diff --git a/patches.suse/proc-avoid-integer-type-confusion-in-get_proc_long.patch b/patches.suse/proc-avoid-integer-type-confusion-in-get_proc_long.patch new file mode 100644 index 0000000..948a3f1 --- /dev/null +++ b/patches.suse/proc-avoid-integer-type-confusion-in-get_proc_long.patch @@ -0,0 +1,45 @@ +From e6cfaf34be9fcd1a8285a294e18986bfc41a409c Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Mon, 5 Dec 2022 11:33:40 -0800 +Subject: [PATCH] proc: avoid integer type confusion in get_proc_long +Git-commit: e6cfaf34be9fcd1a8285a294e18986bfc41a409c +Patch-mainline: v6.1 +References: CVE-2022-4378 bsc#1206207 + +proc_get_long() is passed a size_t, but then assigns it to an 'int' +variable for the length. Let's not do that, even if our IO paths are +limited to MAX_RW_COUNT (exactly because of these kinds of type errors). + +So do the proper test in the rigth type. + +Reported-by: Kyle Zeng +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + kernel/sysctl.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 188c305aeb8b..8898ddeaaf75 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -342,13 +342,12 @@ static int proc_get_long(char **buf, size_t *size, + unsigned long *val, bool *neg, + const char *perm_tr, unsigned perm_tr_len, char *tr) + { +- int len; + char *p, tmp[TMPBUFLEN]; ++ ssize_t len = *size; + +- if (!*size) ++ if (len <= 0) + return -EINVAL; + +- len = *size; + if (len > TMPBUFLEN - 1) + len = TMPBUFLEN - 1; + +-- +2.35.3 + diff --git a/patches.suse/proc-proc_skip_spaces-shouldn-t-think-it-is-working-.patch b/patches.suse/proc-proc_skip_spaces-shouldn-t-think-it-is-working-.patch new file mode 100644 index 0000000..eec6a30 --- /dev/null +++ b/patches.suse/proc-proc_skip_spaces-shouldn-t-think-it-is-working-.patch @@ -0,0 +1,106 @@ +From bce9332220bd677d83b19d21502776ad555a0e73 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Mon, 5 Dec 2022 12:09:06 -0800 +Subject: [PATCH] proc: proc_skip_spaces() shouldn't think it is working on C strings +Git-commit: bce9332220bd677d83b19d21502776ad555a0e73 +Patch-mainline: v6.1 +References: CVE-2022-4378 bsc#1206207 + +proc_skip_spaces() seems to think it is working on C strings, and ends +up being just a wrapper around skip_spaces() with a really odd calling +convention. + +Instead of basing it on skip_spaces(), it should have looked more like +proc_skip_char(), which really is the exact same function (except it +skips a particular character, rather than whitespace). So use that as +inspiration, odd coding and all. + +Now the calling convention actually makes sense and works for the +intended purpose. + +Reported-and-tested-by: Kyle Zeng +Acked-by: Eric Dumazet +Signed-off-by: Linus Torvalds +Acked-by: Takashi Iwai + +--- + kernel/sysctl.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2169,13 +2169,14 @@ int proc_dostring(struct ctl_table *tabl + (char __user *)buffer, lenp, ppos); + } + +-static size_t proc_skip_spaces(char **buf) ++static void proc_skip_spaces(char **buf, size_t *size) + { +- size_t ret; +- char *tmp = skip_spaces(*buf); +- ret = tmp - *buf; +- *buf = tmp; +- return ret; ++ while (*size) { ++ if (!isspace(**buf)) ++ break; ++ (*size)--; ++ (*buf)++; ++ } + } + + static void proc_skip_char(char **buf, size_t *size, const char v) +@@ -2412,7 +2413,7 @@ static int __do_proc_dointvec(void *tbl_ + bool neg; + + if (write) { +- left -= proc_skip_spaces(&p); ++ proc_skip_spaces(&p, &left); + + if (!left) + break; +@@ -2443,7 +2444,7 @@ static int __do_proc_dointvec(void *tbl_ + if (!write && !first && left && !err) + err = proc_put_char(&buffer, &left, '\n'); + if (write && !err && left) +- left -= proc_skip_spaces(&p); ++ proc_skip_spaces(&p, &left); + if (write) { + kfree(kbuf); + if (first) +@@ -2492,7 +2493,7 @@ static int do_proc_douintvec_w(unsigned + if (IS_ERR(kbuf)) + return -EINVAL; + +- left -= proc_skip_spaces(&p); ++ proc_skip_spaces(&p, &left); + if (!left) { + err = -EINVAL; + goto out_free; +@@ -2512,7 +2513,7 @@ static int do_proc_douintvec_w(unsigned + } + + if (!err && left) +- left -= proc_skip_spaces(&p); ++ proc_skip_spaces(&p, &left); + + out_free: + kfree(kbuf); +@@ -2926,7 +2927,7 @@ static int __do_proc_doulongvec_minmax(v + if (write) { + bool neg; + +- left -= proc_skip_spaces(&p); ++ proc_skip_spaces(&p, &left); + if (!left) + break; + +@@ -2959,7 +2960,7 @@ static int __do_proc_doulongvec_minmax(v + if (!write && !first && left && !err) + err = proc_put_char(&buffer, &left, '\n'); + if (write && !err) +- left -= proc_skip_spaces(&p); ++ proc_skip_spaces(&p, &left); + if (write) { + kfree(kbuf); + if (first) diff --git a/series.conf b/series.conf index ab95eff..588cde2 100644 --- a/series.conf +++ b/series.conf @@ -23314,6 +23314,8 @@ patches.suse/msft-hv-2682-Drivers-hv-vmbus-fix-double-free-in-the-error-path-o.patch patches.suse/msft-hv-2683-Drivers-hv-vmbus-fix-possible-memory-leak-in-vmbus_d.patch patches.suse/drm-i915-fix-TLB-invalidation-for-Gen12-video-and-co.patch + patches.suse/proc-avoid-integer-type-confusion-in-get_proc_long.patch + patches.suse/proc-proc_skip_spaces-shouldn-t-think-it-is-working-.patch ######################################################## # end of sorted patches