From 14070b15a38365dd12fb428f3630a3bb7c397964 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 12 Jul 2025 15:53:18 +0200 Subject: [PATCH] 6.1-stable patches added patches: ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch x86-boot-compile-boot-code-with-std-gnu11-too.patch --- ...emory-corruption-in-ipmi_create_user.patch | 49 +++++++++++++++++++ ...existence-of-prealloc-backlog-struct.patch | 44 +++++++++++++++++ queue-6.1/series | 3 ++ ...compile-boot-code-with-std-gnu11-too.patch | 34 +++++++++++++ 4 files changed, 130 insertions(+) create mode 100644 queue-6.1/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch create mode 100644 queue-6.1/rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch create mode 100644 queue-6.1/x86-boot-compile-boot-code-with-std-gnu11-too.patch diff --git a/queue-6.1/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch b/queue-6.1/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch new file mode 100644 index 0000000000..942f2fff0d --- /dev/null +++ b/queue-6.1/ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch @@ -0,0 +1,49 @@ +From fa332f5dc6fc662ad7d3200048772c96b861cf6b Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 5 May 2025 17:34:15 +0300 +Subject: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() + +From: Dan Carpenter + +commit fa332f5dc6fc662ad7d3200048772c96b861cf6b upstream. + +The "intf" list iterator is an invalid pointer if the correct +"intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on +and invalid pointer will lead to memory corruption. + +We don't really need to call atomic_dec() if we haven't called +atomic_add_return() so update the if (intf->in_shutdown) path as well. + +Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI") +Signed-off-by: Dan Carpenter +Message-ID: +Signed-off-by: Corey Minyard +[ - Dropped change to the `if (intf->in_shutdown)` block since that logic + doesn't exist yet. + - Modified out_unlock to release the srcu lock instead of the mutex + since we don't have the mutex here yet. ] +Signed-off-by: Brendan Jackman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_msghandler.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -1241,7 +1241,7 @@ int ipmi_create_user(unsigned int + } + /* Not found, return an error */ + rv = -EINVAL; +- goto out_kfree; ++ goto out_unlock; + + found: + if (atomic_add_return(1, &intf->nr_users) > max_users) { +@@ -1283,6 +1283,7 @@ int ipmi_create_user(unsigned int + + out_kfree: + atomic_dec(&intf->nr_users); ++out_unlock: + srcu_read_unlock(&ipmi_interfaces_srcu, index); + vfree(new_user); + return rv; diff --git a/queue-6.1/rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch b/queue-6.1/rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch new file mode 100644 index 0000000000..ba999294de --- /dev/null +++ b/queue-6.1/rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch @@ -0,0 +1,44 @@ +From 880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 8 Jul 2025 22:15:04 +0100 +Subject: rxrpc: Fix oops due to non-existence of prealloc backlog struct + +From: David Howells + +commit 880a88f318cf1d2a0f4c0a7ff7b07e2062b434a4 upstream. + +If an AF_RXRPC service socket is opened and bound, but calls are +preallocated, then rxrpc_alloc_incoming_call() will oops because the +rxrpc_backlog struct doesn't get allocated until the first preallocation is +made. + +Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no +backlog struct. This will cause the incoming call to be aborted. + +Reported-by: Junvyyang, Tencent Zhuque Lab +Suggested-by: Junvyyang, Tencent Zhuque Lab +Signed-off-by: David Howells +cc: LePremierHomme +cc: Marc Dionne +cc: Willy Tarreau +cc: Simon Horman +cc: linux-afs@lists.infradead.org +Link: https://patch.msgid.link/20250708211506.2699012-3-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/call_accept.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/rxrpc/call_accept.c ++++ b/net/rxrpc/call_accept.c +@@ -270,6 +270,9 @@ static struct rxrpc_call *rxrpc_alloc_in + unsigned short call_tail, conn_tail, peer_tail; + unsigned short call_count, conn_count; + ++ if (!b) ++ return NULL; ++ + /* #calls >= #conns >= #peers must hold true. */ + call_head = smp_load_acquire(&b->call_backlog_head); + call_tail = b->call_backlog_tail; diff --git a/queue-6.1/series b/queue-6.1/series index 1924547006..c08e2756b1 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -18,3 +18,6 @@ atm-clip-fix-null-pointer-dereference-in-vcc_sendmsg.patch net-sched-abort-__tc_modify_qdisc-if-parent-class-do.patch x86-cpu-amd-properly-check-the-tsa-microcode.patch maple_tree-fix-ma_state_prealloc-flag-in-mas_preallocate.patch +rxrpc-fix-oops-due-to-non-existence-of-prealloc-backlog-struct.patch +x86-boot-compile-boot-code-with-std-gnu11-too.patch +ipmi-msghandler-fix-potential-memory-corruption-in-ipmi_create_user.patch diff --git a/queue-6.1/x86-boot-compile-boot-code-with-std-gnu11-too.patch b/queue-6.1/x86-boot-compile-boot-code-with-std-gnu11-too.patch new file mode 100644 index 0000000000..40799d060e --- /dev/null +++ b/queue-6.1/x86-boot-compile-boot-code-with-std-gnu11-too.patch @@ -0,0 +1,34 @@ +From b3bee1e7c3f2b1b77182302c7b2131c804175870 Mon Sep 17 00:00:00 2001 +From: Alexey Dobriyan +Date: Wed, 27 Sep 2023 18:42:11 +0300 +Subject: x86/boot: Compile boot code with -std=gnu11 too + +From: Alexey Dobriyan + +commit b3bee1e7c3f2b1b77182302c7b2131c804175870 upstream. + +Use -std=gnu11 for consistency with main kernel code. + +It doesn't seem to change anything in vmlinux. + +Signed-off-by: Alexey Dobriyan +Signed-off-by: Ingo Molnar +Acked-by: H. Peter Anvin (Intel) +Link: https://lore.kernel.org/r/2058761e-12a4-4b2f-9690-3c3c1c9902a5@p183 +Cc: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -43,7 +43,7 @@ endif + + # How to compile the 16-bit code. Note we always compile for -march=i386; + # that way we can complain to the user if the CPU is insufficient. +-REALMODE_CFLAGS := -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ ++REALMODE_CFLAGS := -std=gnu11 -m16 -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \ + -Wall -Wstrict-prototypes -march=i386 -mregparm=3 \ + -fno-strict-aliasing -fomit-frame-pointer -fno-pic \ + -mno-mmx -mno-sse $(call cc-option,-fcf-protection=none) -- 2.47.2