From 4ad69754f8950fe9ee9caf7c1626d02a635e8c99 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 8 Sep 2024 12:11:19 +0200 Subject: [PATCH] 6.6-stable patches added patches: asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch kvm-x86-acquire-kvm-srcu-when-handling-kvm_set_vcpu_events.patch net-microchip-vcap-fix-use-after-free-error-in-kunit-test.patch --- ...x-uaf-for-snd_soc_pcm_runtime-object.patch | 58 ++++++++++++++ ...cu-when-handling-kvm_set_vcpu_events.patch | 80 +++++++++++++++++++ ...x-use-after-free-error-in-kunit-test.patch | 49 ++++++++++++ queue-6.6/series | 3 + 4 files changed, 190 insertions(+) create mode 100644 queue-6.6/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch create mode 100644 queue-6.6/kvm-x86-acquire-kvm-srcu-when-handling-kvm_set_vcpu_events.patch create mode 100644 queue-6.6/net-microchip-vcap-fix-use-after-free-error-in-kunit-test.patch diff --git a/queue-6.6/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch b/queue-6.6/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch new file mode 100644 index 00000000000..9a494bf2e6c --- /dev/null +++ b/queue-6.6/asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch @@ -0,0 +1,58 @@ +From b4a90b543d9f62d3ac34ec1ab97fc5334b048565 Mon Sep 17 00:00:00 2001 +From: robelin +Date: Fri, 23 Aug 2024 14:43:41 +0000 +Subject: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object + +From: robelin + +commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream. + +When using kernel with the following extra config, + + - CONFIG_KASAN=y + - CONFIG_KASAN_GENERIC=y + - CONFIG_KASAN_INLINE=y + - CONFIG_KASAN_VMALLOC=y + - CONFIG_FRAME_WARN=4096 + +kernel detects that snd_pcm_suspend_all() access a freed +'snd_soc_pcm_runtime' object when the system is suspended, which +leads to a use-after-free bug: + +[ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 +[ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 + +[ 52.047785] Call trace: +[ 52.047787] dump_backtrace+0x0/0x3c0 +[ 52.047794] show_stack+0x34/0x50 +[ 52.047797] dump_stack_lvl+0x68/0x8c +[ 52.047802] print_address_description.constprop.0+0x74/0x2c0 +[ 52.047809] kasan_report+0x210/0x230 +[ 52.047815] __asan_report_load1_noabort+0x3c/0x50 +[ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 +[ 52.047824] snd_soc_suspend+0x19c/0x4e0 + +The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before +making any access. So we need to always set 'substream->runtime' to NULL +everytime we kfree() it. + +Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables") +Signed-off-by: robelin +Signed-off-by: Sameer Pujar +Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-dapm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -4018,6 +4018,7 @@ static int snd_soc_dai_link_event(struct + + case SND_SOC_DAPM_POST_PMD: + kfree(substream->runtime); ++ substream->runtime = NULL; + break; + + default: diff --git a/queue-6.6/kvm-x86-acquire-kvm-srcu-when-handling-kvm_set_vcpu_events.patch b/queue-6.6/kvm-x86-acquire-kvm-srcu-when-handling-kvm_set_vcpu_events.patch new file mode 100644 index 00000000000..45c22c112d2 --- /dev/null +++ b/queue-6.6/kvm-x86-acquire-kvm-srcu-when-handling-kvm_set_vcpu_events.patch @@ -0,0 +1,80 @@ +From 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Tue, 23 Jul 2024 16:20:55 -0700 +Subject: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS + +From: Sean Christopherson + +commit 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 upstream. + +Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly +leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX +reads guest memory. + +Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN +via sync_regs(), which already holds SRCU. I.e. trying to precisely use +kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause +problems. Acquiring SRCU isn't all that expensive, so for simplicity, +grab it unconditionally for KVM_SET_VCPU_EVENTS. + + ============================= + WARNING: suspicious RCU usage + 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted + ----------------------------- + include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage! + + other info that might help us debug this: + + rcu_scheduler_active = 2, debug_locks = 1 + 1 lock held by repro/1071: + #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm] + + stack backtrace: + CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + Call Trace: + + dump_stack_lvl+0x7f/0x90 + lockdep_rcu_suspicious+0x13f/0x1a0 + kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] + kvm_vcpu_read_guest+0x3e/0x90 [kvm] + nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] + load_vmcs12_host_state+0x432/0xb40 [kvm_intel] + vmx_leave_nested+0x30/0x40 [kvm_intel] + kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] + kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] + ? mark_held_locks+0x49/0x70 + ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] + ? kvm_vcpu_ioctl+0x497/0x970 [kvm] + kvm_vcpu_ioctl+0x497/0x970 [kvm] + ? lock_acquire+0xba/0x2d0 + ? find_held_lock+0x2b/0x80 + ? do_user_addr_fault+0x40c/0x6f0 + ? lock_release+0xb7/0x270 + __x64_sys_ioctl+0x82/0xb0 + do_syscall_64+0x6c/0x170 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + RIP: 0033:0x7ff11eb1b539 + + +Fixes: f7e570780efc ("KVM: x86: Forcibly leave nested virt when SMM state is toggled") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240723232055.3643811-1-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/x86.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -5829,7 +5829,9 @@ long kvm_arch_vcpu_ioctl(struct file *fi + if (copy_from_user(&events, argp, sizeof(struct kvm_vcpu_events))) + break; + ++ kvm_vcpu_srcu_read_lock(vcpu); + r = kvm_vcpu_ioctl_x86_set_vcpu_events(vcpu, &events); ++ kvm_vcpu_srcu_read_unlock(vcpu); + break; + } + case KVM_GET_DEBUGREGS: { diff --git a/queue-6.6/net-microchip-vcap-fix-use-after-free-error-in-kunit-test.patch b/queue-6.6/net-microchip-vcap-fix-use-after-free-error-in-kunit-test.patch new file mode 100644 index 00000000000..6a1dc540a35 --- /dev/null +++ b/queue-6.6/net-microchip-vcap-fix-use-after-free-error-in-kunit-test.patch @@ -0,0 +1,49 @@ +From a3c1e45156ad39f225cd7ddae0f81230a3b1e657 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jens=20Emil=20Schulz=20=C3=98stergaard?= + +Date: Thu, 29 Aug 2024 11:52:54 +0200 +Subject: net: microchip: vcap: Fix use-after-free error in kunit test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jens Emil Schulz Østergaard + +commit a3c1e45156ad39f225cd7ddae0f81230a3b1e657 upstream. + +This is a clear use-after-free error. We remove it, and rely on checking +the return code of vcap_del_rule. + +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/kernel-janitors/7bffefc6-219a-4f71-baa0-ad4526e5c198@kili.mountain/ +Fixes: c956b9b318d9 ("net: microchip: sparx5: Adding KUNIT tests of key/action values in VCAP API") +Signed-off-by: Jens Emil Schulz Østergaard +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +--- a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c ++++ b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c +@@ -1442,18 +1442,8 @@ static void vcap_api_encode_rule_test(st + vcap_enable_lookups(&test_vctrl, &test_netdev, 0, 0, + rule->cookie, false); + +- vcap_free_rule(rule); +- +- /* Check that the rule has been freed: tricky to access since this +- * memory should not be accessible anymore +- */ +- KUNIT_EXPECT_PTR_NE(test, NULL, rule); +- ret = list_empty(&rule->keyfields); +- KUNIT_EXPECT_EQ(test, true, ret); +- ret = list_empty(&rule->actionfields); +- KUNIT_EXPECT_EQ(test, true, ret); +- +- vcap_del_rule(&test_vctrl, &test_netdev, id); ++ ret = vcap_del_rule(&test_vctrl, &test_netdev, id); ++ KUNIT_EXPECT_EQ(test, 0, ret); + } + + static void vcap_api_set_rule_counter_test(struct kunit *test) diff --git a/queue-6.6/series b/queue-6.6/series index b165590dfba..aba70794ccf 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1 +1,4 @@ sch-netem-fix-use-after-free-in-netem_dequeue.patch +net-microchip-vcap-fix-use-after-free-error-in-kunit-test.patch +asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch +kvm-x86-acquire-kvm-srcu-when-handling-kvm_set_vcpu_events.patch -- 2.47.3