From 17ddede397702f9cb323ac8bbcc673c8dd00c0cf Mon Sep 17 00:00:00 2001
From: Yannick Cote <ycote@redhat.com>
Date: Fri, 27 Jan 2023 10:34:30 -0500
Subject: [KPATCH CVE-2022-4379] kpatch fixes for CVE-2022-4379

Kernels:
5.14.0-162.6.1.el9_1
5.14.0-162.12.1.el9_1


Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-9/-/merge_requests/21
Approved-by: Joe Lawrence (@joe.lawrence)
Changes since last build:
arches: x86_64 ppc64le
l2cap_core.o: changed function: l2cap_rx_state_recv
l2cap_core.o: changed function: l2cap_stream_rx
nfs4proc.o: changed function: nfsd4_copy
nfs4proc.o: changed function: nfsd4_do_async_copy
nft_payload.o: changed function: nft_payload_copy_vlan
sysctl.o: changed function: __do_proc_dointvec
sysctl.o: changed function: __do_proc_douintvec
sysctl.o: changed function: __do_proc_doulongvec_minmax
sysctl.o: changed function: proc_get_long.constprop.0
---------------------------

Modifications:
- fix `kpatch_no_sibling_calls_ppc64le` with -fno-optimize-sibling-calls

commit e7df0c736aef6f0cc49758b8b0bdb27edf5c3e61
Author: Benjamin Coddington <bcodding@redhat.com>
Date:   Wed Dec 21 11:03:36 2022 -0500

    NFSD: fix use-after-free in __nfs42_ssc_open()

    Bugzilla: https://bugzilla.redhat.com/2152815
    CVE: CVE-2022-4379
    Y-Commit: a16ccb9a41ad6a36d58f690b823095798ba7f69c

    O-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2152816
    O-CVE: CVE-2022-4379
    Conflicts: Slight context diff from upstream patch, as we've not yet taken
    upstream commit 754035ff7.  This resulting fix is unchanged.

    commit 75333d48f92256a0dec91dbf07835e804fc411c0
    Author: Dai Ngo <dai.ngo@oracle.com>
    Date:   Mon Dec 12 14:50:11 2022 -0800

        NFSD: fix use-after-free in __nfs42_ssc_open()

        Problem caused by source's vfsmount being unmounted but remains
        on the delayed unmount list. This happens when nfs42_ssc_open()
        return errors.

        Fixed by removing nfsd4_interssc_connect(), leave the vfsmount
        for the laundromat to unmount when idle time expires.

        We don't need to call nfs_do_sb_deactive when nfs42_ssc_open
        return errors since the file was not opened so nfs_server->active
        was not incremented. Same as in nfsd4_copy, if we fail to
        launch nfsd4_do_async_copy thread then there's no need to
        call nfs_do_sb_deactive

        Reported-by: Xingyuan Mo <hdthky0@gmail.com>
        Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
        Tested-by: Xingyuan Mo <hdthky0@gmail.com>
        Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

    Signed-off-by: Benjamin Coddington <bcodding@redhat.com>

    Conflicts: This area of code was refractored by c9s MR !1357 so
               context is quite different.

    Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

Signed-off-by: Yannick Cote <ycote@redhat.com>
---
 fs/nfsd/nfs4proc.c | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index bbd02c7f4ffe..87bb43a32aad 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1525,13 +1525,6 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
 	return status;
 }
 
-static void
-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt)
-{
-	nfs_do_sb_deactive(ss_mnt->mnt_sb);
-	mntput(ss_mnt);
-}
-
 /*
  * Verify COPY destination stateid.
  *
@@ -1634,11 +1627,6 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct nfsd_file *src,
 {
 }
 
-static void
-nfsd4_interssc_disconnect(struct vfsmount *ss_mnt)
-{
-}
-
 static struct file *nfs42_ssc_open(struct vfsmount *ss_mnt,
 				   struct nfs_fh *src_fh,
 				   nfs4_stateid *stateid)
@@ -1794,14 +1782,14 @@ static int nfsd4_do_async_copy(void *data)
 		copy->nf_src = kzalloc(sizeof(struct nfsd_file), GFP_KERNEL);
 		if (!copy->nf_src) {
 			copy->nfserr = nfserr_serverfault;
-			nfsd4_interssc_disconnect(copy->ss_mnt);
+			/* ss_mnt will be unmounted by the laundromat */
 			goto do_callback;
 		}
 		copy->nf_src->nf_file = nfs42_ssc_open(copy->ss_mnt, &copy->c_fh,
 					      &copy->stateid);
 		if (IS_ERR(copy->nf_src->nf_file)) {
 			copy->nfserr = nfserr_offload_denied;
-			nfsd4_interssc_disconnect(copy->ss_mnt);
+			/* ss_mnt will be unmounted by the laundromat */
 			goto do_callback;
 		}
 	}
@@ -1828,6 +1816,7 @@ static int nfsd4_do_async_copy(void *data)
 	return 0;
 }
 
+__attribute__((optimize("-fno-optimize-sibling-calls")))
 static __be32
 nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 		union nfsd4_op_u *u)
@@ -1886,8 +1875,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 	if (async_copy)
 		cleanup_async_copy(async_copy);
 	status = nfserrno(-ENOMEM);
-	if (!copy->cp_intra)
-		nfsd4_interssc_disconnect(copy->ss_mnt);
+	/*
+	 * source's vfsmount of inter-copy will be unmounted
+	 * by the laundromat
+	 */
 	goto out;
 }
 
-- 
2.39.1