diff --git a/patches.suse/IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-error.patch b/patches.suse/IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-error.patch index 8b4b875..0583d5b 100644 --- a/patches.suse/IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-error.patch +++ b/patches.suse/IB-hfi1-Fix-sdma.h-tx-num_descs-off-by-one-error.patch @@ -4,7 +4,7 @@ Date: Thu, 1 Feb 2024 09:10:08 +0100 Subject: [PATCH 1/1] IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Git-commit: e6f57c6881916df39db7d95981a8ad2b9c3458d6 Patch-mainline: v6.8 or v6.8-rc6 (next release) -References: git-fixes +References: git-fixes bsc#1222726 CVE-2024-26766 Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes diff --git a/patches.suse/RDMA-cm-add-timeout-to-cm_destroy_id-wait.patch b/patches.suse/RDMA-cm-add-timeout-to-cm_destroy_id-wait.patch new file mode 100644 index 0000000..63dbbf2 --- /dev/null +++ b/patches.suse/RDMA-cm-add-timeout-to-cm_destroy_id-wait.patch @@ -0,0 +1,101 @@ +From 96d9cbe2f2ff7abde021bac75eafaceabe9a51fa Mon Sep 17 00:00:00 2001 +From: Manjunath Patil +Date: Fri, 8 Mar 2024 22:33:23 -0800 +Subject: [PATCH 1/1] RDMA/cm: add timeout to cm_destroy_id wait +Git-commit: 96d9cbe2f2ff7abde021bac75eafaceabe9a51fa +Patch-mainline: v6.9-rc1 +References: git-fixes + +Add timeout to cm_destroy_id, so that userspace can trigger any data +collection that would help in analyzing the cause of delay in destroying +the cm_id. + +New noinline function helps dtrace/ebpf programs to hook on to it. +Existing functionality isn't changed except triggering a probe-able new +function at every timeout interval. + +We have seen cases where CM messages stuck with MAD layer (either due to +software bug or faulty HCA), leading to cm_id getting stuck in the +following call stack. This patch helps in resolving such issues faster. + +kernel: ... INFO: task XXXX:56778 blocked for more than 120 seconds. +... + Call Trace: + __schedule+0x2bc/0x895 + schedule+0x36/0x7c + schedule_timeout+0x1f6/0x31f + ? __slab_free+0x19c/0x2ba + wait_for_completion+0x12b/0x18a + ? wake_up_q+0x80/0x73 + cm_destroy_id+0x345/0x610 [ib_cm] + ib_destroy_cm_id+0x10/0x20 [ib_cm] + rdma_destroy_id+0xa8/0x300 [rdma_cm] + ucma_destroy_id+0x13e/0x190 [rdma_ucm] + ucma_write+0xe0/0x160 [rdma_ucm] + __vfs_write+0x3a/0x16d + vfs_write+0xb2/0x1a1 + ? syscall_trace_enter+0x1ce/0x2b8 + SyS_write+0x5c/0xd3 + do_syscall_64+0x79/0x1b9 + entry_SYSCALL_64_after_hwframe+0x16d/0x0 + +Signed-off-by: Manjunath Patil +Link: https://lore.kernel.org/r/20240309063323.458102-1-manjunath.b.patil@oracle.com +Signed-off-by: Leon Romanovsky +Acked-by: Nicolas Morey +--- + drivers/infiniband/core/cm.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index ff58058aeadc..bf0df6ee4f78 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -34,6 +34,7 @@ MODULE_AUTHOR("Sean Hefty"); + MODULE_DESCRIPTION("InfiniBand CM"); + MODULE_LICENSE("Dual BSD/GPL"); + ++#define CM_DESTROY_ID_WAIT_TIMEOUT 10000 /* msecs */ + static const char * const ibcm_rej_reason_strs[] = { + [IB_CM_REJ_NO_QP] = "no QP", + [IB_CM_REJ_NO_EEC] = "no EEC", +@@ -1025,10 +1026,20 @@ static void cm_reset_to_idle(struct cm_id_private *cm_id_priv) + } + } + ++static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id) ++{ ++ struct cm_id_private *cm_id_priv; ++ ++ cm_id_priv = container_of(cm_id, struct cm_id_private, id); ++ pr_err("%s: cm_id=%p timed out. state=%d refcnt=%d\n", __func__, ++ cm_id, cm_id->state, refcount_read(&cm_id_priv->refcount)); ++} ++ + static void cm_destroy_id(struct ib_cm_id *cm_id, int err) + { + struct cm_id_private *cm_id_priv; + struct cm_work *work; ++ int ret; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); + spin_lock_irq(&cm_id_priv->lock); +@@ -1135,7 +1146,14 @@ retest: + + xa_erase(&cm.local_id_table, cm_local_id(cm_id->local_id)); + cm_deref_id(cm_id_priv); +- wait_for_completion(&cm_id_priv->comp); ++ do { ++ ret = wait_for_completion_timeout(&cm_id_priv->comp, ++ msecs_to_jiffies( ++ CM_DESTROY_ID_WAIT_TIMEOUT)); ++ if (!ret) /* timeout happened */ ++ cm_destroy_id_wait_timeout(cm_id); ++ } while (!ret); ++ + while ((work = cm_dequeue_work(cm_id_priv)) != NULL) + cm_free_work(work); + +-- +2.44.0.1.gd14cf580c85d + diff --git a/patches.suse/RDMA-qedr-Fix-qedr_create_user_qp-error-flow.patch b/patches.suse/RDMA-qedr-Fix-qedr_create_user_qp-error-flow.patch index a15e103..f6e6dd5 100644 --- a/patches.suse/RDMA-qedr-Fix-qedr_create_user_qp-error-flow.patch +++ b/patches.suse/RDMA-qedr-Fix-qedr_create_user_qp-error-flow.patch @@ -4,7 +4,7 @@ Date: Thu, 8 Feb 2024 17:36:28 -0500 Subject: [PATCH 1/1] RDMA/qedr: Fix qedr_create_user_qp error flow Git-commit: 5ba4e6d5863c53e937f49932dee0ecb004c65928 Patch-mainline: v6.8 or v6.8-rc6 (next release) -References: git-fixes +References: git-fixes bsc#1222677 CVE-2024-26743 Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail. diff --git a/patches.suse/RDMA-srpt-Support-specifying-the-srpt_service_guid-p.patch b/patches.suse/RDMA-srpt-Support-specifying-the-srpt_service_guid-p.patch index 71f56f6..6afacd0 100644 --- a/patches.suse/RDMA-srpt-Support-specifying-the-srpt_service_guid-p.patch +++ b/patches.suse/RDMA-srpt-Support-specifying-the-srpt_service_guid-p.patch @@ -5,7 +5,7 @@ Subject: [PATCH 1/1] RDMA/srpt: Support specifying the srpt_service_guid parameter Git-commit: fdfa083549de5d50ebf7f6811f33757781e838c0 Patch-mainline: v6.8 or v6.8-rc6 (next release) -References: git-fixes +References: git-fixes bsc#1222449 CVE-2024-26744 Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module diff --git a/patches.suse/netlink-Fix-kernel-infoleak-after-free-in-__skb_data.patch b/patches.suse/netlink-Fix-kernel-infoleak-after-free-in-__skb_data.patch new file mode 100644 index 0000000..e701265 --- /dev/null +++ b/patches.suse/netlink-Fix-kernel-infoleak-after-free-in-__skb_data.patch @@ -0,0 +1,134 @@ +From 46937652f4f6941841e3e671ceb8c4e2552aa700 Mon Sep 17 00:00:00 2001 +From: Ryosuke Yasuoka +Date: Wed, 21 Feb 2024 16:40:48 +0900 +Subject: [PATCH] netlink: Fix kernel-infoleak-after-free in + __skb_datagram_iter +Git-commit: 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd +Patch-mainline: 6.8-rc7 +References: bsc#1222630 CVE-2024-26805 + +syzbot reported the following uninit-value access issue [1]: + +netlink_to_full_skb() creates a new `skb` and puts the `skb->data` +passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data +size is specified as `len` and passed to skb_put_data(). This `len` +is based on `skb->end` that is not data offset but buffer offset. The +`skb->end` contains data and tailroom. Since the tailroom is not +initialized when the new `skb` created, KMSAN detects uninitialized +memory area when copying the data. + +This patch resolved this issue by correct the len from `skb->end` to +`skb->len`, which is the actual data offset. + +BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] +BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] +BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] +BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] +BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] +BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 + instrument_copy_to_user include/linux/instrumented.h:114 [inline] + copy_to_user_iter lib/iov_iter.c:24 [inline] + iterate_ubuf include/linux/iov_iter.h:29 [inline] + iterate_and_advance2 include/linux/iov_iter.h:245 [inline] + iterate_and_advance include/linux/iov_iter.h:271 [inline] + _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 + copy_to_iter include/linux/uio.h:197 [inline] + simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 + __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 + skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 + skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] + packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 + sock_recvmsg_nosec net/socket.c:1044 [inline] + sock_recvmsg net/socket.c:1066 [inline] + sock_read_iter+0x467/0x580 net/socket.c:1136 + call_read_iter include/linux/fs.h:2014 [inline] + new_sync_read fs/read_write.c:389 [inline] + vfs_read+0x8f6/0xe00 fs/read_write.c:470 + ksys_read+0x20f/0x4c0 fs/read_write.c:613 + __do_sys_read fs/read_write.c:623 [inline] + __se_sys_read fs/read_write.c:621 [inline] + __x64_sys_read+0x93/0xd0 fs/read_write.c:621 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Uninit was stored to memory at: + skb_put_data include/linux/skbuff.h:2622 [inline] + netlink_to_full_skb net/netlink/af_netlink.c:181 [inline] + __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline] + __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325 + netlink_deliver_tap net/netlink/af_netlink.c:338 [inline] + netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline] + netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] + netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368 + netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg net/socket.c:745 [inline] + ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 + ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 + __sys_sendmsg net/socket.c:2667 [inline] + __do_sys_sendmsg net/socket.c:2676 [inline] + __se_sys_sendmsg net/socket.c:2674 [inline] + __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Uninit was created at: + free_pages_prepare mm/page_alloc.c:1087 [inline] + free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347 + free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533 + release_pages+0x23d3/0x2410 mm/swap.c:1042 + free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316 + tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] + tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] + tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300 + tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392 + exit_mmap+0x49e/0xd30 mm/mmap.c:3321 + __mmput+0x13f/0x530 kernel/fork.c:1349 + mmput+0x8a/0xa0 kernel/fork.c:1371 + exit_mm+0x1b8/0x360 kernel/exit.c:567 + do_exit+0xd57/0x4080 kernel/exit.c:858 + do_group_exit+0x2fd/0x390 kernel/exit.c:1021 + __do_sys_exit_group kernel/exit.c:1032 [inline] + __se_sys_exit_group kernel/exit.c:1030 [inline] + __x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Bytes 3852-3903 of 3904 are uninitialized +Memory access of size 3904 starts at ffff88812ea1e000 +Data copied to user address 0000000020003280 + +CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 + +Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps") +Reported-and-tested-by: syzbot+34ad5fab48f7bf510349@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1] +Signed-off-by: Ryosuke Yasuoka +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Denis Kirjanov +--- + net/netlink/af_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index fa8c9e250fda..5a2f8238c482 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -160,7 +160,7 @@ static inline u32 netlink_group_mask(u32 group) + static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb, + gfp_t gfp_mask) + { +- unsigned int len = skb_end_offset(skb); ++ unsigned int len = skb->len; + struct sk_buff *new; + + new = alloc_skb(len, gfp_mask); +-- +2.16.4 + diff --git a/patches.suse/nvmet-fc-avoid-deadlock-on-delete-association-path.patch b/patches.suse/nvmet-fc-avoid-deadlock-on-delete-association-path.patch index 9a22041..f2f09af 100644 --- a/patches.suse/nvmet-fc-avoid-deadlock-on-delete-association-path.patch +++ b/patches.suse/nvmet-fc-avoid-deadlock-on-delete-association-path.patch @@ -3,7 +3,7 @@ Date: Wed, 31 Jan 2024 09:51:10 +0100 Subject: nvmet-fc: avoid deadlock on delete association path Patch-mainline: v6.8-rc3 Git-commit: 710c69dbaccdac312e32931abcb8499c1525d397 -References: git-fixes +References: git-fixes CVE-2024-26769 bsc#1222727 When deleting an association the shutdown path is deadlocking because we try to flush the nvmet_wq nested. Avoid this by deadlock by deferring diff --git a/patches.suse/spi-cadence-qspi-fix-pointer-reference-in-runtime-PM-hooks.patch b/patches.suse/spi-cadence-qspi-fix-pointer-reference-in-runtime-PM-hooks.patch new file mode 100644 index 0000000..62ab156 --- /dev/null +++ b/patches.suse/spi-cadence-qspi-fix-pointer-reference-in-runtime-PM-hooks.patch @@ -0,0 +1,79 @@ +From: =?utf-8?q?Th=C3=A9o_Lebrun_=3Ctheo=2Elebrun=40bootlin=2Ecom=3E?= +Date: Thu, 22 Feb 2024 11:12:29 +0100 +Subject: spi: cadence-qspi: fix pointer reference in runtime PM hooks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Git-commit: 32ce3bb57b6b402de2aec1012511e7ac4e7449dc +Patch-mainline: v6.8-rc7 +References: CVE-2024-26807 bsc#1222801 + +dev_get_drvdata() gets used to acquire the pointer to cqspi and the SPI +controller. Neither embed the other; this lead to memory corruption. + +On a given platform (Mobileye EyeQ5) the memory corruption is hidden +inside cqspi->f_pdata. Also, this uninitialised memory is used as a +mutex (ctlr->bus_lock_mutex) by spi_controller_suspend(). + +Fixes: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Reviewed-by: Dhruva Gole +Signed-off-by: Théo Lebrun +Link: https://msgid.link/r/20240222-cdns-qspi-pm-fix-v4-1-6b6af8bcbf59@bootlin.com +Signed-off-by: Mark Brown +[iivanov: Adapt the fix for SLE15-SP5 without kABI breakage" +Acked-by: Ivan T. Ivanov +--- + drivers/spi/spi-cadence-quadspi.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1446,6 +1446,13 @@ static int cqspi_probe(struct platform_d + master->mem_ops = &cqspi_mem_ops; + master->dev.of_node = pdev->dev.of_node; + ++ /* ++ * hack: Fix bsc#1222801 CVE-2024-26807 ++ * Upstream commit 32ce3bb57b6b402de2aec1012511e7ac4e7449dc ++ * Reuse this unused member to keep SPI host reference ++ */ ++ pdev->mfd_cell = (struct mfd_cell *) master; ++ + cqspi = spi_master_get_devdata(master); + + cqspi->pdev = pdev; +@@ -1592,6 +1599,9 @@ static int cqspi_remove(struct platform_ + { + struct cqspi_st *cqspi = platform_get_drvdata(pdev); + ++ /* hack: Fix bsc#1222801 CVE-2024-26807 */ ++ cqspi->pdev->mfd_cell = NULL; ++ + cqspi_controller_enable(cqspi, 0); + + if (cqspi->rx_chan) +@@ -1609,9 +1619,11 @@ static int cqspi_remove(struct platform_ + static int cqspi_suspend(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); +- struct spi_master *master = dev_get_drvdata(dev); ++ struct spi_master *master; + int ret; + ++ /* hack: Fix bsc#1222801 CVE-2024-26807 */ ++ master = (struct spi_master *) cqspi->pdev->mfd_cell; + ret = spi_master_suspend(master); + cqspi_controller_enable(cqspi, 0); + +@@ -1623,7 +1635,10 @@ static int cqspi_suspend(struct device * + static int cqspi_resume(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); +- struct spi_master *master = dev_get_drvdata(dev); ++ struct spi_master *master; ++ ++ /* hack: Fix bsc#1222801 CVE-2024-26807 */ ++ master = (struct spi_master *) cqspi->pdev->mfd_cell; + + clk_prepare_enable(cqspi->clk); + cqspi_wait_idle(cqspi); diff --git a/series.conf b/series.conf index fe3dbaa..f932d7d 100644 --- a/series.conf +++ b/series.conf @@ -45794,6 +45794,8 @@ patches.suse/usb-dwc3-gadget-Don-t-disconnect-if-not-started.patch patches.suse/usb-gadget-ncm-Avoid-dropping-datagrams-of-properly-.patch patches.suse/mtd-spinand-gigadevice-Fix-the-get-ecc-status-issue.patch + patches.suse/spi-cadence-qspi-fix-pointer-reference-in-runtime-PM-hooks.patch + patches.suse/netlink-Fix-kernel-infoleak-after-free-in-__skb_data.patch patches.suse/lan78xx-enable-auto-speed-configuration-for-LAN7850-.patch patches.suse/net-usb-dm9601-fix-wrong-return-value-in-dm9601_mdio.patch patches.suse/wifi-nl80211-reject-iftype-change-with-mesh-ID-chang.patch @@ -46093,6 +46095,7 @@ patches.suse/RDMA-device-Fix-a-race-between-mad_client-and-cm_cli.patch patches.suse/RDMA-rtrs-clt-Check-strnlen-return-len-in-sysfs-mpat.patch patches.suse/msft-hv-2962-RDMA-mana_ib-Fix-bug-in-creation-of-dma-regions.patch + patches.suse/RDMA-cm-add-timeout-to-cm_destroy_id-wait.patch patches.suse/vdpa-mlx5-Allow-CVQ-size-changes.patch patches.suse/s390-vtime-fix-average-steal-time-calculation.patch patches.suse/arm64-dts-broadcom-bcmbca-bcm4908-drop-invalid-switch-cells.patch