From: Greg Kroah-Hartman Date: Tue, 11 Apr 2023 11:31:33 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.15.107~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=98d4f13c86ac2850d8f8076e3e98c25f0c42bf02;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: can-j1939-j1939_tp_tx_dat_new-fix-out-of-bounds-memory-access.patch ftrace-mark-get_lock_parent_ip-__always_inline.patch tracing-free-error-logs-of-tracing-instances.patch --- diff --git a/queue-5.4/can-j1939-j1939_tp_tx_dat_new-fix-out-of-bounds-memory-access.patch b/queue-5.4/can-j1939-j1939_tp_tx_dat_new-fix-out-of-bounds-memory-access.patch new file mode 100644 index 00000000000..fffac43305d --- /dev/null +++ b/queue-5.4/can-j1939-j1939_tp_tx_dat_new-fix-out-of-bounds-memory-access.patch @@ -0,0 +1,53 @@ +From b45193cb4df556fe6251b285a5ce44046dd36b4a Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Tue, 4 Apr 2023 09:31:28 +0200 +Subject: can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access + +From: Oleksij Rempel + +commit b45193cb4df556fe6251b285a5ce44046dd36b4a upstream. + +In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access +could occur during the memcpy() operation if the size of skb->cb is +larger than the size of struct j1939_sk_buff_cb. This is because the +memcpy() operation uses the size of skb->cb, leading to a read beyond +the struct j1939_sk_buff_cb. + +Updated the memcpy() operation to use the size of struct +j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the +memcpy() operation only reads the memory within the bounds of struct +j1939_sk_buff_cb, preventing out-of-bounds memory access. + +Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb +is greater than or equal to the size of struct j1939_sk_buff_cb. This +ensures that the skb->cb buffer is large enough to hold the +j1939_sk_buff_cb structure. + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Reported-by: Shuangpeng Bai +Tested-by: Shuangpeng Bai +Signed-off-by: Oleksij Rempel +Link: https://groups.google.com/g/syzkaller/c/G_LL-C3plRs/m/-8xCi6dCAgAJ +Link: https://lore.kernel.org/all/20230404073128.3173900-1-o.rempel@pengutronix.de +Cc: stable@vger.kernel.org +[mkl: rephrase commit message] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -600,7 +600,10 @@ sk_buff *j1939_tp_tx_dat_new(struct j193 + /* reserve CAN header */ + skb_reserve(skb, offsetof(struct can_frame, data)); + +- memcpy(skb->cb, re_skcb, sizeof(skb->cb)); ++ /* skb->cb must be large enough to hold a j1939_sk_buff_cb structure */ ++ BUILD_BUG_ON(sizeof(skb->cb) < sizeof(*re_skcb)); ++ ++ memcpy(skb->cb, re_skcb, sizeof(*re_skcb)); + skcb = j1939_skb_to_cb(skb); + if (swap_src_dst) + j1939_skbcb_swap(skcb); diff --git a/queue-5.4/ftrace-mark-get_lock_parent_ip-__always_inline.patch b/queue-5.4/ftrace-mark-get_lock_parent_ip-__always_inline.patch new file mode 100644 index 00000000000..23313743691 --- /dev/null +++ b/queue-5.4/ftrace-mark-get_lock_parent_ip-__always_inline.patch @@ -0,0 +1,37 @@ +From ea65b41807a26495ff2a73dd8b1bab2751940887 Mon Sep 17 00:00:00 2001 +From: John Keeping +Date: Mon, 27 Mar 2023 18:36:46 +0100 +Subject: ftrace: Mark get_lock_parent_ip() __always_inline + +From: John Keeping + +commit ea65b41807a26495ff2a73dd8b1bab2751940887 upstream. + +If the compiler decides not to inline this function then preemption +tracing will always show an IP inside the preemption disabling path and +never the function actually calling preempt_{enable,disable}. + +Link: https://lore.kernel.org/linux-trace-kernel/20230327173647.1690849-1-john@metanate.com + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: stable@vger.kernel.org +Fixes: f904f58263e1d ("sched/debug: Fix preempt_disable_ip recording for preempt_disable()") +Signed-off-by: John Keeping +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/ftrace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/ftrace.h ++++ b/include/linux/ftrace.h +@@ -712,7 +712,7 @@ static inline void __ftrace_enabled_rest + #define CALLER_ADDR5 ((unsigned long)ftrace_return_address(5)) + #define CALLER_ADDR6 ((unsigned long)ftrace_return_address(6)) + +-static inline unsigned long get_lock_parent_ip(void) ++static __always_inline unsigned long get_lock_parent_ip(void) + { + unsigned long addr = CALLER_ADDR0; + diff --git a/queue-5.4/series b/queue-5.4/series index b38614d26a6..7d0af3a58b7 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -28,3 +28,6 @@ nilfs2-fix-potential-uaf-of-struct-nilfs_sc_info-in-nilfs_segctor_thread.patch nilfs2-fix-sysfs-interface-lifetime.patch alsa-hda-realtek-add-quirk-for-clevo-x370snw.patch perf-core-fix-the-same-task-check-in-perf_event_set_.patch +ftrace-mark-get_lock_parent_ip-__always_inline.patch +can-j1939-j1939_tp_tx_dat_new-fix-out-of-bounds-memory-access.patch +tracing-free-error-logs-of-tracing-instances.patch diff --git a/queue-5.4/tracing-free-error-logs-of-tracing-instances.patch b/queue-5.4/tracing-free-error-logs-of-tracing-instances.patch new file mode 100644 index 00000000000..da75013636e --- /dev/null +++ b/queue-5.4/tracing-free-error-logs-of-tracing-instances.patch @@ -0,0 +1,93 @@ +From 3357c6e429643231e60447b52ffbb7ac895aca22 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Tue, 4 Apr 2023 19:45:04 -0400 +Subject: tracing: Free error logs of tracing instances + +From: Steven Rostedt (Google) + +commit 3357c6e429643231e60447b52ffbb7ac895aca22 upstream. + +When a tracing instance is removed, the error messages that hold errors +that occurred in the instance needs to be freed. The following reports a +memory leak: + + # cd /sys/kernel/tracing + # mkdir instances/foo + # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger + # cat instances/foo/error_log + [ 117.404795] hist:sched:sched_switch: error: Couldn't find field + Command: hist:keys=x + ^ + # rmdir instances/foo + +Then check for memory leaks: + + # echo scan > /sys/kernel/debug/kmemleak + # cat /sys/kernel/debug/kmemleak +unreferenced object 0xffff88810d8ec700 (size 192): + comm "bash", pid 869, jiffies 4294950577 (age 215.752s) + hex dump (first 32 bytes): + 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... + a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... + backtrace: + [<00000000dae26536>] kmalloc_trace+0x2a/0xa0 + [<00000000b2938940>] tracing_log_err+0x277/0x2e0 + [<000000004a0e1b07>] parse_atom+0x966/0xb40 + [<0000000023b24337>] parse_expr+0x5f3/0xdb0 + [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 + [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 + [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 + [<000000002cadc509>] vfs_write+0x162/0x670 + [<0000000059c3b9be>] ksys_write+0xca/0x170 + [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 + [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc +unreferenced object 0xffff888170c35a00 (size 32): + comm "bash", pid 869, jiffies 4294950577 (age 215.752s) + hex dump (first 32 bytes): + 0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist + 3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x......... + backtrace: + [<000000006a747de5>] __kmalloc+0x4d/0x160 + [<000000000039df5f>] tracing_log_err+0x29b/0x2e0 + [<000000004a0e1b07>] parse_atom+0x966/0xb40 + [<0000000023b24337>] parse_expr+0x5f3/0xdb0 + [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 + [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 + [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 + [<000000002cadc509>] vfs_write+0x162/0x670 + [<0000000059c3b9be>] ksys_write+0xca/0x170 + [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 + [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +The problem is that the error log needs to be freed when the instance is +removed. + +Link: https://lore.kernel.org/lkml/76134d9f-a5ba-6a0d-37b3-28310b4a1e91@alu.unizg.hr/ +Link: https://lore.kernel.org/linux-trace-kernel/20230404194504.5790b95f@gandalf.local.home + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Andrew Morton +Cc: Mark Rutland +Cc: Thorsten Leemhuis +Cc: Ulf Hansson +Cc: Eric Biggers +Fixes: 2f754e771b1a6 ("tracing: Have the error logs show up in the proper instances") +Reported-by: Mirsad Goran Todorovac +Tested-by: Mirsad Todorovac +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -8542,6 +8542,7 @@ static int __remove_instance(struct trac + ftrace_destroy_function_files(tr); + tracefs_remove_recursive(tr->dir); + free_trace_buffers(tr); ++ clear_tracing_err_log(tr); + + for (i = 0; i < tr->nr_topts; i++) { + kfree(tr->topts[i].topts);