From: Greg Kroah-Hartman Date: Mon, 21 Jul 2025 14:08:52 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.1.147~50 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3de2abf396cfd621dcc5084afa373d9ef76203e1;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: clone_private_mnt-make-sure-that-caller-has-cap_sys_admin-in-the-right-userns.patch sched-change-nr_uninterruptible-type-to-unsigned-long.patch --- diff --git a/queue-5.15/clone_private_mnt-make-sure-that-caller-has-cap_sys_admin-in-the-right-userns.patch b/queue-5.15/clone_private_mnt-make-sure-that-caller-has-cap_sys_admin-in-the-right-userns.patch new file mode 100644 index 0000000000..1080ce8f0e --- /dev/null +++ b/queue-5.15/clone_private_mnt-make-sure-that-caller-has-cap_sys_admin-in-the-right-userns.patch @@ -0,0 +1,48 @@ +From c28f922c9dcee0e4876a2c095939d77fe7e15116 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Sun, 1 Jun 2025 20:11:06 -0400 +Subject: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns + +From: Al Viro + +commit c28f922c9dcee0e4876a2c095939d77fe7e15116 upstream. + +What we want is to verify there is that clone won't expose something +hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" +may be a result of MNT_LOCKED on a child, but it may also come from +lacking admin rights in the userns of the namespace mount belongs to. + +clone_private_mnt() checks the former, but not the latter. + +There's a number of rather confusing CAP_SYS_ADMIN checks in various +userns during the mount, especially with the new mount API; they serve +different purposes and in case of clone_private_mnt() they usually, +but not always end up covering the missing check mentioned above. + +Reviewed-by: Christian Brauner +Reported-by: "Orlando, Noah" +Fixes: 427215d85e8d ("ovl: prevent private clone if bind mount is not allowed") +Signed-off-by: Al Viro +[ merge conflict resolution: clone_private_mount() was reworked in + db04662e2f4f ("fs: allow detached mounts in clone_private_mount()"). + Tweak the relevant ns_capable check so that it works on older kernels ] +Signed-off-by: Noah Orlando +Signed-off-by: Greg Kroah-Hartman +--- + fs/namespace.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1975,6 +1975,11 @@ struct vfsmount *clone_private_mount(con + if (!check_mnt(old_mnt)) + goto invalid; + ++ if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN)) { ++ up_read(&namespace_sem); ++ return ERR_PTR(-EPERM); ++ } ++ + if (has_locked_children(old_mnt, path->dentry)) + goto invalid; + diff --git a/queue-5.15/sched-change-nr_uninterruptible-type-to-unsigned-long.patch b/queue-5.15/sched-change-nr_uninterruptible-type-to-unsigned-long.patch new file mode 100644 index 0000000000..58c8b0b0bd --- /dev/null +++ b/queue-5.15/sched-change-nr_uninterruptible-type-to-unsigned-long.patch @@ -0,0 +1,54 @@ +From 36569780b0d64de283f9d6c2195fd1a43e221ee8 Mon Sep 17 00:00:00 2001 +From: Aruna Ramakrishna +Date: Wed, 9 Jul 2025 17:33:28 +0000 +Subject: sched: Change nr_uninterruptible type to unsigned long + +From: Aruna Ramakrishna + +commit 36569780b0d64de283f9d6c2195fd1a43e221ee8 upstream. + +The commit e6fe3f422be1 ("sched: Make multiple runqueue task counters +32-bit") changed nr_uninterruptible to an unsigned int. But the +nr_uninterruptible values for each of the CPU runqueues can grow to +large numbers, sometimes exceeding INT_MAX. This is valid, if, over +time, a large number of tasks are migrated off of one CPU after going +into an uninterruptible state. Only the sum of all nr_interruptible +values across all CPUs yields the correct result, as explained in a +comment in kernel/sched/loadavg.c. + +Change the type of nr_uninterruptible back to unsigned long to prevent +overflows, and thus the miscalculation of load average. + +Fixes: e6fe3f422be1 ("sched: Make multiple runqueue task counters 32-bit") + +Signed-off-by: Aruna Ramakrishna +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20250709173328.606794-1-aruna.ramakrishna@oracle.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/loadavg.c | 2 +- + kernel/sched/sched.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/sched/loadavg.c ++++ b/kernel/sched/loadavg.c +@@ -81,7 +81,7 @@ long calc_load_fold_active(struct rq *th + long nr_active, delta = 0; + + nr_active = this_rq->nr_running - adjust; +- nr_active += (int)this_rq->nr_uninterruptible; ++ nr_active += (long)this_rq->nr_uninterruptible; + + if (nr_active != this_rq->calc_load_active) { + delta = nr_active - this_rq->calc_load_active; +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -971,7 +971,7 @@ struct rq { + * one CPU and if it got migrated afterwards it may decrease + * it on another CPU. Always updated under the runqueue lock: + */ +- unsigned int nr_uninterruptible; ++ unsigned long nr_uninterruptible; + + struct task_struct __rcu *curr; + struct task_struct *idle; diff --git a/queue-5.15/series b/queue-5.15/series index 8c9be73a31..3da93b398f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -57,3 +57,4 @@ net-vlan-fix-vlan-0-refcount-imbalance-of-toggling-f.patch net-bridge-do-not-offload-igmp-mld-messages.patch net-sched-return-null-when-htb_lookup_leaf-encounter.patch sched-change-nr_uninterruptible-type-to-unsigned-long.patch +clone_private_mnt-make-sure-that-caller-has-cap_sys_admin-in-the-right-userns.patch