From fc148f78f84084054d8cf46c001e01ef84acf15b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 27 Jan 2024 12:46:24 -0800 Subject: [PATCH] 5.15-stable patches added patches: overflow-allow-mixed-type-arguments.patch --- .../overflow-allow-mixed-type-arguments.patch | 123 ++++++++++++++++++ queue-5.15/series | 1 + 2 files changed, 124 insertions(+) create mode 100644 queue-5.15/overflow-allow-mixed-type-arguments.patch diff --git a/queue-5.15/overflow-allow-mixed-type-arguments.patch b/queue-5.15/overflow-allow-mixed-type-arguments.patch new file mode 100644 index 00000000000..204a3126082 --- /dev/null +++ b/queue-5.15/overflow-allow-mixed-type-arguments.patch @@ -0,0 +1,123 @@ +From d219d2a9a92e39aa92799efe8f2aa21259b6dd82 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Mon, 29 Aug 2022 13:37:17 -0700 +Subject: overflow: Allow mixed type arguments + +From: Kees Cook + +commit d219d2a9a92e39aa92799efe8f2aa21259b6dd82 upstream. + +When the check_[op]_overflow() helpers were introduced, all arguments +were required to be the same type to make the fallback macros simpler. +However, now that the fallback macros have been removed[1], it is fine +to allow mixed types, which makes using the helpers much more useful, +as they can be used to test for type-based overflows (e.g. adding two +large ints but storing into a u8), as would be handy in the drm core[2]. + +Remove the restriction, and add additional self-tests that exercise +some of the mixed-type overflow cases, and double-check for accidental +macro side-effects. + +[1] https://git.kernel.org/linus/4eb6bd55cfb22ffc20652732340c4962f3ac9a91 +[2] https://lore.kernel.org/lkml/20220824084514.2261614-2-gwan-gyeong.mun@intel.com + +Cc: Rasmus Villemoes +Cc: Gwan-gyeong Mun +Cc: "Gustavo A. R. Silva" +Cc: Nick Desaulniers +Cc: linux-hardening@vger.kernel.org +Reviewed-by: Andrzej Hajda +Reviewed-by: Gwan-gyeong Mun +Tested-by: Gwan-gyeong Mun +Signed-off-by: Kees Cook +[ dropped the test portion of the commit as that doesn't apply to + 5.15.y - gregkh] +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/overflow.h | 72 ++++++++++++++++++++++++++--------------------- + 1 file changed, 41 insertions(+), 31 deletions(-) + +--- a/include/linux/overflow.h ++++ b/include/linux/overflow.h +@@ -51,40 +51,50 @@ static inline bool __must_check __must_c + return unlikely(overflow); + } + +-/* +- * For simplicity and code hygiene, the fallback code below insists on +- * a, b and *d having the same type (similar to the min() and max() +- * macros), whereas gcc's type-generic overflow checkers accept +- * different types. Hence we don't just make check_add_overflow an +- * alias for __builtin_add_overflow, but add type checks similar to +- * below. ++/** check_add_overflow() - Calculate addition with overflow checking ++ * ++ * @a: first addend ++ * @b: second addend ++ * @d: pointer to store sum ++ * ++ * Returns 0 on success. ++ * ++ * *@d holds the results of the attempted addition, but is not considered ++ * "safe for use" on a non-zero return value, which indicates that the ++ * sum has overflowed or been truncated. + */ +-#define check_add_overflow(a, b, d) __must_check_overflow(({ \ +- typeof(a) __a = (a); \ +- typeof(b) __b = (b); \ +- typeof(d) __d = (d); \ +- (void) (&__a == &__b); \ +- (void) (&__a == __d); \ +- __builtin_add_overflow(__a, __b, __d); \ +-})) ++#define check_add_overflow(a, b, d) \ ++ __must_check_overflow(__builtin_add_overflow(a, b, d)) + +-#define check_sub_overflow(a, b, d) __must_check_overflow(({ \ +- typeof(a) __a = (a); \ +- typeof(b) __b = (b); \ +- typeof(d) __d = (d); \ +- (void) (&__a == &__b); \ +- (void) (&__a == __d); \ +- __builtin_sub_overflow(__a, __b, __d); \ +-})) ++/** check_sub_overflow() - Calculate subtraction with overflow checking ++ * ++ * @a: minuend; value to subtract from ++ * @b: subtrahend; value to subtract from @a ++ * @d: pointer to store difference ++ * ++ * Returns 0 on success. ++ * ++ * *@d holds the results of the attempted subtraction, but is not considered ++ * "safe for use" on a non-zero return value, which indicates that the ++ * difference has underflowed or been truncated. ++ */ ++#define check_sub_overflow(a, b, d) \ ++ __must_check_overflow(__builtin_sub_overflow(a, b, d)) + +-#define check_mul_overflow(a, b, d) __must_check_overflow(({ \ +- typeof(a) __a = (a); \ +- typeof(b) __b = (b); \ +- typeof(d) __d = (d); \ +- (void) (&__a == &__b); \ +- (void) (&__a == __d); \ +- __builtin_mul_overflow(__a, __b, __d); \ +-})) ++/** check_mul_overflow() - Calculate multiplication with overflow checking ++ * ++ * @a: first factor ++ * @b: second factor ++ * @d: pointer to store product ++ * ++ * Returns 0 on success. ++ * ++ * *@d holds the results of the attempted multiplication, but is not ++ * considered "safe for use" on a non-zero return value, which indicates ++ * that the product has overflowed or been truncated. ++ */ ++#define check_mul_overflow(a, b, d) \ ++ __must_check_overflow(__builtin_mul_overflow(a, b, d)) + + /** check_shl_overflow() - Calculate a left-shifted value and check overflow + * diff --git a/queue-5.15/series b/queue-5.15/series index 02d33282362..ceaab04a18a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -63,6 +63,7 @@ net-mlx5-dr-align-mlx5dv_dr-api-vport-action-with-fw.patch net-mlx5-dr-can-t-go-to-uplink-vport-on-rx-rule.patch net-mlx5e-fix-a-double-free-in-arfs_create_groups.patch net-mlx5e-fix-a-potential-double-free-in-fs_any_crea.patch +overflow-allow-mixed-type-arguments.patch netfilter-nft_limit-reject-configurations-that-cause.patch netfilter-nf_tables-restrict-anonymous-set-and-map-n.patch netfilter-nf_tables-validate-nfproto_-family.patch -- 2.47.3