[FIPS-9.2] Multiple VULNS 22/10/25

[shreeya-patel98]

Commits

    can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
    
    jira VULN-63436
    cve CVE-2021-47459
    commit-author Ziyang Xuan <william.xuanziyang@huawei.com>
    commit d9d52a3ebd284882f5562c88e55991add5d01586
    
    It will trigger UAF for rx_kref of j1939_priv as following.
    

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
    
    jira VULN-70089
    cve CVE-2022-50087
    commit-author Sudeep Holla <sudeep.holla@arm.com>
    commit 689640efc0a2c4e07e6f88affe6d42cd40cc3f85
 
    

    net: usb: smsc75xx: Limit packet length to skb->len
    
    jira VULN-67491
    cve CVE-2023-53125
    commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
    commit d8b228318935044dafe3a5bc07ee71a1f1424b8d
    

    net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
    
    jira VULN-67491
    cve-bf CVE-2023-53125
    commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
    commit 43ffe6caccc7a1bb9d7442fbab521efbf6c1378c

    skbuff: Fix a race between coalescing and releasing SKBs
    
    jira VULN-154361
    cve CVE-2023-53186
    commit-author Liang Chen <liangchen.linux@gmail.com>
    commit 0646dc31ca886693274df5749cd0c8c1eaaeb5ca
    

    skbuff: skb_segment, Call zero copy functions before using skbuff frags
    
    jira VULN-155413
    cve CVE-2023-53354
    commit-author Mohamed Khalfella <mkhalfella@purestorage.com>
    commit 2ea35288c83b3d501a88bc17f2df8f176b5cc96f
    

    ext4: fix double-free of blocks due to wrong extents moved_len
    
    jira VULN-42475
    cve CVE-2024-26704
    commit-author Baokun Li <libaokun1@huawei.com>
    commit 55583e899a5357308274601364741a83e78d6ac4
    

    padata: fix UAF in padata_reorder
    
    jira VULN-53767
    cve CVE-2025-21727
    commit-author Chen Ridong <chenridong@huawei.com>
    commit e01780ea4661172734118d2a5f41bc9720765668

    memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
    
    jira VULN-64888
    cve CVE-2025-22020
    commit-author Luo Qiu <luoqiu@kylinsec.com.cn>
    commit 4676741a3464b300b486e70585c3c9b692be1632
    

    ibmvnic: Use kernel helpers for hex dumps
    
    jira VULN-65342
    cve CVE-2025-22104
    commit-author Nick Child <nnac123@linux.ibm.com>
    commit d93a6caab5d7d9b5ce034d75b1e1e993338e3852
    

    ext4: fix off-by-one error in do_split
    
    jira VULN-66676
    cve CVE-2025-23150
    commit-author Artem Sadovnikov <a.sadovnikov@ispras.ru>
    commit 94824ac9a8aaf2fb3c54b4bdde842db80ffa555d
    

    ext4: ignore xattrs past end
    
    jira VULN-66828
    cve CVE-2025-37738
    commit-author Bhupesh <bhupesh@igalia.com>
    commit c8e008b60492cf6fd31ef127aea6d02fd3d314cd
    

Kernel Build Log

[shreeya@localhost kernel-src-tree]$ ../kernel-src-tree-tools/kernel_build.sh -m 2>&1 | tee ../kernel-build.log
/mnt/scratch/workspace/fips-9-compliant/kernel-src-tree
Skipping make mrproper
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965"
Making olddefconfig
#
# configuration written to .config
#
Starting Build
 SYNC    include/config/auto.conf.cmd
 UPD     include/config/kernel.release
 DESCEND objtool
 DESCEND bpf/resolve_btfids
 UPD     include/generated/utsrelease.h
 CALL    scripts/atomic/check-atomics.sh
warning: generated include/linux/atomic/atomic-instrumented.h has been modified.
 CALL    scripts/checksyscalls.sh
 CHK     include/generated/compile.h
 CC      init/version.o
 CC      arch/x86/crypto/aesni-intel_glue.o
 AR      init/built-in.a
 CC      kernel/sys.o
 CC [M]  net/bridge/br_device.o
 CC [M]  net/bridge/br_forward.o
 AR      arch/x86/crypto/built-in.a
 CC [M]  net/l2tp/l2tp_core.o
 CC      crypto/fips.o
 CC      security/integrity/ima/ima_init.o
 CC      crypto/algapi.o
 CC [M]  net/bridge/br_if.o
 AR      arch/x86/built-in.a
 AR      security/integrity/ima/built-in.a
 AR      security/integrity/built-in.a
 AR      security/built-in.a
 <--snip-->
 STRIP   /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/usb/snd-usb-audio.ko
 INSTALL /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/xen/snd_xen_front.ko
 SIGN    /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/usb/misc/snd-ua101.ko
 SIGN    /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/usb/usx2y/snd-usb-us122l.ko
 STRIP   /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
 STRIP   /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/xen/snd_xen_front.ko
 SIGN    /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/virtio/virtio_snd.ko
 SIGN    /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/usb/snd-usb-audio.ko
 SIGN    /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/x86/snd-hdmi-lpe-audio.ko
 SIGN    /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/sound/xen/snd_xen_front.ko
 SIGN    /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+/kernel/drivers/net/ipvlan/ipvtap.ko
 DEPMOD  /lib/modules/5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+
[TIMER]{MODULES}: 10s
Making Install
sh ./arch/x86/boot/install.sh \
   5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-169ee76f6965+ arch/x86/boot/bzImage \
   System.map "/boot"
[TIMER]{INSTALL}: 21s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-f5000b080a7e+ and Index to 4
The default is /boot/loader/entries/809410938d1447fc931cf787fb714082-5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-f5000b080a7e+.conf with index 4 and kernel /boot/vmlinuz-5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-f5000b080a7e+
The default is /boot/loader/entries/809410938d1447fc931cf787fb714082-5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-f5000b080a7e+.conf with index 4 and kernel /boot/vmlinuz-5.14.0-shreeya_fips-9-compliant_5.14.0-284.30.1-f5000b080a7e+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 271s
[TIMER]{MODULES}: 10s
[TIMER]{INSTALL}: 21s
[TIMER]{TOTAL} 305s
Rebooting in 10 seconds

kernel-build.log

Testing

shreeya@spatel-dev-bom ~/c/w/fips-9-compliant> grep -a ^ok kselftest-before.log | wc -l
317
shreeya@spatel-dev-bom ~/c/w/fips-9-compliant> grep -a ^ok kselftest-after.log | wc -l
317

kselftest-after.log
kselftest-before.log

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit c26a53e44606 (net: usb: smsc75xx: Limit packet length to skb->len) references upstream commit
  d8b228318935 which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    43ffe6caccc7 net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (Szymon Heidrich)

This is an automated message from the kernel commit checker workflow.

[kerneltoast]

With the new --fuzzy=0 option for interdiff, only one hunk differed for this entire PR, in padata: fix UAF in padata_reorder:

$ interdiff --fuzzy=0 <(git format-patch -1 --stdout fdb010fbf4767) <(git format-patch -1 --stdout e01780ea46611)
1 out of 1 hunk FAILED -- saving rejects to file /tmp/interdiff-2.7An9vf.rej
diff -u b/kernel/padata.c b/kernel/padata.c
--- b/kernel/padata.c
+++ b/kernel/padata.c
@@ -1135,6 +1135,12 @@
 	if (!ps)
 		return;
 
+	/*
+	 * Wait for all _do_serial calls to finish to avoid touching
+	 * freed pd's and ps's.
+	 */
+	synchronize_rcu();
+
 	mutex_lock(&ps->pinst->lock);
 	list_del(&ps->list);
 	pd = rcu_dereference_protected(ps->pd, 1);

The backport patch looks like this:

+++ b/kernel/padata.c
@@ -1105,6 +1105,12 @@ void padata_free_shell(struct padata_shell *ps)
 	if (!ps)
 		return;
 
+	/*
+	 * Wait for all _do_serial calls to finish to avoid touching
+	 * freed pd's and ps's.
+	 */
+	synchronize_rcu();
+
 	mutex_lock(&ps->pinst->lock);
 	list_del(&ps->list);
 	padata_free_pd(rcu_dereference_protected(ps->pd, 1));

The differing context line is the very last line, where the upstream patch has padata_free_pd(rcu_dereference_protected(ps->pd, 1)); instead of pd = rcu_dereference_protected(ps->pd, 1);.

I did a git blame and found out that the difference comes from this commit that we're missing commit 7ddc21e (padata: Fix refcnt handling in padata_free_shell()). Which happens to be the fix for CVE-2023-52854!

We already have that CVE ingested in JIRA, so it doesn't need to be added into this PR, but maybe it'd make sense to add it along?

(@PlaidCat Figured you'd find this interdiff result interesting since we were just talking about it. 🙂)

[shreeya-patel98]

@kerneltoast Don't you think it will be more complicated if we check for these kind of differences as well? I mean there can be multiple fixes missing in the file or in the same function. It might also not necessarily be related to the change we are doing.

[roxanan1996]

LGTM

[PlaidCat]

@kerneltoast Don't you think it will be more complicated if we check for these kind of differences as well? I mean there can be multiple fixes missing in the file or in the same function. It might also not necessarily be related to the change we are doing.

I think this kind of interdiff is important, but It can be as basic as "does not impact change" but it should call it out as a difference in the event we do find something worth looking at or investigating further. I would have probably stopped and looked at this when I do my manual review, which im still doing and looked through the comments first.. We actually used to make upstream-diff comments when the context window was impacted along the lines of merge conflict in context window.

Fuzz in context is potentially a very bad thing which is why I called it out in another PR as to why something I found wasn't being caught initially. All of this is hints to the reviewers to speed up the review process.

[kerneltoast]

🚢

[kerneltoast]

@kerneltoast Don't you think it will be more complicated if we check for these kind of differences as well? I mean there can be multiple fixes missing in the file or in the same function. It might also not necessarily be related to the change we are doing.

@shreeya-patel98 Since we're only interdiff'ing patches with the standard 3 lines of context before + after each delta, that means we're just looking at code differences a mere 3 lines away from the delta. Generally, I don't think this will produce a lot of noise for us if we do a quick git blame to find why at least 1 of those 3 lines is different.

And interdiff gives us such a big speedup in the review process that we can leverage it like this to vastly improve review accuracy as well.

For example, to review the code changes in this entire PR, I only had to look at a single tiny hunk that interdiff emitted. And that hunk was the one I put in my comment above.

With the time and effort saved from not needing to manually scrutinize the code from each individual commit, I was able to use that to instead dig a little deeper into why there was a context difference for that one hunk. And although the context difference was ultimately just a fix for a CVE we've already cataloged (and therefore there was no action to take), it was technically still relevant to the commit in this PR.

And even after digging a little deeper there, I still finished the code review for this entire PR much faster than before interdiff.

I wrote up that comment about my finding to highlight the potential value of validating that all 3 context lines are the same.