release 6.14.4
This commit is contained in:
@@ -18,7 +18,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||
|
||||
--- a/fs/btrfs/super.c
|
||||
+++ b/fs/btrfs/super.c
|
||||
@@ -2627,7 +2627,7 @@ module_exit(exit_btrfs_fs)
|
||||
@@ -2626,7 +2626,7 @@ module_exit(exit_btrfs_fs)
|
||||
|
||||
MODULE_DESCRIPTION("B-Tree File System (BTRFS)");
|
||||
MODULE_LICENSE("GPL");
|
||||
|
@@ -1,84 +0,0 @@
|
||||
From: Vasiliy Kovalev <kovalev@altlinux.org>
|
||||
Date: Sat, 19 Oct 2024 22:13:03 +0300
|
||||
Subject: hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
|
||||
Origin: https://git.kernel.org/linus/bb5e07cb927724e0b47be371fa081141cfb14414
|
||||
|
||||
Syzbot reported an issue in hfs subsystem:
|
||||
|
||||
BUG: KASAN: slab-out-of-bounds in memcpy_from_page include/linux/highmem.h:423 [inline]
|
||||
BUG: KASAN: slab-out-of-bounds in hfs_bnode_read fs/hfs/bnode.c:35 [inline]
|
||||
BUG: KASAN: slab-out-of-bounds in hfs_bnode_read_key+0x314/0x450 fs/hfs/bnode.c:70
|
||||
Write of size 94 at addr ffff8880123cd100 by task syz-executor237/5102
|
||||
|
||||
Call Trace:
|
||||
<TASK>
|
||||
__dump_stack lib/dump_stack.c:94 [inline]
|
||||
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
|
||||
print_address_description mm/kasan/report.c:377 [inline]
|
||||
print_report+0x169/0x550 mm/kasan/report.c:488
|
||||
kasan_report+0x143/0x180 mm/kasan/report.c:601
|
||||
kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
|
||||
__asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
|
||||
memcpy_from_page include/linux/highmem.h:423 [inline]
|
||||
hfs_bnode_read fs/hfs/bnode.c:35 [inline]
|
||||
hfs_bnode_read_key+0x314/0x450 fs/hfs/bnode.c:70
|
||||
hfs_brec_insert+0x7f3/0xbd0 fs/hfs/brec.c:159
|
||||
hfs_cat_create+0x41d/0xa50 fs/hfs/catalog.c:118
|
||||
hfs_mkdir+0x6c/0xe0 fs/hfs/dir.c:232
|
||||
vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257
|
||||
do_mkdirat+0x264/0x3a0 fs/namei.c:4280
|
||||
__do_sys_mkdir fs/namei.c:4300 [inline]
|
||||
__se_sys_mkdir fs/namei.c:4298 [inline]
|
||||
__x64_sys_mkdir+0x6c/0x80 fs/namei.c:4298
|
||||
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
|
||||
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
|
||||
entry_SYSCALL_64_after_hwframe+0x77/0x7f
|
||||
RIP: 0033:0x7fbdd6057a99
|
||||
|
||||
Add a check for key length in hfs_bnode_read_key to prevent
|
||||
out-of-bounds memory access. If the key length is invalid, the
|
||||
key buffer is cleared, improving stability and reliability.
|
||||
|
||||
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
|
||||
Reported-by: syzbot+5f3a973ed3dfb85a6683@syzkaller.appspotmail.com
|
||||
Closes: https://syzkaller.appspot.com/bug?extid=5f3a973ed3dfb85a6683
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
|
||||
Link: https://lore.kernel.org/20241019191303.24048-1-kovalev@altlinux.org
|
||||
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
|
||||
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
||||
---
|
||||
fs/hfs/bnode.c | 6 ++++++
|
||||
fs/hfsplus/bnode.c | 6 ++++++
|
||||
2 files changed, 12 insertions(+)
|
||||
|
||||
--- a/fs/hfs/bnode.c
|
||||
+++ b/fs/hfs/bnode.c
|
||||
@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnode
|
||||
else
|
||||
key_len = tree->max_key_len + 1;
|
||||
|
||||
+ if (key_len > sizeof(hfs_btree_key) || key_len < 1) {
|
||||
+ memset(key, 0, sizeof(hfs_btree_key));
|
||||
+ pr_err("hfs: Invalid key length: %d\n", key_len);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
hfs_bnode_read(node, key, off, key_len);
|
||||
}
|
||||
|
||||
--- a/fs/hfsplus/bnode.c
|
||||
+++ b/fs/hfsplus/bnode.c
|
||||
@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnode
|
||||
else
|
||||
key_len = tree->max_key_len + 2;
|
||||
|
||||
+ if (key_len > sizeof(hfsplus_btree_key) || key_len < 1) {
|
||||
+ memset(key, 0, sizeof(hfsplus_btree_key));
|
||||
+ pr_err("hfsplus: Invalid key length: %d\n", key_len);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
hfs_bnode_read(node, key, off, key_len);
|
||||
}
|
||||
|
41
debian/patches/bugfix/all/libbpf-use-the-standard-fixdep-build-rule.patch
vendored
Normal file
41
debian/patches/bugfix/all/libbpf-use-the-standard-fixdep-build-rule.patch
vendored
Normal file
@@ -0,0 +1,41 @@
|
||||
From: Ben Hutchings <benh@debian.org>
|
||||
Date: Sun, 20 Apr 2025 18:50:44 +0200
|
||||
Subject: libbpf: Use the standard fixdep build rule
|
||||
|
||||
libbpf's all target depends on the fixdep target defined in
|
||||
tools/scripts/Makefile.include. However the $(BPF_IN_SHARED) and
|
||||
$(BPF_IN_STATIC) targets don't use it, but instead rebuild fixdep in
|
||||
the staticobjs or sharedobjs subdirectory using a different command.
|
||||
|
||||
Change the $(BPF_IN_SHARED) and $(BPF_IN_STATIC) targets to depend on
|
||||
fixdep and to symlink the executable into the respective output
|
||||
subdirectory.
|
||||
|
||||
Signed-off-by: Ben Hutchings <benh@debian.org>
|
||||
---
|
||||
--- a/tools/lib/bpf/Makefile
|
||||
+++ b/tools/lib/bpf/Makefile
|
||||
@@ -134,7 +134,7 @@ all_cmd: $(CMD_TARGETS) check
|
||||
$(SHARED_OBJDIR) $(STATIC_OBJDIR):
|
||||
$(Q)mkdir -p $@
|
||||
|
||||
-$(BPF_IN_SHARED): force $(BPF_GENERATED) | $(SHARED_OBJDIR)
|
||||
+$(BPF_IN_SHARED): fixdep force $(BPF_GENERATED) | $(SHARED_OBJDIR)
|
||||
@(test -f ../../include/uapi/linux/bpf.h -a -f ../../../include/uapi/linux/bpf.h && ( \
|
||||
(diff -B ../../include/uapi/linux/bpf.h ../../../include/uapi/linux/bpf.h >/dev/null) || \
|
||||
echo "Warning: Kernel ABI header at 'tools/include/uapi/linux/bpf.h' differs from latest version at 'include/uapi/linux/bpf.h'" >&2 )) || true
|
||||
@@ -144,11 +144,11 @@ $(BPF_IN_SHARED): force $(BPF_GENERATED)
|
||||
@(test -f ../../include/uapi/linux/if_xdp.h -a -f ../../../include/uapi/linux/if_xdp.h && ( \
|
||||
(diff -B ../../include/uapi/linux/if_xdp.h ../../../include/uapi/linux/if_xdp.h >/dev/null) || \
|
||||
echo "Warning: Kernel ABI header at 'tools/include/uapi/linux/if_xdp.h' differs from latest version at 'include/uapi/linux/if_xdp.h'" >&2 )) || true
|
||||
- $(SILENT_MAKE) -C $(srctree)/tools/build CFLAGS= LDFLAGS= OUTPUT=$(SHARED_OBJDIR) $(SHARED_OBJDIR)fixdep
|
||||
+ ln -sf ../fixdep $(SHARED_OBJDIR)/
|
||||
$(Q)$(MAKE) $(build)=libbpf OUTPUT=$(SHARED_OBJDIR) CFLAGS="$(CFLAGS) $(SHLIB_FLAGS)"
|
||||
|
||||
-$(BPF_IN_STATIC): force $(BPF_GENERATED) | $(STATIC_OBJDIR)
|
||||
- $(SILENT_MAKE) -C $(srctree)/tools/build CFLAGS= LDFLAGS= OUTPUT=$(STATIC_OBJDIR) $(STATIC_OBJDIR)fixdep
|
||||
+$(BPF_IN_STATIC): fixdep force $(BPF_GENERATED) | $(STATIC_OBJDIR)
|
||||
+ ln -sf ../fixdep $(STATIC_OBJDIR)/
|
||||
$(Q)$(MAKE) $(build)=libbpf OUTPUT=$(STATIC_OBJDIR)
|
||||
|
||||
$(BPF_HELPER_DEFS): $(srctree)/tools/include/uapi/linux/bpf.h
|
Reference in New Issue
Block a user