From: Greg Kroah-Hartman Date: Mon, 1 Jul 2024 14:39:11 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.19.317~69 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d8b777fb9f0d5cbef356c6fdaa18e0c3066a156a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: ftruncate-pass-a-signed-offset.patch syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch --- diff --git a/queue-5.15/ftruncate-pass-a-signed-offset.patch b/queue-5.15/ftruncate-pass-a-signed-offset.patch new file mode 100644 index 00000000000..54328532069 --- /dev/null +++ b/queue-5.15/ftruncate-pass-a-signed-offset.patch @@ -0,0 +1,72 @@ +From 4b8e88e563b5f666446d002ad0dc1e6e8e7102b0 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 19 Jun 2024 11:34:09 +0200 +Subject: ftruncate: pass a signed offset + +From: Arnd Bergmann + +commit 4b8e88e563b5f666446d002ad0dc1e6e8e7102b0 upstream. + +The old ftruncate() syscall, using the 32-bit off_t misses a sign +extension when called in compat mode on 64-bit architectures. As a +result, passing a negative length accidentally succeeds in truncating +to file size between 2GiB and 4GiB. + +Changing the type of the compat syscall to the signed compat_off_t +changes the behavior so it instead returns -EINVAL. + +The native entry point, the truncate() syscall and the corresponding +loff_t based variants are all correct already and do not suffer +from this mistake. + +Fixes: 3f6d078d4acc ("fix compat truncate/ftruncate") +Reviewed-by: Christian Brauner +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + fs/open.c | 4 ++-- + include/linux/compat.h | 2 +- + include/linux/syscalls.h | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +--- a/fs/open.c ++++ b/fs/open.c +@@ -199,13 +199,13 @@ out: + return error; + } + +-SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length) ++SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } + + #ifdef CONFIG_COMPAT +-COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length) ++COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -590,7 +590,7 @@ asmlinkage long compat_sys_fstatfs(unsig + asmlinkage long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz, + struct compat_statfs64 __user *buf); + asmlinkage long compat_sys_truncate(const char __user *, compat_off_t); +-asmlinkage long compat_sys_ftruncate(unsigned int, compat_ulong_t); ++asmlinkage long compat_sys_ftruncate(unsigned int, compat_off_t); + /* No generic prototype for truncate64, ftruncate64, fallocate */ + asmlinkage long compat_sys_openat(int dfd, const char __user *filename, + int flags, umode_t mode); +--- a/include/linux/syscalls.h ++++ b/include/linux/syscalls.h +@@ -453,7 +453,7 @@ asmlinkage long sys_fstatfs(unsigned int + asmlinkage long sys_fstatfs64(unsigned int fd, size_t sz, + struct statfs64 __user *buf); + asmlinkage long sys_truncate(const char __user *path, long length); +-asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length); ++asmlinkage long sys_ftruncate(unsigned int fd, off_t length); + #if BITS_PER_LONG == 32 + asmlinkage long sys_truncate64(const char __user *path, loff_t length); + asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length); diff --git a/queue-5.15/series b/queue-5.15/series index b7a5384b627..c5fd9619eb7 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -370,3 +370,5 @@ drm-nouveau-dispnv04-fix-null-pointer-dereference-in-nv17_tv_get_hd_modes.patch batman-adv-don-t-accept-tt-entries-for-out-of-spec-vids.patch ata-ahci-clean-up-sysfs-file-on-error.patch ata-libata-core-fix-double-free-on-error.patch +ftruncate-pass-a-signed-offset.patch +syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch diff --git a/queue-5.15/syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch b/queue-5.15/syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch new file mode 100644 index 00000000000..ddf7920eca4 --- /dev/null +++ b/queue-5.15/syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch @@ -0,0 +1,142 @@ +From d3882564a77c21eb746ba5364f3fa89b88de3d61 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 20 Jun 2024 14:16:37 +0200 +Subject: syscalls: fix compat_sys_io_pgetevents_time64 usage + +From: Arnd Bergmann + +commit d3882564a77c21eb746ba5364f3fa89b88de3d61 upstream. + +Using sys_io_pgetevents() as the entry point for compat mode tasks +works almost correctly, but misses the sign extension for the min_nr +and nr arguments. + +This was addressed on parisc by switching to +compat_sys_io_pgetevents_time64() in commit 6431e92fc827 ("parisc: +io_pgetevents_time64() needs compat syscall in 32-bit compat mode"), +as well as by using more sophisticated system call wrappers on x86 and +s390. However, arm64, mips, powerpc, sparc and riscv still have the +same bug. + +Change all of them over to use compat_sys_io_pgetevents_time64() +like parisc already does. This was clearly the intention when the +function was originally added, but it got hooked up incorrectly in +the tables. + +Cc: stable@vger.kernel.org +Fixes: 48166e6ea47d ("y2038: add 64-bit time_t syscalls to all 32-bit architectures") +Acked-by: Heiko Carstens # s390 +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/unistd32.h | 2 +- + arch/mips/kernel/syscalls/syscall_n32.tbl | 2 +- + arch/mips/kernel/syscalls/syscall_o32.tbl | 2 +- + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- + arch/s390/kernel/syscalls/syscall.tbl | 2 +- + arch/sparc/kernel/syscalls/syscall.tbl | 2 +- + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- + include/uapi/asm-generic/unistd.h | 2 +- + kernel/sys_ni.c | 2 +- + 9 files changed, 9 insertions(+), 9 deletions(-) + +--- a/arch/arm64/include/asm/unistd32.h ++++ b/arch/arm64/include/asm/unistd32.h +@@ -840,7 +840,7 @@ __SYSCALL(__NR_pselect6_time64, compat_s + #define __NR_ppoll_time64 414 + __SYSCALL(__NR_ppoll_time64, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SYSCALL(__NR_io_pgetevents_time64, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SYSCALL(__NR_recvmmsg_time64, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +--- a/arch/mips/kernel/syscalls/syscall_n32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_n32.tbl +@@ -354,7 +354,7 @@ + 412 n32 utimensat_time64 sys_utimensat + 413 n32 pselect6_time64 compat_sys_pselect6_time64 + 414 n32 ppoll_time64 compat_sys_ppoll_time64 +-416 n32 io_pgetevents_time64 sys_io_pgetevents ++416 n32 io_pgetevents_time64 compat_sys_io_pgetevents_time64 + 417 n32 recvmmsg_time64 compat_sys_recvmmsg_time64 + 418 n32 mq_timedsend_time64 sys_mq_timedsend + 419 n32 mq_timedreceive_time64 sys_mq_timedreceive +--- a/arch/mips/kernel/syscalls/syscall_o32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_o32.tbl +@@ -403,7 +403,7 @@ + 412 o32 utimensat_time64 sys_utimensat sys_utimensat + 413 o32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 o32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 o32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 o32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 o32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 o32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 o32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +--- a/arch/powerpc/kernel/syscalls/syscall.tbl ++++ b/arch/powerpc/kernel/syscalls/syscall.tbl +@@ -495,7 +495,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +--- a/arch/s390/kernel/syscalls/syscall.tbl ++++ b/arch/s390/kernel/syscalls/syscall.tbl +@@ -418,7 +418,7 @@ + 412 32 utimensat_time64 - sys_utimensat + 413 32 pselect6_time64 - compat_sys_pselect6_time64 + 414 32 ppoll_time64 - compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 - sys_io_pgetevents ++416 32 io_pgetevents_time64 - compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 - compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 - sys_mq_timedsend + 419 32 mq_timedreceive_time64 - sys_mq_timedreceive +--- a/arch/sparc/kernel/syscalls/syscall.tbl ++++ b/arch/sparc/kernel/syscalls/syscall.tbl +@@ -461,7 +461,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +--- a/arch/x86/entry/syscalls/syscall_32.tbl ++++ b/arch/x86/entry/syscalls/syscall_32.tbl +@@ -420,7 +420,7 @@ + 412 i386 utimensat_time64 sys_utimensat + 413 i386 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 i386 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 i386 io_pgetevents_time64 sys_io_pgetevents ++416 i386 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 i386 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 i386 mq_timedsend_time64 sys_mq_timedsend + 419 i386 mq_timedreceive_time64 sys_mq_timedreceive +--- a/include/uapi/asm-generic/unistd.h ++++ b/include/uapi/asm-generic/unistd.h +@@ -805,7 +805,7 @@ __SC_COMP(__NR_pselect6_time64, sys_psel + #define __NR_ppoll_time64 414 + __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +--- a/kernel/sys_ni.c ++++ b/kernel/sys_ni.c +@@ -46,8 +46,8 @@ COND_SYSCALL(io_getevents_time32); + COND_SYSCALL(io_getevents); + COND_SYSCALL(io_pgetevents_time32); + COND_SYSCALL(io_pgetevents); +-COND_SYSCALL_COMPAT(io_pgetevents_time32); + COND_SYSCALL_COMPAT(io_pgetevents); ++COND_SYSCALL_COMPAT(io_pgetevents_time64); + COND_SYSCALL(io_uring_setup); + COND_SYSCALL(io_uring_enter); + COND_SYSCALL(io_uring_register);