja: Entering directory `/data/build/rocky-patching'
[0/1] Check ABI of kernel [ciqlts9_4-CVE-2025-21785]
++ uname -m
+ python3 /home/pvts/ctrliq-github/kernel-dist-git-el-9.4/SOURCES/check-kabi -k /home/pvts/ctrliq-github/kernel-dist-git-el-9.4/SOURCES/Module.kabi_aarch64 -s vms/aarch64--build--ciqlts9_4/build_files/kernel-src-tree-ciqlts9_4-CVE-2025-21785/Module.symvers
kABI check passed
+ touch state/kernels/ciqlts9_4-CVE-2025-21785/aarch64/kabi_checked

(The el-9.4 branch was missing from https://github.com/ciq-rocky-lts/kernel, it was added by hand on the imports/r9/kernel-5.14.0-427.42.1.el9_4 tag from the added https://git.rockylinux.org/staging/rpms/kernel.git repo)

Boot test: passed

boot-test.log

Kselftests: passed relative

Methodology

The tests were run using the rocky-patching framework (qemu-kvm virtualization of Rocky base cloud aarch64 images) ported to the local WHLE-LS1046A machine, based on the NXP Layerscape LS1046A arm64 processor.

• kernel-selftests-internal package: bpf tests.
• source-compiled selftests: (commit f794e72) all the rest.

Some specific tests were excluded, see below.

Coverage

bpf (except test_progs-no_alu32, test_progs, test_xsk.sh, test_kmod.sh, test_sockmap), breakpoints, capabilities, clone3, cpu-hotplug, cpufreq, drivers/dma-buf, drivers/net/bonding, drivers/net/team, efivarfs, exec, filesystems/binderfs, filesystems/epoll, firmware, fpu, ftrace, futex, gpio, hid, intel_pstate, iommu, ipc, ir, kcmp, kvm, landlock, lib, livepatch, membarrier, memfd, memory-hotplug, mincore, mount, mqueue, nci, net/forwarding (except sch_tbf_prio.sh, sch_ets.sh, tc_actions.sh, sch_red.sh, dual_vxlan_bridge.sh, sch_tbf_ets.sh, tc_police.sh, sch_tbf_root.sh, ipip_hier_gre_keys.sh), net/hsr, net/mptcp (except simult_flows.sh), net (except ip_defrag.sh, gro.sh, udpgso_bench.sh, xfrm_policy.sh, reuseport_addr_any.sh, txtimestamp.sh, reuseaddr_conflict), netfilter (except nft_trans_stress.sh), nsfs, pid_namespace, pidfd, proc (except proc-pid-vm), pstore, ptrace, rlimits, rseq, seccomp, sgx, sigaltstack, size, splice, static_keys, sync, syscall_user_dispatch, sysctl, tc-testing, tdx, timens, timers, tmpfs, tpm2, tty, user, vDSO, zram.

Reference

kselftests–ciqlts9_4–run1.log
kselftests–ciqlts9_4–run2.log
kselftests–ciqlts9_4–run3.log

Patch

kselftests–ciqlts9_4-CVE-2025-21785–run1.log

Comparison

Column    File
--------  ----------------------------------------------
Status0   kselftests--ciqlts9_4--run1.log
Status1   kselftests--ciqlts9_4--run2.log
Status2   kselftests--ciqlts9_4--run3.log
Status3   kselftests--ciqlts9_4-CVE-2025-21785--run1.log

TestCase                                     Status0  Status1  Status2  Status3  Summary
filesystems/epoll:epoll_wakeup_test          pass     fail     fail     fail     diff
net/forwarding:mirror_gre_vlan_bridge_1q.sh  pass     fail     pass     pass     diff
net/forwarding:router_bridge_1d_lag.sh       fail     pass     pass     pass     diff
net/forwarding:router_bridge_lag.sh          pass     pass     fail     pass     diff
net/forwarding:vxlan_bridge_1d_ipv6.sh       fail     pass     pass     pass     diff
net:fib_nexthops.sh                          pass     pass     fail     pass     diff
net:srv6_end_dt46_l3vpn_test.sh              fail     fail     fail     pass     diff
net:srv6_end_dt4_l3vpn_test.sh               pass     fail     pass     fail     diff
net:srv6_end_dt6_l3vpn_test.sh               fail     pass     pass     pass     diff

All differences are contained within the reference kernel tests, except for net:srv6_end_dt46_l3vpn_test.sh which passed in the patched kernel. Many ciqlts9_4 tests reporting inconsistent results, similarly to #256. Added to the kselftests knowledge base https://gitlab.conclusive.pl/devices/rocky-patching/-/blob/master/rocky.yml?ref_type=heads

Specific tests: skipped

To be done on demand

[bmastbergen]

🥌

[thefossguy-ciq]

🚤

[bmastbergen]

🥌

[PlaidCat]