From b744afbd80ef291a6b12f667c4178a866d5e51f2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 3 Dec 2024 12:48:11 +0100 Subject: [PATCH] 5.4-stable patches added patches: lib-string_helpers-silence-snprintf-output-truncation-warning.patch nfsd-prevent-a-potential-integer-overflow.patch sunrpc-make-sure-cache-entry-active-before-cache_show.patch --- ...e-snprintf-output-truncation-warning.patch | 40 +++++++++++++ ...prevent-a-potential-integer-overflow.patch | 50 ++++++++++++++++ queue-5.4/series | 3 + ...cache-entry-active-before-cache_show.patch | 57 +++++++++++++++++++ 4 files changed, 150 insertions(+) create mode 100644 queue-5.4/lib-string_helpers-silence-snprintf-output-truncation-warning.patch create mode 100644 queue-5.4/nfsd-prevent-a-potential-integer-overflow.patch create mode 100644 queue-5.4/sunrpc-make-sure-cache-entry-active-before-cache_show.patch diff --git a/queue-5.4/lib-string_helpers-silence-snprintf-output-truncation-warning.patch b/queue-5.4/lib-string_helpers-silence-snprintf-output-truncation-warning.patch new file mode 100644 index 00000000000..43e72fe8dc1 --- /dev/null +++ b/queue-5.4/lib-string_helpers-silence-snprintf-output-truncation-warning.patch @@ -0,0 +1,40 @@ +From a508ef4b1dcc82227edc594ffae583874dd425d7 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Fri, 1 Nov 2024 21:54:53 +0100 +Subject: lib: string_helpers: silence snprintf() output truncation warning + +From: Bartosz Golaszewski + +commit a508ef4b1dcc82227edc594ffae583874dd425d7 upstream. + +The output of ".%03u" with the unsigned int in range [0, 4294966295] may +get truncated if the target buffer is not 12 bytes. This can't really +happen here as the 'remainder' variable cannot exceed 999 but the +compiler doesn't know it. To make it happy just increase the buffer to +where the warning goes away. + +Fixes: 3c9f3681d0b4 ("[SCSI] lib: add generic helper to print sizes rounded to the correct SI range") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Andy Shevchenko +Cc: James E.J. Bottomley +Cc: Kees Cook +Cc: stable@vger.kernel.org +Signed-off-by: Andrew Morton +Link: https://lore.kernel.org/r/20241101205453.9353-1-brgl@bgdev.pl +Signed-off-by: Kees Cook +Signed-off-by: Greg Kroah-Hartman +--- + lib/string_helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/string_helpers.c ++++ b/lib/string_helpers.c +@@ -51,7 +51,7 @@ void string_get_size(u64 size, u64 blk_s + static const unsigned int rounding[] = { 500, 50, 5 }; + int i = 0, j; + u32 remainder = 0, sf_cap; +- char tmp[8]; ++ char tmp[12]; + const char *unit; + + tmp[0] = '\0'; diff --git a/queue-5.4/nfsd-prevent-a-potential-integer-overflow.patch b/queue-5.4/nfsd-prevent-a-potential-integer-overflow.patch new file mode 100644 index 00000000000..a8ffa893496 --- /dev/null +++ b/queue-5.4/nfsd-prevent-a-potential-integer-overflow.patch @@ -0,0 +1,50 @@ +From 7f33b92e5b18e904a481e6e208486da43e4dc841 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Tue, 17 Sep 2024 12:15:23 -0400 +Subject: NFSD: Prevent a potential integer overflow + +From: Chuck Lever + +commit 7f33b92e5b18e904a481e6e208486da43e4dc841 upstream. + +If the tag length is >= U32_MAX - 3 then the "length + 4" addition +can result in an integer overflow. Address this by splitting the +decoding into several steps so that decode_cb_compound4res() does +not have to perform arithmetic on the unsafe length value. + +Reported-by: Dan Carpenter +Cc: stable@vger.kernel.org +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4callback.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -285,17 +285,17 @@ static int decode_cb_compound4res(struct + u32 length; + __be32 *p; + +- p = xdr_inline_decode(xdr, 4 + 4); ++ p = xdr_inline_decode(xdr, XDR_UNIT); + if (unlikely(p == NULL)) + goto out_overflow; +- hdr->status = be32_to_cpup(p++); ++ hdr->status = be32_to_cpup(p); + /* Ignore the tag */ +- length = be32_to_cpup(p++); +- p = xdr_inline_decode(xdr, length + 4); +- if (unlikely(p == NULL)) ++ if (xdr_stream_decode_u32(xdr, &length) < 0) ++ goto out_overflow; ++ if (xdr_inline_decode(xdr, length) == NULL) ++ goto out_overflow; ++ if (xdr_stream_decode_u32(xdr, &hdr->nops) < 0) + goto out_overflow; +- p += XDR_QUADLEN(length); +- hdr->nops = be32_to_cpup(p); + return 0; + out_overflow: + return -EIO; diff --git a/queue-5.4/series b/queue-5.4/series index f23050f8401..af32e3b4222 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -174,3 +174,6 @@ alsa-hda-realtek-set-pcbeep-to-default-value-for-alc274.patch alsa-hda-realtek-fix-internal-speaker-and-mic-boost-of-infinix-y4-max.patch alsa-hda-realtek-apply-quirk-for-medion-e15433.patch usb-dwc3-gadget-fix-checking-for-number-of-trbs-left.patch +lib-string_helpers-silence-snprintf-output-truncation-warning.patch +nfsd-prevent-a-potential-integer-overflow.patch +sunrpc-make-sure-cache-entry-active-before-cache_show.patch diff --git a/queue-5.4/sunrpc-make-sure-cache-entry-active-before-cache_show.patch b/queue-5.4/sunrpc-make-sure-cache-entry-active-before-cache_show.patch new file mode 100644 index 00000000000..51e5cca8fb4 --- /dev/null +++ b/queue-5.4/sunrpc-make-sure-cache-entry-active-before-cache_show.patch @@ -0,0 +1,57 @@ +From 2862eee078a4d2d1f584e7f24fa50dddfa5f3471 Mon Sep 17 00:00:00 2001 +From: Yang Erkun +Date: Mon, 21 Oct 2024 22:23:42 +0800 +Subject: SUNRPC: make sure cache entry active before cache_show + +From: Yang Erkun + +commit 2862eee078a4d2d1f584e7f24fa50dddfa5f3471 upstream. + +The function `c_show` was called with protection from RCU. This only +ensures that `cp` will not be freed. Therefore, the reference count for +`cp` can drop to zero, which will trigger a refcount use-after-free +warning when `cache_get` is called. To resolve this issue, use +`cache_get_rcu` to ensure that `cp` remains active. + +------------[ cut here ]------------ +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 7 PID: 822 at lib/refcount.c:25 +refcount_warn_saturate+0xb1/0x120 +CPU: 7 UID: 0 PID: 822 Comm: cat Not tainted 6.12.0-rc3+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +1.16.1-2.fc37 04/01/2014 +RIP: 0010:refcount_warn_saturate+0xb1/0x120 + +Call Trace: + + c_show+0x2fc/0x380 [sunrpc] + seq_read_iter+0x589/0x770 + seq_read+0x1e5/0x270 + proc_reg_read+0xe1/0x140 + vfs_read+0x125/0x530 + ksys_read+0xc1/0x160 + do_syscall_64+0x5f/0x170 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Cc: stable@vger.kernel.org # v4.20+ +Signed-off-by: Yang Erkun +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/cache.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -1407,7 +1407,9 @@ static int c_show(struct seq_file *m, vo + seq_printf(m, "# expiry=%ld refcnt=%d flags=%lx\n", + convert_to_wallclock(cp->expiry_time), + kref_read(&cp->ref), cp->flags); +- cache_get(cp); ++ if (!cache_get_rcu(cp)) ++ return 0; ++ + if (cache_check(cd, cp, NULL)) + /* cache_check does a cache_put on failure */ + seq_printf(m, "# "); -- 2.47.3