5.15-stable patches

added patches:
	lib-string_helpers-silence-snprintf-output-truncation-warning.patch
	nfsd-prevent-a-potential-integer-overflow.patch
	sunrpc-make-sure-cache-entry-active-before-cache_show.patch

diff --git a/queue-5.15/lib-string_helpers-silence-snprintf-output-truncation-warning.patch b/queue-5.15/lib-string_helpers-silence-snprintf-output-truncation-warning.patch
new file mode 100644 (file)
index 0000000..43e72fe
--- /dev/null
+++ b/queue-5.15/lib-string_helpers-silence-snprintf-output-truncation-warning.patch
@@ -0,0 +1,40 @@
+From a508ef4b1dcc82227edc594ffae583874dd425d7 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Date: Fri, 1 Nov 2024 21:54:53 +0100
+Subject: lib: string_helpers: silence snprintf() output truncation warning
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+commit a508ef4b1dcc82227edc594ffae583874dd425d7 upstream.
+
+The output of ".%03u" with the unsigned int in range [0, 4294966295] may
+get truncated if the target buffer is not 12 bytes. This can't really
+happen here as the 'remainder' variable cannot exceed 999 but the
+compiler doesn't know it. To make it happy just increase the buffer to
+where the warning goes away.
+
+Fixes: 3c9f3681d0b4 ("[SCSI] lib: add generic helper to print sizes rounded to the correct SI range")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
+Cc: Kees Cook <kees@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Link: https://lore.kernel.org/r/20241101205453.9353-1-brgl@bgdev.pl
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/string_helpers.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/string_helpers.c
++++ b/lib/string_helpers.c
+@@ -51,7 +51,7 @@ void string_get_size(u64 size, u64 blk_s
+       static const unsigned int rounding[] = { 500, 50, 5 };
+       int i = 0, j;
+       u32 remainder = 0, sf_cap;
+-      char tmp[8];
++      char tmp[12];
+       const char *unit;
+ 
+       tmp[0] = '\0';

diff --git a/queue-5.15/nfsd-prevent-a-potential-integer-overflow.patch b/queue-5.15/nfsd-prevent-a-potential-integer-overflow.patch
new file mode 100644 (file)
index 0000000..d294dd3
--- /dev/null
+++ b/queue-5.15/nfsd-prevent-a-potential-integer-overflow.patch
@@ -0,0 +1,50 @@
+From 7f33b92e5b18e904a481e6e208486da43e4dc841 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Tue, 17 Sep 2024 12:15:23 -0400
+Subject: NFSD: Prevent a potential integer overflow
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 7f33b92e5b18e904a481e6e208486da43e4dc841 upstream.
+
+If the tag length is >= U32_MAX - 3 then the "length + 4" addition
+can result in an integer overflow. Address this by splitting the
+decoding into several steps so that decode_cb_compound4res() does
+not have to perform arithmetic on the unsafe length value.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: stable@vger.kernel.org
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/nfs4callback.c |   14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -297,17 +297,17 @@ static int decode_cb_compound4res(struct
+       u32 length;
+       __be32 *p;
+ 
+-      p = xdr_inline_decode(xdr, 4 + 4);
++      p = xdr_inline_decode(xdr, XDR_UNIT);
+       if (unlikely(p == NULL))
+               goto out_overflow;
+-      hdr->status = be32_to_cpup(p++);
++      hdr->status = be32_to_cpup(p);
+       /* Ignore the tag */
+-      length = be32_to_cpup(p++);
+-      p = xdr_inline_decode(xdr, length + 4);
+-      if (unlikely(p == NULL))
++      if (xdr_stream_decode_u32(xdr, &length) < 0)
++              goto out_overflow;
++      if (xdr_inline_decode(xdr, length) == NULL)
++              goto out_overflow;
++      if (xdr_stream_decode_u32(xdr, &hdr->nops) < 0)
+               goto out_overflow;
+-      p += XDR_QUADLEN(length);
+-      hdr->nops = be32_to_cpup(p);
+       return 0;
+ out_overflow:
+       return -EIO;

diff --git a/queue-5.15/series b/queue-5.15/series
index b8b30fb3501d2282e636970c6d16ff432e4274b0..5692b3fe1ed44a45cd78ef0f2ba7afd3f816d3ef 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -337,3 +337,6 @@ alsa-hda-realtek-fix-internal-speaker-and-mic-boost-of-infinix-y4-max.patch
 alsa-hda-realtek-apply-quirk-for-medion-e15433.patch
 usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch
 usb-dwc3-gadget-fix-looping-of-queued-sg-entries.patch
+lib-string_helpers-silence-snprintf-output-truncation-warning.patch
+nfsd-prevent-a-potential-integer-overflow.patch
+sunrpc-make-sure-cache-entry-active-before-cache_show.patch

diff --git a/queue-5.15/sunrpc-make-sure-cache-entry-active-before-cache_show.patch b/queue-5.15/sunrpc-make-sure-cache-entry-active-before-cache_show.patch
new file mode 100644 (file)
index 0000000..8e252ea
--- /dev/null
+++ b/queue-5.15/sunrpc-make-sure-cache-entry-active-before-cache_show.patch
@@ -0,0 +1,57 @@
+From 2862eee078a4d2d1f584e7f24fa50dddfa5f3471 Mon Sep 17 00:00:00 2001
+From: Yang Erkun <yangerkun@huawei.com>
+Date: Mon, 21 Oct 2024 22:23:42 +0800
+Subject: SUNRPC: make sure cache entry active before cache_show
+
+From: Yang Erkun <yangerkun@huawei.com>
+
+commit 2862eee078a4d2d1f584e7f24fa50dddfa5f3471 upstream.
+
+The function `c_show` was called with protection from RCU. This only
+ensures that `cp` will not be freed. Therefore, the reference count for
+`cp` can drop to zero, which will trigger a refcount use-after-free
+warning when `cache_get` is called. To resolve this issue, use
+`cache_get_rcu` to ensure that `cp` remains active.
+
+------------[ cut here ]------------
+refcount_t: addition on 0; use-after-free.
+WARNING: CPU: 7 PID: 822 at lib/refcount.c:25
+refcount_warn_saturate+0xb1/0x120
+CPU: 7 UID: 0 PID: 822 Comm: cat Not tainted 6.12.0-rc3+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+1.16.1-2.fc37 04/01/2014
+RIP: 0010:refcount_warn_saturate+0xb1/0x120
+
+Call Trace:
+ <TASK>
+ c_show+0x2fc/0x380 [sunrpc]
+ seq_read_iter+0x589/0x770
+ seq_read+0x1e5/0x270
+ proc_reg_read+0xe1/0x140
+ vfs_read+0x125/0x530
+ ksys_read+0xc1/0x160
+ do_syscall_64+0x5f/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Cc: stable@vger.kernel.org # v4.20+
+Signed-off-by: Yang Erkun <yangerkun@huawei.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/cache.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -1415,7 +1415,9 @@ static int c_show(struct seq_file *m, vo
+               seq_printf(m, "# expiry=%lld refcnt=%d flags=%lx\n",
+                          convert_to_wallclock(cp->expiry_time),
+                          kref_read(&cp->ref), cp->flags);
+-      cache_get(cp);
++      if (!cache_get_rcu(cp))
++              return 0;
++
+       if (cache_check(cd, cp, NULL))
+               /* cache_check does a cache_put on failure */
+               seq_puts(m, "# ");