[ciqlts8 6] Easy(sh) vulns

[roxanan1996]

DESCRIPTION

These are commits that were pretty easy to backport.
Some were applied cleanly, some required only a prereq.
The last one had to be manually fix since the context is slightly changed due
to internal red hat kabi fix.
Otherwise, it should be straightforward to review.

Notes

1. After a discussion with Maple, I should send separate pull requests for each CVE if possible, or at least split them based on the subsystem. But that's for the future, I'll keep this one as it is.
2. Please check below the explanation about interdiff differences.

COMMITS

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

jira VULN-152932
cve CVE-2025-39757
commit-author Takashi Iwai <[email protected]>
commit ecfd41166b72b67d3bdeb88d224ff445f6163869

ALSA: usb-audio: Fix size validation in convert_chmap_v3()

jira VULN-152932
cve-bf CVE-2025-39757
commit-author Dan Carpenter <[email protected]>
commit 89f0addeee3cb2dc49837599330ed9c4612f05b0

net: sched: delete duplicate cleanup of backlog and qlen

jira VULN-155239
cve-pre CVE-2022-50356
commit-author Zhengchao Shao <[email protected]>
commit c19d893fbf3f2f8fa864ae39652c7fee939edde2

net: sched: sfb: fix null pointer access issue when sfb_init() fails

jira VULN-155239
cve CVE-2022-50356
commit-author Zhengchao Shao <[email protected]>
commit 2a3fc78210b9f0e85372a2435368962009f480fc

scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()

jira VULN-70476
cve-pre CVE-2022-50030
commit-author Dan Carpenter <[email protected]>
commit 9020be114a47bf7ff33e179b3bb0016b91a098e6

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

jira VULN-70476
cve CVE-2022-50030
commit-author James Smart <[email protected]>
commit f8191d40aa612981ce897e66cda6a88db8df17bb

fs: fix UAF/GPF bug in nilfs_mdt_destroy

jira VULN-155283
cve CVE-2022-50367
commit-author Dongliang Mu <[email protected]>
commit 2e488f13755ffbb60f307e991b27024716a33b29
upstream-diff |
	Adjusted context in inode_init_always to due rh specific variable
	rh_reserved2 being initialized to 0 added in commit:
	dbb05b7432a1f9 ("Rebuild centos8 with kernel-4.18.0-80.el8")

TESTING

BUILD

> grep -E -B 5 -A 5 '\[TIMER\]|^Starting Build' /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-build-after.log
/home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-src-tree
Running make mrproper...
[TIMER]{MRPROPER}: 13s
x86_64 architecture detected, copying config
'configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2"
Making olddefconfig
--
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
--
  LD [M]  sound/usb/usx2y/snd-usb-usx2y.ko
  LD [M]  sound/virtio/virtio_snd.ko
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
[TIMER]{BUILD}: 2633s
Making Modules
  INSTALL arch/x86/crypto/blowfish-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx2.ko
  INSTALL arch/x86/crypto/camellia-x86_64.ko
--
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+
[TIMER]{MODULES}: 10s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 31s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+ and Index to 2
The default is /boot/loader/entries/d9e0711368554fce865850e4faca8049-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+.conf with index 2 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+
The default is /boot/loader/entries/d9e0711368554fce865850e4faca8049-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+.conf with index 2 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+
Generating grub configuration file ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 13s
[TIMER]{BUILD}: 2633s
[TIMER]{MODULES}: 10s
[TIMER]{INSTALL}: 31s
[TIMER]{TOTAL} 2696s
Rebooting in 10 seconds

Kselftests

> /home/rnicolescu/ciq/kernel-tools/kselftest-diff.sh /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns
./kselftest-before.log
212
./kselftest-after.log
212
Before: ./kselftest-before.log
After: ./kselftest-after.log
Diff:
No differences found.

Check_kernel_commits

> python3 /home/rnicolescu/ciq/kernel-src-tree-tools/check_kernel_commits.py --repo /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-src-tree --pr_branch {rnicolescu}_ciqlts8_6_easy_vulns --base_branch origin/ciqlts8_6 --check-cves
All referenced commits exist upstream and have no Fixes: tags.

Run jira_pr_check

> python3 /home/rnicolescu/ciq/kernel-src-tree-tools/jira_pr_check.py --kernel-src-tree /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-src-tree --merge-target {rnicolescu}_ciqlts8_6_easy_vulns --pr-branch origin/ciqlts8_6

## JIRA PR Check Results

✅ **No issues found!**


---
**Summary:** Checked 0 commit(s) total.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit fad75018ba11 (ALSA: usb-audio: Validate UAC3 cluster segment descriptors) → upstream ecfd41166b72
  Differences found:

diff -u b/sound/usb/stream.c b/sound/usb/stream.c
--- b/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -355,6 +360,9 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h
@@ -360,6 +365,9 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h

• ⚠️ PR commit 4ea57db54a1d (ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()) → upstream 94c1ceb043c1
  Differences found:

diff -u b/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
--- b/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -543,4 +543,4 @@
 		len += scnprintf(msg + len, sizeof(msg) - len, " 0x%x", value);
 	}
 
-	dev_printk(level, sdev->dev, "extended rom status: %s", msg);
+	dev_err(sdev->dev, "extended rom status: %s", msg);

• ⚠️ PR commit a3868bcfb11b (fs: fix UAF/GPF bug in nilfs_mdt_destroy) → upstream 2e488f13755f
  Differences found:

diff -u b/fs/inode.c b/fs/inode.c
--- b/fs/inode.c
+++ b/fs/inode.c
@@ -165,5 +165,5 @@
-	inode->i_wb_frn_history = 0;
-#endif
+
+	inode->rh_reserved2 = 0;
 
 	spin_lock_init(&inode->i_lock);
 	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);

This is an automated interdiff check for backported commits.

[roxanan1996]

🔍 Interdiff Analysis

* ⚠️ PR commit `fad75018ba11 (ALSA: usb-audio: Validate UAC3 cluster segment descriptors)` → upstream `ecfd41166b72`
  **Differences found:**

diff -u b/sound/usb/stream.c b/sound/usb/stream.c
--- b/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -355,6 +360,9 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h
@@ -360,6 +365,9 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h

This is a bug in interdiff, the patch looks fine. Check colordiff log
colordiff.log
Colordiff checks the whole function context, you may see a small diff because commit
6aa8700 ("ALSA: usb-audio: Support multiple control interfaces")
was not backported. But it should not be, since it's a new feature and not relevant for this CVE fix.

* ⚠️ PR commit `4ea57db54a1d (ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf())` → upstream `94c1ceb043c1`
  **Differences found:**

diff -u b/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
--- b/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -543,4 +543,4 @@
 		len += scnprintf(msg + len, sizeof(msg) - len, " 0x%x", value);
 	}
 
-	dev_printk(level, sdev->dev, "extended rom status: %s", msg);
+	dev_err(sdev->dev, "extended rom status: %s", msg);

This is due to missing commit 34bfba9 ("ASoC: SOF: Intel: hda: Use DEBUG log level for optional prints").
Not relevant here

* ⚠️ PR commit `a3868bcfb11b (fs: fix UAF/GPF bug in nilfs_mdt_destroy)` → upstream `2e488f13755f`
  **Differences found:**

diff -u b/fs/inode.c b/fs/inode.c
--- b/fs/inode.c
+++ b/fs/inode.c
@@ -165,5 +165,5 @@
-	inode->i_wb_frn_history = 0;
-#endif
+
+	inode->rh_reserved2 = 0;
 
 	spin_lock_init(&inode->i_lock);
 	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);

This is expected since inode->rh_reserved2 = 0 is red hat specific.

This is an automated interdiff check for backported commits.

[bmastbergen]

🥌

[PlaidCat]

Please Revert and manually deal with the changes for cve-2022-50087
30254c3 firmware: arm_scpi: convert platform driver to use dev_groups

We can't take this change in the event that some actually uses this driver.
this is a part of a larger change set that actually implements in another place the code that is referenced being dropped
We need this commit to take this change
torvalds/linux@23b6904

which is a part of a larger fix up
https://lore.kernel.org/all/[email protected]/t/#u

[roxanan1996]

Please Revert and manually deal with the changes for cve-2022-50087 30254c3 firmware: arm_scpi: convert platform driver to use dev_groups

We can't take this change in the event that some actually uses this driver. this is a part of a larger change set that actually implements in another place the code that is referenced being dropped We need this commit to take this change torvalds/linux@23b6904

which is a part of a larger fix up https://lore.kernel.org/all/[email protected]/t/#u

I thought I checked that. Great catch.
I removed it from this merge request.

I did the same for "ASoC: SOF: Intel: hda: Define rom_status_reg in sof_intel_dsp_desc" as the prereq is patch from a bigger patchset.
Will address these in separate merge requests.
Thanks!

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit e281493e2f0a (ALSA: usb-audio: Validate UAC3 cluster segment descriptors) → upstream ecfd41166b72
  Differences found:

diff -u b/sound/usb/stream.c b/sound/usb/stream.c
--- b/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -355,6 +360,9 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h
@@ -360,6 +365,9 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h

• ⚠️ PR commit db64e8eb9ad1 (fs: fix UAF/GPF bug in nilfs_mdt_destroy) → upstream 2e488f13755f
  Differences found:

diff -u b/fs/inode.c b/fs/inode.c
--- b/fs/inode.c
+++ b/fs/inode.c
@@ -165,5 +165,5 @@
-	inode->i_wb_frn_history = 0;
-#endif
+
+	inode->rh_reserved2 = 0;
 
 	spin_lock_init(&inode->i_lock);
 	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);

This is an automated interdiff check for backported commits.