|
 |
33702d |
From 794229b5711a96a488d85dd719511a278b4a4956 Mon Sep 17 00:00:00 2001
|
|
|
33702d |
From: Ryan Sullivan <rysulliv@redhat.com>
|
|
|
33702d |
Date: Fri, 27 Jan 2023 11:25:43 -0500
|
|
|
33702d |
Subject: [KPATCH CVE-2022-4378] kpatch fixes for CVE-2022-4378
|
|
|
33702d |
|
|
|
33702d |
|
|
|
33702d |
Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/51
|
|
|
33702d |
Approved-by: Yannick Cote (@ycote1)
|
|
|
33702d |
Approved-by: Joe Lawrence (@joe.lawrence)
|
|
|
33702d |
Kernels:
|
|
|
33702d |
3.10.0-1160.76.1.el7
|
|
|
33702d |
3.10.0-1160.80.1.el7
|
|
|
33702d |
3.10.0-1160.81.1.el7
|
|
|
33702d |
3.10.0-1160.83.1.el7
|
|
|
33702d |
|
|
|
33702d |
Changes since last build:
|
|
|
33702d |
[x86_64]:
|
|
|
33702d |
sysctl.o: changed function: __do_proc_dointvec
|
|
|
33702d |
sysctl.o: changed function: __do_proc_douintvec
|
|
|
33702d |
sysctl.o: changed function: __do_proc_doulongvec_minmax
|
|
|
33702d |
sysctl.o: changed function: proc_dostring
|
|
|
33702d |
sysctl.o: changed function: proc_get_long.constprop.13
|
|
|
33702d |
|
|
|
33702d |
[ppc64le]:
|
|
|
33702d |
sysctl.o: changed function: __do_proc_doulongvec_minmax
|
|
|
33702d |
sysctl.o: changed function: proc_do_cad_pid
|
|
|
33702d |
sysctl.o: changed function: proc_dointvec
|
|
|
33702d |
sysctl.o: changed function: proc_dointvec_jiffies
|
|
|
33702d |
sysctl.o: changed function: proc_dointvec_minmax
|
|
|
33702d |
sysctl.o: changed function: proc_dointvec_minmax_coredump
|
|
|
33702d |
sysctl.o: changed function: proc_dointvec_minmax_sysadmin
|
|
|
33702d |
sysctl.o: changed function: proc_dointvec_ms_jiffies
|
|
|
33702d |
sysctl.o: changed function: proc_dointvec_userhz_jiffies
|
|
|
33702d |
sysctl.o: changed function: proc_dopipe_max_size
|
|
|
33702d |
sysctl.o: changed function: proc_dostring
|
|
|
33702d |
sysctl.o: changed function: proc_dostring_coredump
|
|
|
33702d |
sysctl.o: changed function: proc_douintvec
|
|
|
33702d |
sysctl.o: changed function: proc_douintvec_minmax
|
|
|
33702d |
sysctl.o: changed function: proc_doulongvec_minmax
|
|
|
33702d |
sysctl.o: changed function: proc_doulongvec_ms_jiffies_minmax
|
|
|
33702d |
sysctl.o: changed function: proc_get_long.constprop.13
|
|
|
33702d |
sysctl.o: changed function: sysrq_sysctl_handler
|
|
|
33702d |
sysctl.o: new function: __do_proc_dointvec
|
|
|
33702d |
|
|
|
33702d |
---------------------------
|
|
|
33702d |
|
|
|
33702d |
Modifications:
|
|
|
33702d |
added '__attribute__((optimize("-fno-optimize-sibling-calls")))' to
|
|
|
33702d |
proc_dointvec_jiffies(), proc_dointvec_ms_jiffies(), proc_doulongvec_ms_jiffies_minmax(),
|
|
|
33702d |
proc_doulongvec_minmax(), proc_dointvec_userhz_jiffies(), and proc_dointvec() definitions.
|
|
|
33702d |
|
|
|
33702d |
commit f4f6d6bf0cd6fc3d1b88341f784b2f7e8589ff61
|
|
|
33702d |
Author: Wander Lairson Costa <wander@redhat.com>
|
|
|
33702d |
Date: Tue Dec 13 08:13:31 2022 -0300
|
|
|
33702d |
|
|
|
33702d |
proc: avoid integer type confusion in get_proc_long
|
|
|
33702d |
|
|
|
33702d |
Bugzilla: https://bugzilla.redhat.com/2152565
|
|
|
33702d |
CVE: CVE-2022-4378
|
|
|
33702d |
|
|
|
33702d |
commit e6cfaf34be9fcd1a8285a294e18986bfc41a409c
|
|
|
33702d |
Author: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
33702d |
Date: Mon Dec 5 11:33:40 2022 -0800
|
|
|
33702d |
|
|
|
33702d |
proc: avoid integer type confusion in get_proc_long
|
|
|
33702d |
|
|
|
33702d |
proc_get_long() is passed a size_t, but then assigns it to an 'int'
|
|
|
33702d |
variable for the length. Let's not do that, even if our IO paths are
|
|
|
33702d |
limited to MAX_RW_COUNT (exactly because of these kinds of type errors).
|
|
|
33702d |
|
|
|
33702d |
So do the proper test in the rigth type.
|
|
|
33702d |
|
|
|
33702d |
Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
|
|
|
33702d |
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
33702d |
|
|
|
33702d |
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
|
|
|
33702d |
|
|
|
33702d |
commit c727ac3f665ed51c096edeedf039552cea6053f6
|
|
|
33702d |
Author: Wander Lairson Costa <wander@redhat.com>
|
|
|
33702d |
Date: Tue Dec 13 08:12:23 2022 -0300
|
|
|
33702d |
|
|
|
33702d |
proc: proc_skip_spaces() shouldn't think it is working on C strings
|
|
|
33702d |
|
|
|
33702d |
Bugzilla: https://bugzilla.redhat.com/2152565
|
|
|
33702d |
CVE: CVE-2022-4378
|
|
|
33702d |
|
|
|
33702d |
Conflicts: some context hunks because we are way behind upstream.
|
|
|
33702d |
|
|
|
33702d |
commit bce9332220bd677d83b19d21502776ad555a0e73
|
|
|
33702d |
Author: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
33702d |
Date: Mon Dec 5 12:09:06 2022 -0800
|
|
|
33702d |
|
|
|
33702d |
proc: proc_skip_spaces() shouldn't think it is working on C strings
|
|
|
33702d |
|
|
|
33702d |
proc_skip_spaces() seems to think it is working on C strings, and ends
|
|
|
33702d |
up being just a wrapper around skip_spaces() with a really odd calling
|
|
|
33702d |
convention.
|
|
|
33702d |
|
|
|
33702d |
Instead of basing it on skip_spaces(), it should have looked more like
|
|
|
33702d |
proc_skip_char(), which really is the exact same function (except it
|
|
|
33702d |
skips a particular character, rather than whitespace). So use that as
|
|
|
33702d |
inspiration, odd coding and all.
|
|
|
33702d |
|
|
|
33702d |
Now the calling convention actually makes sense and works for the
|
|
|
33702d |
intended purpose.
|
|
|
33702d |
|
|
|
33702d |
Reported-and-tested-by: Kyle Zeng <zengyhkyle@gmail.com>
|
|
|
33702d |
Acked-by: Eric Dumazet <edumazet@google.com>
|
|
|
33702d |
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
33702d |
|
|
|
33702d |
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
|
|
|
33702d |
|
|
|
33702d |
Signed-off-by: Ryan Sullivan <rysulliv@redhat.com>
|
|
|
33702d |
---
|
|
|
33702d |
kernel/sysctl.c | 36 +++++++++++++++++++++---------------
|
|
|
33702d |
1 file changed, 21 insertions(+), 15 deletions(-)
|
|
|
33702d |
|
|
|
33702d |
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
|
|
|
33702d |
index 62e2788cf09a..6f7d80afda89 100644
|
|
|
33702d |
--- a/kernel/sysctl.c
|
|
|
33702d |
+++ b/kernel/sysctl.c
|
|
|
33702d |
@@ -1999,13 +1999,14 @@ int proc_dostring(struct ctl_table *table, int write,
|
|
|
33702d |
(char __user *)buffer, lenp, ppos);
|
|
|
33702d |
}
|
|
|
33702d |
|
|
|
33702d |
-static size_t proc_skip_spaces(char **buf)
|
|
|
33702d |
+static void proc_skip_spaces(char **buf, size_t *size)
|
|
|
33702d |
{
|
|
|
33702d |
- size_t ret;
|
|
|
33702d |
- char *tmp = skip_spaces(*buf);
|
|
|
33702d |
- ret = tmp - *buf;
|
|
|
33702d |
- *buf = tmp;
|
|
|
33702d |
- return ret;
|
|
|
33702d |
+ while (*size) {
|
|
|
33702d |
+ if (!isspace(**buf))
|
|
|
33702d |
+ break;
|
|
|
33702d |
+ (*size)--;
|
|
|
33702d |
+ (*buf)++;
|
|
|
33702d |
+ }
|
|
|
33702d |
}
|
|
|
33702d |
|
|
|
33702d |
static void proc_skip_char(char **buf, size_t *size, const char v)
|
|
|
33702d |
@@ -2074,13 +2075,12 @@ static int proc_get_long(char **buf, size_t *size,
|
|
|
33702d |
unsigned long *val, bool *neg,
|
|
|
33702d |
const char *perm_tr, unsigned perm_tr_len, char *tr)
|
|
|
33702d |
{
|
|
|
33702d |
- int len;
|
|
|
33702d |
char *p, tmp[TMPBUFLEN];
|
|
|
33702d |
+ ssize_t len = *size;
|
|
|
33702d |
|
|
|
33702d |
- if (!*size)
|
|
|
33702d |
+ if (len <= 0)
|
|
|
33702d |
return -EINVAL;
|
|
|
33702d |
|
|
|
33702d |
- len = *size;
|
|
|
33702d |
if (len > TMPBUFLEN - 1)
|
|
|
33702d |
len = TMPBUFLEN - 1;
|
|
|
33702d |
|
|
|
33702d |
@@ -2250,7 +2250,7 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
|
|
|
33702d |
bool neg;
|
|
|
33702d |
|
|
|
33702d |
if (write) {
|
|
|
33702d |
- left -= proc_skip_spaces(&kbuf);
|
|
|
33702d |
+ proc_skip_spaces(&kbuf, &left);
|
|
|
33702d |
|
|
|
33702d |
if (!left)
|
|
|
33702d |
break;
|
|
|
33702d |
@@ -2281,7 +2281,7 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
|
|
|
33702d |
if (!write && !first && left && !err)
|
|
|
33702d |
err = proc_put_char(&buffer, &left, '\n');
|
|
|
33702d |
if (write && !err && left)
|
|
|
33702d |
- left -= proc_skip_spaces(&kbuf);
|
|
|
33702d |
+ proc_skip_spaces(&kbuf, &left);
|
|
|
33702d |
free:
|
|
|
33702d |
if (write) {
|
|
|
33702d |
free_page(page);
|
|
|
33702d |
@@ -2331,7 +2331,7 @@ static int do_proc_douintvec_w(unsigned int *tbl_data,
|
|
|
33702d |
if (IS_ERR(kbuf))
|
|
|
33702d |
return -EINVAL;
|
|
|
33702d |
|
|
|
33702d |
- left -= proc_skip_spaces(&p);
|
|
|
33702d |
+ proc_skip_spaces(&p, &left);
|
|
|
33702d |
if (!left) {
|
|
|
33702d |
err = -EINVAL;
|
|
|
33702d |
goto out_free;
|
|
|
33702d |
@@ -2351,7 +2351,7 @@ static int do_proc_douintvec_w(unsigned int *tbl_data,
|
|
|
33702d |
}
|
|
|
33702d |
|
|
|
33702d |
if (!err && left)
|
|
|
33702d |
- left -= proc_skip_spaces(&p);
|
|
|
33702d |
+ proc_skip_spaces(&p, &left);
|
|
|
33702d |
|
|
|
33702d |
out_free:
|
|
|
33702d |
kfree(kbuf);
|
|
|
33702d |
@@ -2457,6 +2457,7 @@ static int do_proc_douintvec(struct ctl_table *table, int write,
|
|
|
33702d |
*
|
|
|
33702d |
* Returns 0 on success.
|
|
|
33702d |
*/
|
|
|
33702d |
+__attribute__((optimize("-fno-optimize-sibling-calls")))
|
|
|
33702d |
int proc_dointvec(struct ctl_table *table, int write,
|
|
|
33702d |
void __user *buffer, size_t *lenp, loff_t *ppos)
|
|
|
33702d |
{
|
|
|
33702d |
@@ -2775,7 +2776,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
|
|
|
33702d |
if (write) {
|
|
|
33702d |
bool neg;
|
|
|
33702d |
|
|
|
33702d |
- left -= proc_skip_spaces(&kbuf);
|
|
|
33702d |
+ proc_skip_spaces(&kbuf, &left);
|
|
|
33702d |
|
|
|
33702d |
err = proc_get_long(&kbuf, &left, &val, &neg,
|
|
|
33702d |
proc_wspace_sep,
|
|
|
33702d |
@@ -2800,7 +2801,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
|
|
|
33702d |
if (!write && !first && left && !err)
|
|
|
33702d |
err = proc_put_char(&buffer, &left, '\n');
|
|
|
33702d |
if (write && !err)
|
|
|
33702d |
- left -= proc_skip_spaces(&kbuf);
|
|
|
33702d |
+ proc_skip_spaces(&kbuf, &left);
|
|
|
33702d |
free:
|
|
|
33702d |
if (write) {
|
|
|
33702d |
free_page(page);
|
|
|
33702d |
@@ -2839,6 +2840,7 @@ static int do_proc_doulongvec_minmax(struct ctl_table *table, int write,
|
|
|
33702d |
*
|
|
|
33702d |
* Returns 0 on success.
|
|
|
33702d |
*/
|
|
|
33702d |
+__attribute__((optimize("-fno-optimize-sibling-calls")))
|
|
|
33702d |
int proc_doulongvec_minmax(struct ctl_table *table, int write,
|
|
|
33702d |
void __user *buffer, size_t *lenp, loff_t *ppos)
|
|
|
33702d |
{
|
|
|
33702d |
@@ -2862,6 +2864,7 @@ int proc_doulongvec_minmax(struct ctl_table *table, int write,
|
|
|
33702d |
*
|
|
|
33702d |
* Returns 0 on success.
|
|
|
33702d |
*/
|
|
|
33702d |
+__attribute__((optimize("-fno-optimize-sibling-calls")))
|
|
|
33702d |
int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
|
|
|
33702d |
void __user *buffer,
|
|
|
33702d |
size_t *lenp, loff_t *ppos)
|
|
|
33702d |
@@ -2957,6 +2960,7 @@ static int do_proc_dointvec_ms_jiffies_conv(bool *negp, unsigned long *lvalp,
|
|
|
33702d |
*
|
|
|
33702d |
* Returns 0 on success.
|
|
|
33702d |
*/
|
|
|
33702d |
+__attribute__((optimize("-fno-optimize-sibling-calls")))
|
|
|
33702d |
int proc_dointvec_jiffies(struct ctl_table *table, int write,
|
|
|
33702d |
void __user *buffer, size_t *lenp, loff_t *ppos)
|
|
|
33702d |
{
|
|
|
33702d |
@@ -2979,6 +2983,7 @@ int proc_dointvec_jiffies(struct ctl_table *table, int write,
|
|
|
33702d |
*
|
|
|
33702d |
* Returns 0 on success.
|
|
|
33702d |
*/
|
|
|
33702d |
+__attribute__((optimize("-fno-optimize-sibling-calls")))
|
|
|
33702d |
int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write,
|
|
|
33702d |
void __user *buffer, size_t *lenp, loff_t *ppos)
|
|
|
33702d |
{
|
|
|
33702d |
@@ -3002,6 +3007,7 @@ int proc_dointvec_userhz_jiffies(struct ctl_table *table, int write,
|
|
|
33702d |
*
|
|
|
33702d |
* Returns 0 on success.
|
|
|
33702d |
*/
|
|
|
33702d |
+__attribute__((optimize("-fno-optimize-sibling-calls")))
|
|
|
33702d |
int proc_dointvec_ms_jiffies(struct ctl_table *table, int write,
|
|
|
33702d |
void __user *buffer, size_t *lenp, loff_t *ppos)
|
|
|
33702d |
{
|
|
|
33702d |
--
|
|
|
33702d |
2.39.1
|
|
|
33702d |
|
|
|
33702d |
|