From d343130b5457d3786ee9da722e340da1266eda8e Mon Sep 17 00:00:00 2001 From: Kernel Build Daemon Date: Mar 30 2023 07:24:34 +0000 Subject: Merge branch 'SLE15-SP5-GA' into SLE15-SP5-AZURE --- diff --git a/patches.suse/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch b/patches.suse/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch new file mode 100644 index 0000000..0437d99 --- /dev/null +++ b/patches.suse/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch @@ -0,0 +1,35 @@ +From: Greg Kroah-Hartman +Date: Fri, 20 Jan 2023 11:03:20 +0100 +Subject: prlimit: do_prlimit needs to have a speculation check +Git-commit: 739790605705ddcf18f21782b9c99ad7d53a8c11 +Patch-mainline: v6.2-rc5 +References: bsc#1209256 CVE-2017-5753 + +do_prlimit() adds the user-controlled resource value to a pointer that +will subsequently be dereferenced. In order to help prevent this +codepath from being used as a spectre "gadget" a barrier needs to be +added after checking the range. + +Reported-by: Jordy Zomer +Tested-by: Jordy Zomer +Suggested-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +Acked-by: Michal Koutný +--- + kernel/sys.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/sys.c b/kernel/sys.c +index 5fd54bf0e886..88b31f096fb2 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1442,6 +1442,8 @@ static int do_prlimit(struct task_struct *tsk, unsigned int resource, + + if (resource >= RLIM_NLIMITS) + return -EINVAL; ++ resource = array_index_nospec(resource, RLIM_NLIMITS); ++ + if (new_rlim) { + if (new_rlim->rlim_cur > new_rlim->rlim_max) + return -EINVAL; + diff --git a/series.conf b/series.conf index c926590..3360c85 100644 --- a/series.conf +++ b/series.conf @@ -36875,6 +36875,7 @@ patches.suse/serial-atmel-fix-incorrect-baudrate-setup.patch patches.suse/staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch patches.suse/driver-core-Fix-test_async_probe_init-saves-device-i.patch + patches.suse/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch patches.suse/comedi-adv_pci1760-Fix-PWM-instruction-handling.patch patches.suse/w1-fix-deadloop-in-__w1_remove_master_device.patch patches.suse/w1-fix-WARNING-after-calling-w1_process.patch