|
 |
bde638 |
From: Joe Lawrence <joe.lawrence@redhat.com>
|
|
|
bde638 |
Date: Tue, 6 Jul 2021 13:18:44 -0400
|
|
|
bde638 |
Subject: [kernel team] [EMBARGOED KPATCH 7.9] seq_file: kpatch fix for
|
|
|
bde638 |
CVE-2021-33909
|
|
|
bde638 |
|
|
|
bde638 |
Kernels:
|
|
|
bde638 |
3.10.0-1160.el7
|
|
|
bde638 |
3.10.0-1160.2.1.el7
|
|
|
bde638 |
3.10.0-1160.2.2.el7
|
|
|
bde638 |
3.10.0-1160.6.1.el7
|
|
|
bde638 |
3.10.0-1160.11.1.el7
|
|
|
bde638 |
3.10.0-1160.15.2.el7
|
|
|
bde638 |
3.10.0-1160.21.1.el7
|
|
|
bde638 |
3.10.0-1160.24.1.el7
|
|
|
bde638 |
3.10.0-1160.25.1.el7
|
|
|
bde638 |
3.10.0-1160.31.1.el7
|
|
|
bde638 |
|
|
|
bde638 |
Changes since last build:
|
|
|
bde638 |
arches: x86_64 ppc64le
|
|
|
bde638 |
seq_file.o: changed function: seq_read
|
|
|
bde638 |
seq_file.o: changed function: single_open_size
|
|
|
bde638 |
seq_file.o: changed function: traverse
|
|
|
bde638 |
---------------------------
|
|
|
bde638 |
|
|
|
bde638 |
Kernels:
|
|
|
bde638 |
3.10.0-1160.el7
|
|
|
bde638 |
3.10.0-1160.2.1.el7
|
|
|
bde638 |
3.10.0-1160.2.2.el7
|
|
|
bde638 |
3.10.0-1160.6.1.el7
|
|
|
bde638 |
3.10.0-1160.11.1.el7
|
|
|
bde638 |
3.10.0-1160.15.2.el7
|
|
|
bde638 |
3.10.0-1160.21.1.el7
|
|
|
bde638 |
3.10.0-1160.24.1.el7
|
|
|
bde638 |
3.10.0-1160.25.1.el7
|
|
|
bde638 |
3.10.0-1160.31.1.el7
|
|
|
bde638 |
|
|
|
bde638 |
Modifications:
|
|
|
bde638 |
- inline PAGE_CACHE_SHIFT rather than including linux/pagemap.h and
|
|
|
bde638 |
fighting kABI fallout (and potentially more inadvertent changes)
|
|
|
bde638 |
|
|
|
bde638 |
commit 1236d5dd5b9f13ccbb44979a5652a4b137b968a4
|
|
|
bde638 |
Author: Ian Kent <ikent@redhat.com>
|
|
|
bde638 |
Date: Thu Jul 1 09:13:59 2021 +0800
|
|
|
bde638 |
|
|
|
bde638 |
seq_file: Disallow extremely large seq buffer allocations
|
|
|
bde638 |
|
|
|
bde638 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1975251
|
|
|
bde638 |
|
|
|
bde638 |
Brew build: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=37832573
|
|
|
bde638 |
|
|
|
bde638 |
Testing: The patch has been tested by Qualys and it has been
|
|
|
bde638 |
confirmed the patch fixes the problem.
|
|
|
bde638 |
|
|
|
bde638 |
Upstream status: RHEL only (CVE-2021-33909)
|
|
|
bde638 |
|
|
|
bde638 |
Conflicts: include/fs.h uses PAGE_CACHE_SHIFT in the definition of
|
|
|
bde638 |
MAX_RW_COUNT which isn't defined in fs/seq_file.c and including
|
|
|
bde638 |
linux/pagemap.h breaks kabi (since it makes kabi aware of additional
|
|
|
bde638 |
structs) even though there are no changes to any structures. So the
|
|
|
bde638 |
include needs to be added and excluded from the kabi calculation.
|
|
|
bde638 |
|
|
|
bde638 |
Author: Eric Sandeen <sandeen@redhat.com>
|
|
|
bde638 |
|
|
|
bde638 |
seq_file: Disallow extremely large seq buffer allocations
|
|
|
bde638 |
|
|
|
bde638 |
There is no reasonable need for a buffer larger than this,
|
|
|
bde638 |
and it avoids int overflow pitfalls.
|
|
|
bde638 |
|
|
|
bde638 |
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
|
|
|
bde638 |
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
|
|
|
bde638 |
|
|
|
bde638 |
Signed-off-by: Ian Kent <ikent@redhat.com>
|
|
|
bde638 |
|
|
|
bde638 |
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
|
|
|
bde638 |
Acked-by: Artem Savkov <asavkov@redhat.com>
|
|
|
bde638 |
Acked-by: Yannick Cote <ycote@redhat.com>
|
|
|
bde638 |
---
|
|
|
bde638 |
|
|
|
bde638 |
Z-MR: https://gitlab.com/redhat/prdsc/rhel/src/kernel-private/rhel-7/-/merge_requests/7
|
|
|
bde638 |
|
|
|
bde638 |
KT0 test PASS: https://beaker.engineering.redhat.com/jobs/5525685
|
|
|
bde638 |
for kpatch-patch-3_10_0-1160-1-7.el7 scratch build:
|
|
|
bde638 |
https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=37846414
|
|
|
bde638 |
|
|
|
bde638 |
fs/seq_file.c | 23 +++++++++++++++++++++++
|
|
|
bde638 |
1 file changed, 23 insertions(+)
|
|
|
bde638 |
|
|
|
bde638 |
diff --git a/fs/seq_file.c b/fs/seq_file.c
|
|
|
bde638 |
index bc7a9ec855aa..daef8f4bdbd0 100644
|
|
|
bde638 |
--- a/fs/seq_file.c
|
|
|
bde638 |
+++ b/fs/seq_file.c
|
|
|
bde638 |
@@ -5,6 +5,26 @@
|
|
|
bde638 |
* initial implementation -- AV, Oct 2001.
|
|
|
bde638 |
*/
|
|
|
bde638 |
|
|
|
bde638 |
+/* inline linux/pagemap.h :: PAGE_CACHE_MASK and dependency values */
|
|
|
bde638 |
+
|
|
|
bde638 |
+/* arch/x86/include/asm/page_types.h */
|
|
|
bde638 |
+#ifdef __x86_64__
|
|
|
bde638 |
+# define PAGE_CACHE_MASK (~((1UL << 12)-1))
|
|
|
bde638 |
+#endif
|
|
|
bde638 |
+
|
|
|
bde638 |
+/* arch/powerpc/include/asm/page.h */
|
|
|
bde638 |
+#ifdef __powerpc64__
|
|
|
bde638 |
+# if defined(CONFIG_PPC_256K_PAGES)
|
|
|
bde638 |
+# define PAGE_CACHE_MASK (~((1 << 18) - 1))
|
|
|
bde638 |
+# elif defined(CONFIG_PPC_64K_PAGES)
|
|
|
bde638 |
+# define PAGE_CACHE_MASK (~((1 << 16) - 1))
|
|
|
bde638 |
+# elif defined(CONFIG_PPC_16K_PAGES)
|
|
|
bde638 |
+# define PAGE_CACHE_MASK (~((1 << 14) - 1))
|
|
|
bde638 |
+# else
|
|
|
bde638 |
+# define PAGE_CACHE_MASK (~((1 << 12) - 1))
|
|
|
bde638 |
+# endif
|
|
|
bde638 |
+#endif
|
|
|
bde638 |
+
|
|
|
bde638 |
#include <linux/fs.h>
|
|
|
bde638 |
#include <linux/export.h>
|
|
|
bde638 |
#include <linux/seq_file.h>
|
|
|
bde638 |
@@ -26,6 +46,9 @@ static void seq_set_overflow(struct seq_file *m)
|
|
|
bde638 |
|
|
|
bde638 |
static void *seq_buf_alloc(unsigned long size)
|
|
|
bde638 |
{
|
|
|
bde638 |
+ if (unlikely(size > MAX_RW_COUNT))
|
|
|
bde638 |
+ return NULL;
|
|
|
bde638 |
+
|
|
|
bde638 |
return kvmalloc(size, GFP_KERNEL);
|
|
|
bde638 |
}
|
|
|
bde638 |
|
|
|
bde638 |
--
|
|
|
bde638 |
2.26.3
|
|
|
bde638 |
|
|
|
bde638 |
|