From 46ab226bdd3b12fa99238f80c3f3d6d10acdfd21 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 1 Jul 2024 16:40:09 +0200 Subject: [PATCH] 6.9-stable patches added patches: ftruncate-pass-a-signed-offset.patch syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch --- .../ftruncate-pass-a-signed-offset.patch | 72 +++++++++ queue-6.9/series | 2 + ...ompat_sys_io_pgetevents_time64-usage.patch | 142 ++++++++++++++++++ 3 files changed, 216 insertions(+) create mode 100644 queue-6.9/ftruncate-pass-a-signed-offset.patch create mode 100644 queue-6.9/syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch diff --git a/queue-6.9/ftruncate-pass-a-signed-offset.patch b/queue-6.9/ftruncate-pass-a-signed-offset.patch new file mode 100644 index 00000000000..b1bdf8e57a9 --- /dev/null +++ b/queue-6.9/ftruncate-pass-a-signed-offset.patch @@ -0,0 +1,72 @@ +From 4b8e88e563b5f666446d002ad0dc1e6e8e7102b0 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 19 Jun 2024 11:34:09 +0200 +Subject: ftruncate: pass a signed offset + +From: Arnd Bergmann + +commit 4b8e88e563b5f666446d002ad0dc1e6e8e7102b0 upstream. + +The old ftruncate() syscall, using the 32-bit off_t misses a sign +extension when called in compat mode on 64-bit architectures. As a +result, passing a negative length accidentally succeeds in truncating +to file size between 2GiB and 4GiB. + +Changing the type of the compat syscall to the signed compat_off_t +changes the behavior so it instead returns -EINVAL. + +The native entry point, the truncate() syscall and the corresponding +loff_t based variants are all correct already and do not suffer +from this mistake. + +Fixes: 3f6d078d4acc ("fix compat truncate/ftruncate") +Reviewed-by: Christian Brauner +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + fs/open.c | 4 ++-- + include/linux/compat.h | 2 +- + include/linux/syscalls.h | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +--- a/fs/open.c ++++ b/fs/open.c +@@ -202,13 +202,13 @@ long do_sys_ftruncate(unsigned int fd, l + return error; + } + +-SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length) ++SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } + + #ifdef CONFIG_COMPAT +-COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length) ++COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) + { + return do_sys_ftruncate(fd, length, 1); + } +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -608,7 +608,7 @@ asmlinkage long compat_sys_fstatfs(unsig + asmlinkage long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz, + struct compat_statfs64 __user *buf); + asmlinkage long compat_sys_truncate(const char __user *, compat_off_t); +-asmlinkage long compat_sys_ftruncate(unsigned int, compat_ulong_t); ++asmlinkage long compat_sys_ftruncate(unsigned int, compat_off_t); + /* No generic prototype for truncate64, ftruncate64, fallocate */ + asmlinkage long compat_sys_openat(int dfd, const char __user *filename, + int flags, umode_t mode); +--- a/include/linux/syscalls.h ++++ b/include/linux/syscalls.h +@@ -418,7 +418,7 @@ asmlinkage long sys_listmount(const stru + u64 __user *mnt_ids, size_t nr_mnt_ids, + unsigned int flags); + asmlinkage long sys_truncate(const char __user *path, long length); +-asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length); ++asmlinkage long sys_ftruncate(unsigned int fd, off_t length); + #if BITS_PER_LONG == 32 + asmlinkage long sys_truncate64(const char __user *path, loff_t length); + asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length); diff --git a/queue-6.9/series b/queue-6.9/series index 8751df286d3..d0f62d9f84a 100644 --- a/queue-6.9/series +++ b/queue-6.9/series @@ -191,3 +191,5 @@ can-mcp251xfd-fix-infinite-loop-when-xmit-fails.patch ata-ahci-clean-up-sysfs-file-on-error.patch ata-libata-core-add-ata_horkage_nolpm-for-all-crucial-bx-ssd1-models.patch ata-libata-core-fix-double-free-on-error.patch +ftruncate-pass-a-signed-offset.patch +syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch diff --git a/queue-6.9/syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch b/queue-6.9/syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch new file mode 100644 index 00000000000..a4807c23cbe --- /dev/null +++ b/queue-6.9/syscalls-fix-compat_sys_io_pgetevents_time64-usage.patch @@ -0,0 +1,142 @@ +From d3882564a77c21eb746ba5364f3fa89b88de3d61 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 20 Jun 2024 14:16:37 +0200 +Subject: syscalls: fix compat_sys_io_pgetevents_time64 usage + +From: Arnd Bergmann + +commit d3882564a77c21eb746ba5364f3fa89b88de3d61 upstream. + +Using sys_io_pgetevents() as the entry point for compat mode tasks +works almost correctly, but misses the sign extension for the min_nr +and nr arguments. + +This was addressed on parisc by switching to +compat_sys_io_pgetevents_time64() in commit 6431e92fc827 ("parisc: +io_pgetevents_time64() needs compat syscall in 32-bit compat mode"), +as well as by using more sophisticated system call wrappers on x86 and +s390. However, arm64, mips, powerpc, sparc and riscv still have the +same bug. + +Change all of them over to use compat_sys_io_pgetevents_time64() +like parisc already does. This was clearly the intention when the +function was originally added, but it got hooked up incorrectly in +the tables. + +Cc: stable@vger.kernel.org +Fixes: 48166e6ea47d ("y2038: add 64-bit time_t syscalls to all 32-bit architectures") +Acked-by: Heiko Carstens # s390 +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/unistd32.h | 2 +- + arch/mips/kernel/syscalls/syscall_n32.tbl | 2 +- + arch/mips/kernel/syscalls/syscall_o32.tbl | 2 +- + arch/powerpc/kernel/syscalls/syscall.tbl | 2 +- + arch/s390/kernel/syscalls/syscall.tbl | 2 +- + arch/sparc/kernel/syscalls/syscall.tbl | 2 +- + arch/x86/entry/syscalls/syscall_32.tbl | 2 +- + include/uapi/asm-generic/unistd.h | 2 +- + kernel/sys_ni.c | 2 +- + 9 files changed, 9 insertions(+), 9 deletions(-) + +--- a/arch/arm64/include/asm/unistd32.h ++++ b/arch/arm64/include/asm/unistd32.h +@@ -840,7 +840,7 @@ __SYSCALL(__NR_pselect6_time64, compat_s + #define __NR_ppoll_time64 414 + __SYSCALL(__NR_ppoll_time64, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SYSCALL(__NR_io_pgetevents_time64, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SYSCALL(__NR_recvmmsg_time64, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +--- a/arch/mips/kernel/syscalls/syscall_n32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_n32.tbl +@@ -354,7 +354,7 @@ + 412 n32 utimensat_time64 sys_utimensat + 413 n32 pselect6_time64 compat_sys_pselect6_time64 + 414 n32 ppoll_time64 compat_sys_ppoll_time64 +-416 n32 io_pgetevents_time64 sys_io_pgetevents ++416 n32 io_pgetevents_time64 compat_sys_io_pgetevents_time64 + 417 n32 recvmmsg_time64 compat_sys_recvmmsg_time64 + 418 n32 mq_timedsend_time64 sys_mq_timedsend + 419 n32 mq_timedreceive_time64 sys_mq_timedreceive +--- a/arch/mips/kernel/syscalls/syscall_o32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_o32.tbl +@@ -403,7 +403,7 @@ + 412 o32 utimensat_time64 sys_utimensat sys_utimensat + 413 o32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 o32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 o32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 o32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 o32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 o32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 o32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +--- a/arch/powerpc/kernel/syscalls/syscall.tbl ++++ b/arch/powerpc/kernel/syscalls/syscall.tbl +@@ -506,7 +506,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +--- a/arch/s390/kernel/syscalls/syscall.tbl ++++ b/arch/s390/kernel/syscalls/syscall.tbl +@@ -418,7 +418,7 @@ + 412 32 utimensat_time64 - sys_utimensat + 413 32 pselect6_time64 - compat_sys_pselect6_time64 + 414 32 ppoll_time64 - compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 - sys_io_pgetevents ++416 32 io_pgetevents_time64 - compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 - compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 - sys_mq_timedsend + 419 32 mq_timedreceive_time64 - sys_mq_timedreceive +--- a/arch/sparc/kernel/syscalls/syscall.tbl ++++ b/arch/sparc/kernel/syscalls/syscall.tbl +@@ -461,7 +461,7 @@ + 412 32 utimensat_time64 sys_utimensat sys_utimensat + 413 32 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 32 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 32 io_pgetevents_time64 sys_io_pgetevents sys_io_pgetevents ++416 32 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 32 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 32 mq_timedsend_time64 sys_mq_timedsend sys_mq_timedsend + 419 32 mq_timedreceive_time64 sys_mq_timedreceive sys_mq_timedreceive +--- a/arch/x86/entry/syscalls/syscall_32.tbl ++++ b/arch/x86/entry/syscalls/syscall_32.tbl +@@ -420,7 +420,7 @@ + 412 i386 utimensat_time64 sys_utimensat + 413 i386 pselect6_time64 sys_pselect6 compat_sys_pselect6_time64 + 414 i386 ppoll_time64 sys_ppoll compat_sys_ppoll_time64 +-416 i386 io_pgetevents_time64 sys_io_pgetevents ++416 i386 io_pgetevents_time64 sys_io_pgetevents compat_sys_io_pgetevents_time64 + 417 i386 recvmmsg_time64 sys_recvmmsg compat_sys_recvmmsg_time64 + 418 i386 mq_timedsend_time64 sys_mq_timedsend + 419 i386 mq_timedreceive_time64 sys_mq_timedreceive +--- a/include/uapi/asm-generic/unistd.h ++++ b/include/uapi/asm-generic/unistd.h +@@ -737,7 +737,7 @@ __SC_COMP(__NR_pselect6_time64, sys_psel + #define __NR_ppoll_time64 414 + __SC_COMP(__NR_ppoll_time64, sys_ppoll, compat_sys_ppoll_time64) + #define __NR_io_pgetevents_time64 416 +-__SYSCALL(__NR_io_pgetevents_time64, sys_io_pgetevents) ++__SC_COMP(__NR_io_pgetevents_time64, sys_io_pgetevents, compat_sys_io_pgetevents_time64) + #define __NR_recvmmsg_time64 417 + __SC_COMP(__NR_recvmmsg_time64, sys_recvmmsg, compat_sys_recvmmsg_time64) + #define __NR_mq_timedsend_time64 418 +--- a/kernel/sys_ni.c ++++ b/kernel/sys_ni.c +@@ -46,8 +46,8 @@ COND_SYSCALL(io_getevents_time32); + COND_SYSCALL(io_getevents); + COND_SYSCALL(io_pgetevents_time32); + COND_SYSCALL(io_pgetevents); +-COND_SYSCALL_COMPAT(io_pgetevents_time32); + COND_SYSCALL_COMPAT(io_pgetevents); ++COND_SYSCALL_COMPAT(io_pgetevents_time64); + COND_SYSCALL(io_uring_setup); + COND_SYSCALL(io_uring_enter); + COND_SYSCALL(io_uring_register); -- 2.47.3