Skip to content

[lts94] Many VULNs 9-10-25 #568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Sep 12, 2025
Merged

[lts94] Many VULNs 9-10-25 #568

merged 2 commits into from
Sep 12, 2025

Conversation

bmastbergen
Copy link
Collaborator

Commits

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

    jira VULN-136693
    cve CVE-2025-38352
    commit-author Oleg Nesterov <[email protected]>
    commit f90fff1e152dedf52b932240ebbd670d83330eca

    ext4: fix double-free of blocks due to wrong extents moved_len

    jira VULN-144688
    cve CVE-2024-26704
    commit-author Baokun Li <[email protected]>
    commit 55583e899a5357308274601364741a83e78d6ac4

Build Log

/home/brett/kernel-src-tree
Running make mrproper...
[TIMER]{MRPROPER}: 12s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686"
Making olddefconfig
--
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
--
  BTF [M] sound/x86/snd-hdmi-lpe-audio.ko
  BTF [M] sound/virtio/virtio_snd.ko
  BTF [M] sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
  BTF [M] virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1107s
Making Modules
  INSTALL /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/arch/x86/crypto/blake2s-x86_64.ko
  INSTALL /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/arch/x86/crypto/blowfish-x86_64.ko
  INSTALL /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/arch/x86/crypto/camellia-aesni-avx2.ko
--
  SIGN    /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/sound/usb/hiface/snd-usb-hiface.ko
  SIGN    /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+/kernel/sound/usb/snd-usb-audio.ko
  DEPMOD  /lib/modules/5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+
[TIMER]{MODULES}: 9s
Making Install
sh ./arch/x86/boot/install.sh 5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+ \
	arch/x86/boot/bzImage System.map "/boot"
[TIMER]{INSTALL}: 123s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+ and Index to 2
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 12s
[TIMER]{BUILD}: 1107s
[TIMER]{MODULES}: 9s
[TIMER]{INSTALL}: 123s
[TIMER]{TOTAL} 1270s
Rebooting in 10 seconds

Testing

selftest-5.14.0-427.42.1.el9_4.94ciq_lts.7.1.x86_64.log

selftest-5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+.log

brett@lycia ~/ciq/many-94-vulns-9-10-25
 % grep ^ok selftest-5.14.0-427.42.1.el9_4.94ciq_lts.7.1.x86_64.log | wc -l
351
brett@lycia ~/ciq/many-94-vulns-9-10-25
 % grep ^ok selftest-5.14.0-bmastbergen_ciqlts9_4_many-vulns-9-10-25-9d72afbb0686+.log | wc -l
351

@bmastbergen
ext4: fix double-free of blocks due to wrong extents moved_len
34084cd 
jira VULN-144688
cve CVE-2024-26704
commit-author Baokun Li <[email protected]>
commit 55583e8

In ext4_move_extents(), moved_len is only updated when all moves are
successfully executed, and only discards orig_inode and donor_inode
preallocations when moved_len is not zero. When the loop fails to exit
after successfully moving some extents, moved_len is not updated and
remains at 0, so it does not discard the preallocations.

If the moved extents overlap with the preallocated extents, the
overlapped extents are freed twice in ext4_mb_release_inode_pa() and
ext4_process_freed_data() (as described in commit 94d7c16 ("ext4:
Fix double-free of blocks with EXT4_IOC_MOVE_EXT")), and bb_free is
incremented twice. Hence when trim is executed, a zero-division bug is
triggered in mb_update_avg_fragment_size() because bb_free is not zero
and bb_fragments is zero.

Therefore, update move_len after each extent move to avoid the issue.

	Reported-by: Wei Chen <[email protected]>
	Reported-by: xingwei lee <[email protected]>
Closes: https://lore.kernel.org/r/CAO4mrferzqBUnCag8R3m2zf897ts9UEuhjFQGPtODT92rYyR2Q@mail.gmail.com
Fixes: fcf6b1b ("ext4: refactor ext4_move_extents code base")
CC:  <[email protected]> # 3.18
	Signed-off-by: Baokun Li <[email protected]>
	Reviewed-by: Jan Kara <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Theodore Ts'o <[email protected]>
(cherry picked from commit 55583e8)
	Signed-off-by: Brett Mastbergen <[email protected]>
@bmastbergen
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posi…
8d3a034 
…x_cpu_timer_del()

jira VULN-136693
cve CVE-2025-38352
commit-author Oleg Nesterov <[email protected]>
commit f90fff1

If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.

	Cc: [email protected]
	Reported-by: Benoît Sevens <[email protected]>
Fixes: 0bdd2ed ("sched: run_posix_cpu_timers: Don't check ->exit_state, use lock_task_sighand()")
	Signed-off-by: Oleg Nesterov <[email protected]>
	Signed-off-by: Linus Torvalds <[email protected]>
(cherry picked from commit f90fff1)
	Signed-off-by: Brett Mastbergen <[email protected]>
PlaidCat
PlaidCat approved these changes Sep 11, 2025
View reviewed changes
Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

kerneltoast
kerneltoast approved these changes Sep 11, 2025
View reviewed changes
Copy link
Collaborator

@kerneltoast kerneltoast left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚢

@bmastbergen bmastbergen merged commit 183d120 into ciqlts9_4 Sep 12, 2025
5 checks passed
@bmastbergen bmastbergen deleted the bmastbergen_ciqlts9_4/many-vulns-9-10-25 branch September 12, 2025 12:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kerneltoast kerneltoast kerneltoast approved these changes

@PlaidCat PlaidCat PlaidCat approved these changes

@shreeya-patel98 shreeya-patel98 shreeya-patel98 approved these changes

@thefossguy-ciq thefossguy-ciq Awaiting requested review from thefossguy-ciq

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@bmastbergen @kerneltoast @PlaidCat @shreeya-patel98