Skip to content

Conversation

@PlaidCat
Copy link
Collaborator

11 Clean Commits for 10 VUNS (plus 1 bugfix).

    net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull

    jira VULN-67488
    cve-bf CVE-2023-53125
    commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
    commit 43ffe6caccc7a1bb9d7442fbab521efbf6c1378c
    KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

    jira VULN-42535
    cve CVE-2024-26598
    commit-author Oliver Upton <oliver.upton@linux.dev>
    commit ad362fe07fecf0aba839ff2cc59a3617bd42c33f
    net: usb: smsc75xx: Limit packet length to skb->len

    jira VULN-67488
    cve CVE-2023-53125
    commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
    commit d8b228318935044dafe3a5bc07ee71a1f1424b8d
    scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

    jira VULN-55147
    cve CVE-2023-52974
    commit-author Mike Christie <michael.christie@oracle.com>
    commit f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3
    uio: Fix use-after-free in uio_open

    jira VULN-8873
    cve CVE-2023-52439
    commit-author Guanghui Feng <guanghuifeng@linux.alibaba.com>
    commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2
    wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

    jira VULN-155636
    cve CVE-2022-50408
    commit-author Alexander Coffin <alex.coffin@matician.com>
    commit 3f42faf6db431e04bf942d2ebe3ae88975723478
    ALSA: bcd2000: Fix a UAF bug on the error path of probing

    jira VULN-70299
    cve CVE-2022-50229
    commit-author Zheyu Ma <zheyuma97@gmail.com>
    commit ffb2759df7efbc00187bfd9d1072434a13a54139
    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0

    jira VULN-70727
    cve CVE-2022-50228
    commit-author Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
    commit f17c31c48e5cde9895a491d91c424eeeada3e134
    md-raid10: fix KASAN warning

    jira VULN-69562
    cve CVE-2022-50211
    commit-author Mikulas Patocka <mpatocka@redhat.com>
    commit d17f744e883b2f8d13cca252d71cfe8ace346f7d
    virtio-gpu: fix a missing check to avoid NULL dereference

    jira VULN-69525
    cve CVE-2022-50181
    commit-author Xiaomeng Tong <xiam0nd.tong@gmail.com>
    commit bd63f11f4c3c46afec07d821f74736161ff6e526
    RDMA/irdma: Fix a window for use-after-free

    jira VULN-70168
    cve CVE-2022-50137
    commit-author Mustafa Ismail <mustafa.ismail@intel.com>
    commit 8ecef7890b3aea78c8bbb501a4b5b8134367b821

Builder

[jmaple@devbox code]$ egrep -B 5 -A 5 "\[TIMER\]|^Starting Build" $(ls -t kbuild* | head -n1)
/mnt/code/kernel-src-tree-build
Running make mrproper...
[TIMER]{MRPROPER}: 5s
x86_64 architecture detected, copying config
'configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-183289"
Making olddefconfig
--
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
--
  LD [M]  sound/usb/usx2y/snd-usb-usx2y.ko
  LD [M]  sound/virtio/virtio_snd.ko
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1746s
Making Modules
  INSTALL arch/x86/crypto/blowfish-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx2.ko
  INSTALL arch/x86/crypto/camellia-x86_64.ko
--
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-183289+
[TIMER]{MODULES}: 11s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-183289+ arch/x86/boot/bzImage \
        System.map "/boot"
[TIMER]{INSTALL}: 18s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-183289+ and Index to 0
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 5s
[TIMER]{BUILD}: 1746s
[TIMER]{MODULES}: 11s
[TIMER]{INSTALL}: 18s
[TIMER]{TOTAL} 1784s
Rebooting in 10 seconds

KSelfTest

[jmaple@devbox code]$ ~/workspace/auto_kernel_history_rebuild/Rocky10/rocky10/code/get_kselftest_diff.sh
kselftest.4.18.0-fips-legacy-8-compliant_4.18.0-425.13.1-84640639ede1+.log
195
kselftest.4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-a85784+.log
195
kselftest.4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-8f4908+.log
195
kselftest.4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-183289+.log
195
Before: kselftest.4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-8f4908+.log
After: kselftest.4.18.0-jmaple_fips-legacy-8-compliant_4.18.0-425.13.1-183289+.log
Diff:
No differences found.

Interdiff

I've been having issues with my dev tools setup so if someone else has it running I'd take your responses.

jira VULN-70168
cve CVE-2022-50137
commit-author Mustafa Ismail <mustafa.ismail@intel.com>
commit 8ecef78

During a destroy CQ an interrupt may cause processing of a CQE after CQ
resources are freed by irdma_cq_free_rsrc(). Fix this by moving the call
to irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is
called under the cq_lock.

Fixes: b48c24c ("RDMA/irdma: Implement device supported verb APIs")
Link: https://lore.kernel.org/r/20220705230815.265-6-shiraz.saleem@intel.com
	Signed-off-by: Bartosz Sobczak <bartosz.sobczak@intel.com>
	Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
	Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
	Signed-off-by: Leon Romanovsky <leon@kernel.org>
(cherry picked from commit 8ecef78)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-69525
cve CVE-2022-50181
commit-author Xiaomeng Tong <xiam0nd.tong@gmail.com>
commit bd63f11

'cache_ent' could be set NULL inside virtio_gpu_cmd_get_capset()
and it will lead to a NULL dereference by a lately use of it
(i.e., ptr = cache_ent->caps_cache). Fix it with a NULL check.

Fixes: 62fb7a5 ("virtio-gpu: add 3d/virgl support")
	Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
	Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20220327050945.1614-1-xiam0nd.tong@gmail.com

[ kraxel: minor codestyle fixup ]

	Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit bd63f11)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-69562
cve CVE-2022-50211
commit-author Mikulas Patocka <mpatocka@redhat.com>
commit d17f744

There's a KASAN warning in raid10_remove_disk when running the lvm
test lvconvert-raid-reshape.sh. We fix this warning by verifying that the
value "number" is valid.

BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10]
Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682

CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x44
 print_report.cold+0x45/0x57a
 ? __lock_text_start+0x18/0x18
 ? raid10_remove_disk+0x61/0x2a0 [raid10]
 kasan_report+0xa8/0xe0
 ? raid10_remove_disk+0x61/0x2a0 [raid10]
 raid10_remove_disk+0x61/0x2a0 [raid10]
Buffer I/O error on dev dm-76, logical block 15344, async page read
 ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0
 remove_and_add_spares+0x367/0x8a0 [md_mod]
 ? super_written+0x1c0/0x1c0 [md_mod]
 ? mutex_trylock+0xac/0x120
 ? _raw_spin_lock+0x72/0xc0
 ? _raw_spin_lock_bh+0xc0/0xc0
 md_check_recovery+0x848/0x960 [md_mod]
 raid10d+0xcf/0x3360 [raid10]
 ? sched_clock_cpu+0x185/0x1a0
 ? rb_erase+0x4d4/0x620
 ? var_wake_function+0xe0/0xe0
 ? psi_group_change+0x411/0x500
 ? preempt_count_sub+0xf/0xc0
 ? _raw_spin_lock_irqsave+0x78/0xc0
 ? __lock_text_start+0x18/0x18
 ? raid10_sync_request+0x36c0/0x36c0 [raid10]
 ? preempt_count_sub+0xf/0xc0
 ? _raw_spin_unlock_irqrestore+0x19/0x40
 ? del_timer_sync+0xa9/0x100
 ? try_to_del_timer_sync+0xc0/0xc0
 ? _raw_spin_lock_irqsave+0x78/0xc0
 ? __lock_text_start+0x18/0x18
 ? _raw_spin_unlock_irq+0x11/0x24
 ? __list_del_entry_valid+0x68/0xa0
 ? finish_wait+0xa3/0x100
 md_thread+0x161/0x260 [md_mod]
 ? unregister_md_personality+0xa0/0xa0 [md_mod]
 ? _raw_spin_lock_irqsave+0x78/0xc0
 ? prepare_to_wait_event+0x2c0/0x2c0
 ? unregister_md_personality+0xa0/0xa0 [md_mod]
 kthread+0x148/0x180
 ? kthread_complete_and_exit+0x20/0x20
 ret_from_fork+0x1f/0x30
 </TASK>

Allocated by task 124495:
 kasan_save_stack+0x1e/0x40
 __kasan_kmalloc+0x80/0xa0
 setup_conf+0x140/0x5c0 [raid10]
 raid10_run+0x4cd/0x740 [raid10]
 md_run+0x6f9/0x1300 [md_mod]
 raid_ctr+0x2531/0x4ac0 [dm_raid]
 dm_table_add_target+0x2b0/0x620 [dm_mod]
 table_load+0x1c8/0x400 [dm_mod]
 ctl_ioctl+0x29e/0x560 [dm_mod]
 dm_compat_ctl_ioctl+0x7/0x20 [dm_mod]
 __do_compat_sys_ioctl+0xfa/0x160
 do_syscall_64+0x90/0xc0
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Last potentially related work creation:
 kasan_save_stack+0x1e/0x40
 __kasan_record_aux_stack+0x9e/0xc0
 kvfree_call_rcu+0x84/0x480
 timerfd_release+0x82/0x140
L __fput+0xfa/0x400
 task_work_run+0x80/0xc0
 exit_to_user_mode_prepare+0x155/0x160
 syscall_exit_to_user_mode+0x12/0x40
 do_syscall_64+0x42/0xc0
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

Second to last potentially related work creation:
 kasan_save_stack+0x1e/0x40
 __kasan_record_aux_stack+0x9e/0xc0
 kvfree_call_rcu+0x84/0x480
 timerfd_release+0x82/0x140
 __fput+0xfa/0x400
 task_work_run+0x80/0xc0
 exit_to_user_mode_prepare+0x155/0x160
 syscall_exit_to_user_mode+0x12/0x40
 do_syscall_64+0x42/0xc0
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

The buggy address belongs to the object at ffff889108f3d200
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 0 bytes to the right of
 256-byte region [ffff889108f3d200, ffff889108f3d300)

The buggy address belongs to the physical page:
page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c
head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=2)
raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff889108f3d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff889108f3d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff889108f3d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff889108f3d400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

	Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
	Cc: stable@vger.kernel.org
	Signed-off-by: Song Liu <song@kernel.org>
	Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit d17f744)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-70727
cve CVE-2022-50228
commit-author Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
commit f17c31c

Don't BUG/WARN on interrupt injection due to GIF being cleared,
since it's trivial for userspace to force the situation via
KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct
for KVM internally generated injections).

  kernel BUG at arch/x86/kvm/svm/svm.c:3386!
  invalid opcode: 0000 [#1] SMP
  CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd]
  Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53
  RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246
  RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006
  RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0
  RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
  R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000
  FS:  0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0
  Call Trace:
   <TASK>
   inject_pending_event+0x2f7/0x4c0 [kvm]
   kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm]
   kvm_vcpu_ioctl+0x26d/0x650 [kvm]
   __x64_sys_ioctl+0x82/0xb0
   do_syscall_64+0x3b/0xc0
   entry_SYSCALL_64_after_hwframe+0x44/0xae
   </TASK>

Fixes: 219b65d ("KVM: SVM: Improve nested interrupt injection")
	Cc: stable@vger.kernel.org
Co-developed-by: Sean Christopherson <seanjc@google.com>
	Signed-off-by: Sean Christopherson <seanjc@google.com>
	Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Message-Id: <35426af6e123cbe91ec7ce5132ce72521f02b1b5.1651440202.git.maciej.szmigiero@oracle.com>
	Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit f17c31c)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-70299
cve CVE-2022-50229
commit-author Zheyu Ma <zheyuma97@gmail.com>
commit ffb2759

When the driver fails in snd_card_register() at probe time, it will free
the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.

The following log can reveal it:

[   50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]
[   50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0
[   50.729530] Call Trace:
[   50.732899]  bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]

Fix this by adding usb_kill_urb() before usb_free_urb().

Fixes: b47a222 ("ALSA: MIDI driver for Behringer BCD2000 USB device")
	Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
	Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com
	Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit ffb2759)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-155636
cve CVE-2022-50408
commit-author Alexander Coffin <alex.coffin@matician.com>
commit 3f42faf

> ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb);

may be schedule, and then complete before the line

> ndev->stats.tx_bytes += skb->len;

[   46.912801] ==================================================================
[   46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]
[   46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328
[   46.935991]
[   46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G           O      5.4.199-[REDACTED] #1
[   46.947255] Hardware name: [REDACTED]
[   46.954568] Call trace:
[   46.957037]  dump_backtrace+0x0/0x2b8
[   46.960719]  show_stack+0x24/0x30
[   46.964052]  dump_stack+0x128/0x194
[   46.967557]  print_address_description.isra.0+0x64/0x380
[   46.972877]  __kasan_report+0x1d4/0x240
[   46.976723]  kasan_report+0xc/0x18
[   46.980138]  __asan_report_load4_noabort+0x18/0x20
[   46.985027]  brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]
[   46.990613]  dev_hard_start_xmit+0x1bc/0xda0
[   46.994894]  sch_direct_xmit+0x198/0xd08
[   46.998827]  __qdisc_run+0x37c/0x1dc0
[   47.002500]  __dev_queue_xmit+0x1528/0x21f8
[   47.006692]  dev_queue_xmit+0x24/0x30
[   47.010366]  neigh_resolve_output+0x37c/0x678
[   47.014734]  ip_finish_output2+0x598/0x2458
[   47.018927]  __ip_finish_output+0x300/0x730
[   47.023118]  ip_output+0x2e0/0x430
[   47.026530]  ip_local_out+0x90/0x140
[   47.030117]  igmpv3_sendpack+0x14c/0x228
[   47.034049]  igmpv3_send_cr+0x384/0x6b8
[   47.037895]  igmp_ifc_timer_expire+0x4c/0x118
[   47.042262]  call_timer_fn+0x1cc/0xbe8
[   47.046021]  __run_timers+0x4d8/0xb28
[   47.049693]  run_timer_softirq+0x24/0x40
[   47.053626]  __do_softirq+0x2c0/0x117c
[   47.057387]  irq_exit+0x2dc/0x388
[   47.060715]  __handle_domain_irq+0xb4/0x158
[   47.064908]  gic_handle_irq+0x58/0xb0
[   47.068581]  el0_irq_naked+0x50/0x5c
[   47.072162]
[   47.073665] Allocated by task 328:
[   47.077083]  save_stack+0x24/0xb0
[   47.080410]  __kasan_kmalloc.isra.0+0xc0/0xe0
[   47.084776]  kasan_slab_alloc+0x14/0x20
[   47.088622]  kmem_cache_alloc+0x15c/0x468
[   47.092643]  __alloc_skb+0xa4/0x498
[   47.096142]  igmpv3_newpack+0x158/0xd78
[   47.099987]  add_grhead+0x210/0x288
[   47.103485]  add_grec+0x6b0/0xb70
[   47.106811]  igmpv3_send_cr+0x2e0/0x6b8
[   47.110657]  igmp_ifc_timer_expire+0x4c/0x118
[   47.115027]  call_timer_fn+0x1cc/0xbe8
[   47.118785]  __run_timers+0x4d8/0xb28
[   47.122457]  run_timer_softirq+0x24/0x40
[   47.126389]  __do_softirq+0x2c0/0x117c
[   47.130142]
[   47.131643] Freed by task 180:
[   47.134712]  save_stack+0x24/0xb0
[   47.138041]  __kasan_slab_free+0x108/0x180
[   47.142146]  kasan_slab_free+0x10/0x18
[   47.145904]  slab_free_freelist_hook+0xa4/0x1b0
[   47.150444]  kmem_cache_free+0x8c/0x528
[   47.154292]  kfree_skbmem+0x94/0x108
[   47.157880]  consume_skb+0x10c/0x5a8
[   47.161466]  __dev_kfree_skb_any+0x88/0xa0
[   47.165598]  brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil]
[   47.171023]  brcmf_txfinalize+0xec/0x190 [brcmfmac]
[   47.176016]  brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac]
[   47.182056]  brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac]
[   47.187568]  brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac]
[   47.192529]  brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac]
[   47.197859]  process_one_work+0x7fc/0x1a80
[   47.201965]  worker_thread+0x31c/0xc40
[   47.205726]  kthread+0x2d8/0x370
[   47.208967]  ret_from_fork+0x10/0x18
[   47.212546]
[   47.214051] The buggy address belongs to the object at ffffff803f588280
[   47.214051]  which belongs to the cache skbuff_head_cache of size 208
[   47.227086] The buggy address is located 104 bytes inside of
[   47.227086]  208-byte region [ffffff803f588280, ffffff803f588350)
[   47.238814] The buggy address belongs to the page:
[   47.243618] page:ffffffff00dd6200 refcount:1 mapcount:0 mapping:ffffff804b6bf800 index:0xffffff803f589900 compound_mapcount: 0
[   47.255007] flags: 0x10200(slab|head)
[   47.258689] raw: 0000000000010200 ffffffff00dfa980 0000000200000002 ffffff804b6bf800
[   47.266439] raw: ffffff803f589900 0000000080190018 00000001ffffffff 0000000000000000
[   47.274180] page dumped because: kasan: bad access detected
[   47.279752]
[   47.281251] Memory state around the buggy address:
[   47.286051]  ffffff803f588180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   47.293277]  ffffff803f588200: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   47.300502] >ffffff803f588280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   47.307723]                                                           ^
[   47.314343]  ffffff803f588300: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
[   47.321569]  ffffff803f588380: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   47.328789] ==================================================================

	Signed-off-by: Alexander Coffin <alex.coffin@matician.com>
	Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220808174925.3922558-1-alex.coffin@matician.com
(cherry picked from commit 3f42faf)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-8873
cve CVE-2023-52439
commit-author Guanghui Feng <guanghuifeng@linux.alibaba.com>
commit 0c9ae0b

core-1				core-2
-------------------------------------------------------
uio_unregister_device		uio_open
				idev = idr_find()
device_unregister(&idev->dev)
put_device(&idev->dev)
uio_device_release
				get_device(&idev->dev)
kfree(idev)
uio_free_minor(minor)
				uio_release
				put_device(&idev->dev)
				kfree(idev)
-------------------------------------------------------

In the core-1 uio_unregister_device(), the device_unregister will kfree
idev when the idev->dev kobject ref is 1. But after core-1
device_unregister, put_device and before doing kfree, the core-2 may
get_device. Then:
1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
2. When core-2 do uio_release and put_device, the idev will be double
   freed.

To address this issue, we can get idev atomic & inc idev reference with
minor_lock.

Fixes: 57c5f4d ("uio: fix crash after the device is unregistered")
	Cc: stable <stable@kernel.org>
	Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
	Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@linux.alibaba.com
	Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0c9ae0b)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-55147
cve CVE-2023-52974
commit-author Mike Christie <michael.christie@oracle.com>
commit f484a79

If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,
userspace could be accessing the host's ipaddress attr. If we then free the
session via iscsi_session_teardown() while userspace is still accessing the
session we will hit a use after free bug.

Set the tcp_sw_host->session after we have completed session creation and
can no longer fail.

Link: https://lore.kernel.org/r/20230117193937.21244-3-michael.christie@oracle.com
	Signed-off-by: Mike Christie <michael.christie@oracle.com>
	Reviewed-by: Lee Duncan <lduncan@suse.com>
	Acked-by: Ding Hui <dinghui@sangfor.com.cn>
	Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
(cherry picked from commit f484a79)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-67488
cve CVE-2023-53125
commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
commit d8b2283

Packet length retrieved from skb data may be larger than
the actual socket buffer length (up to 9026 bytes). In such
case the cloned skb passed up the network stack will leak
kernel memory contents.

Fixes: d0cad87 ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
	Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit d8b2283)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat PlaidCat requested a review from a team October 22, 2025 21:11
@PlaidCat PlaidCat self-assigned this Oct 22, 2025
Copy link

@roxanan1996 roxanan1996 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. And interdiff does not complain.

Nitpick: I would put the cve-bf patch (last one here) next to the cve patch it fixes.

@bmastbergen bmastbergen self-requested a review October 23, 2025 13:36
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

brett@iconium ~/ciq/kernel-src-tree-tools
 % python ./run_interdiff.py --repo ~/ciq/kernel-src-tree --pr_branch origin/{jmaple}_fips-legacy-8-compliant/4.18.0-425.13.1 --base_branch origin/fips-legacy-8-compliant/4.18.0-425.13.1 --interdiff /home/brett/ciq/interdiff/patchutils/src/interdiff
All backported commits match their upstream counterparts.

🥌

@PlaidCat
Copy link
Collaborator Author

LGTM. And interdiff does not complain.

Nitpick: I would put the cve-bf patch (last one here) next to the cve patch it fixes.

Let me rebase and reorganize this ... i will not rerun the build and testing locally

…in skb_pull

jira VULN-67488
cve-bf CVE-2023-53125
commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
commit 43ffe6c

Packet length check needs to be located after size and align_count
calculation to prevent kernel panic in skb_pull() in case
rx_cmd_a & RX_CMD_A_RED evaluates to true.

Fixes: d8b2283 ("net: usb: smsc75xx: Limit packet length to skb->len")
	Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20230316110540.77531-1-szymon.heidrich@gmail.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 43ffe6c)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira VULN-42535
cve CVE-2024-26598
commit-author Oliver Upton <oliver.upton@linux.dev>
commit ad362fe

There is a potential UAF scenario in the case of an LPI translation
cache hit racing with an operation that invalidates the cache, such
as a DISCARD ITS command. The root of the problem is that
vgic_its_check_cache() does not elevate the refcount on the vgic_irq
before dropping the lock that serializes refcount changes.

Have vgic_its_check_cache() raise the refcount on the returned vgic_irq
and add the corresponding decrement after queueing the interrupt.

	Cc: stable@vger.kernel.org
	Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
	Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev
(cherry picked from commit ad362fe)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat PlaidCat force-pushed the {jmaple}_fips-legacy-8-compliant/4.18.0-425.13.1 branch from 183289b to e2c07ca Compare October 23, 2025 16:00
@PlaidCat PlaidCat merged commit e2c07ca into fips-legacy-8-compliant/4.18.0-425.13.1 Oct 23, 2025
2 checks passed
@PlaidCat PlaidCat deleted the {jmaple}_fips-legacy-8-compliant/4.18.0-425.13.1 branch October 23, 2025 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

4 participants