From 17ddede397702f9cb323ac8bbcc673c8dd00c0cf Mon Sep 17 00:00:00 2001

From: Yannick Cote <ycote@redhat.com>

Date: Fri, 27 Jan 2023 10:34:30 -0500

Subject: [KPATCH CVE-2022-4379] kpatch fixes for CVE-2022-4379

Kernels:

5.14.0-162.6.1.el9_1

5.14.0-162.12.1.el9_1

Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-9/-/merge_requests/21

Approved-by: Joe Lawrence (@joe.lawrence)

Changes since last build:

arches: x86_64 ppc64le

l2cap_core.o: changed function: l2cap_rx_state_recv

l2cap_core.o: changed function: l2cap_stream_rx

nfs4proc.o: changed function: nfsd4_copy

nfs4proc.o: changed function: nfsd4_do_async_copy

nft_payload.o: changed function: nft_payload_copy_vlan

sysctl.o: changed function: __do_proc_dointvec

sysctl.o: changed function: __do_proc_douintvec

sysctl.o: changed function: __do_proc_doulongvec_minmax

sysctl.o: changed function: proc_get_long.constprop.0

---------------------------

Modifications:

- fix `kpatch_no_sibling_calls_ppc64le` with -fno-optimize-sibling-calls

commit e7df0c736aef6f0cc49758b8b0bdb27edf5c3e61

Author: Benjamin Coddington <bcodding@redhat.com>

Date:   Wed Dec 21 11:03:36 2022 -0500

    NFSD: fix use-after-free in __nfs42_ssc_open()

    Bugzilla: https://bugzilla.redhat.com/2152815

    CVE: CVE-2022-4379

    Y-Commit: a16ccb9a41ad6a36d58f690b823095798ba7f69c

    O-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2152816

    O-CVE: CVE-2022-4379

    Conflicts: Slight context diff from upstream patch, as we've not yet taken

    upstream commit 754035ff7.  This resulting fix is unchanged.

    commit 75333d48f92256a0dec91dbf07835e804fc411c0

    Author: Dai Ngo <dai.ngo@oracle.com>

    Date:   Mon Dec 12 14:50:11 2022 -0800

        NFSD: fix use-after-free in __nfs42_ssc_open()

        Problem caused by source's vfsmount being unmounted but remains

        on the delayed unmount list. This happens when nfs42_ssc_open()

        return errors.

        Fixed by removing nfsd4_interssc_connect(), leave the vfsmount

        for the laundromat to unmount when idle time expires.

        We don't need to call nfs_do_sb_deactive when nfs42_ssc_open

        return errors since the file was not opened so nfs_server->active

        was not incremented. Same as in nfsd4_copy, if we fail to

        launch nfsd4_do_async_copy thread then there's no need to

        call nfs_do_sb_deactive

        Reported-by: Xingyuan Mo <hdthky0@gmail.com>

        Signed-off-by: Dai Ngo <dai.ngo@oracle.com>

        Tested-by: Xingyuan Mo <hdthky0@gmail.com>

        Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

    Signed-off-by: Benjamin Coddington <bcodding@redhat.com>

    Conflicts: This area of code was refractored by c9s MR !1357 so

               context is quite different.

    Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

Signed-off-by: Yannick Cote <ycote@redhat.com>

---

 fs/nfsd/nfs4proc.c | 23 +++++++----------------

 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c

index bbd02c7f4ffe..87bb43a32aad 100644

--- a/fs/nfsd/nfs4proc.c

+++ b/fs/nfsd/nfs4proc.c

@@ -1525,13 +1525,6 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,

 	return status;

 }

-static void

-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt)

-{

-	nfs_do_sb_deactive(ss_mnt->mnt_sb);

-	mntput(ss_mnt);

-}

-

 /*

  * Verify COPY destination stateid.

  *

@@ -1634,11 +1627,6 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct nfsd_file *src,

 {

 }

-static void

-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt)

-{

-}

-

 static struct file *nfs42_ssc_open(struct vfsmount *ss_mnt,

 				   struct nfs_fh *src_fh,

 				   nfs4_stateid *stateid)

@@ -1794,14 +1782,14 @@ static int nfsd4_do_async_copy(void *data)

 		copy->nf_src = kzalloc(sizeof(struct nfsd_file), GFP_KERNEL);

 		if (!copy->nf_src) {

 			copy->nfserr = nfserr_serverfault;

-			nfsd4_interssc_disconnect(copy->ss_mnt);

+			/* ss_mnt will be unmounted by the laundromat */

 			goto do_callback;

 		}

 		copy->nf_src->nf_file = nfs42_ssc_open(copy->ss_mnt, &copy->c_fh,

 					      &copy->stateid);

 		if (IS_ERR(copy->nf_src->nf_file)) {

 			copy->nfserr = nfserr_offload_denied;

-			nfsd4_interssc_disconnect(copy->ss_mnt);

+			/* ss_mnt will be unmounted by the laundromat */

 			goto do_callback;

 		}

 	}

@@ -1828,6 +1816,7 @@ static int nfsd4_do_async_copy(void *data)

 	return 0;

 }

+__attribute__((optimize("-fno-optimize-sibling-calls")))

 static __be32

 nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,

 		union nfsd4_op_u *u)

@@ -1886,8 +1875,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,

 	if (async_copy)

 		cleanup_async_copy(async_copy);

 	status = nfserrno(-ENOMEM);

-	if (!copy->cp_intra)

-		nfsd4_interssc_disconnect(copy->ss_mnt);

+	/*

+	 * source's vfsmount of inter-copy will be unmounted

+	 * by the laundromat

+	 */

 	goto out;

 }

-- 

2.39.1