[LTS 9.4] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

[pvts-mat]

[LTS 9.4]
CVE-2025-21785
VULN-54131

Problem

https://www.cve.org/CVERecord?id=CVE-2025-21785

In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).

Solution

The official fix in the mainline kernel is provided in the 875d742 commit

arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
The loop that detects/populates cache information already has a bounds
check on the array size but does not account for cache levels with
separate data/instructions cache. Fix this by incrementing the index
for any populated leaf (instead of any populated level).

The 5.15 backport (closest to ciqlts9_4 kernel version 5.14) is provided in the 88a3e6afaf002250220793df99404977d343db14 commit, and it has no differences compared to the mainline solution.

kABI check: passed

DEBUG=1 CVE=CVE-2025-21785 ./ninja.sh _kabi_checked__aarch64--test--ciqlts9_4-CVE-2025-21785
ninja: Entering directory `/data/build/rocky-patching'
[0/1] Check ABI of kernel [ciqlts9_4-CVE-2025-21785]
++ uname -m
+ python3 /home/pvts/ctrliq-github/kernel-dist-git-el-9.4/SOURCES/check-kabi -k /home/pvts/ctrliq-github/kernel-dist-git-el-9.4/SOURCES/Module.kabi_aarch64 -s vms/aarch64--build--ciqlts9_4/build_files/kernel-src-tree-ciqlts9_4-CVE-2025-21785/Module.symvers
kABI check passed
+ touch state/kernels/ciqlts9_4-CVE-2025-21785/aarch64/kabi_checked

(The el-9.4 branch was missing from https://github.com/ciq-rocky-lts/kernel, it was added by hand on the imports/r9/kernel-5.14.0-427.42.1.el9_4 tag from the added https://git.rockylinux.org/staging/rpms/kernel.git repo)

Boot test: passed

boot-test.log

Kselftests: passed relative

Methodology

The tests were run using the rocky-patching framework (qemu-kvm virtualization of Rocky base cloud aarch64 images) ported to the local WHLE-LS1046A machine, based on the NXP Layerscape LS1046A arm64 processor.

• kernel-selftests-internal package:bpf tests.
• source-compiled selftests: (commit f794e72) all the rest.

Some specific tests were excluded, see below.

Coverage

bpf (except test_progs-no_alu32, test_progs, test_xsk.sh, test_kmod.sh, test_sockmap), breakpoints, capabilities, clone3, cpu-hotplug, cpufreq, drivers/dma-buf, drivers/net/bonding, drivers/net/team, efivarfs, exec, filesystems/binderfs, filesystems/epoll, firmware, fpu, ftrace, futex, gpio, hid, intel_pstate, iommu, ipc, ir, kcmp, kvm, landlock, lib, livepatch, membarrier, memfd, memory-hotplug, mincore, mount, mqueue, nci, net/forwarding (except sch_tbf_prio.sh, sch_ets.sh, tc_actions.sh, sch_red.sh, dual_vxlan_bridge.sh, sch_tbf_ets.sh, tc_police.sh, sch_tbf_root.sh, ipip_hier_gre_keys.sh), net/hsr, net/mptcp (except simult_flows.sh), net (except ip_defrag.sh, gro.sh, udpgso_bench.sh, xfrm_policy.sh, reuseport_addr_any.sh, txtimestamp.sh, reuseaddr_conflict), netfilter (except nft_trans_stress.sh), nsfs, pid_namespace, pidfd, proc (except proc-pid-vm), pstore, ptrace, rlimits, rseq, seccomp, sgx, sigaltstack, size, splice, static_keys, sync, syscall_user_dispatch, sysctl, tc-testing, tdx, timens, timers, tmpfs, tpm2, tty, user, vDSO, zram.

Reference

kselftests–ciqlts9_4–run1.log
kselftests–ciqlts9_4–run2.log
kselftests–ciqlts9_4–run3.log

Patch

kselftests–ciqlts9_4-CVE-2025-21785–run1.log

Comparison

Column File
-------- ----------------------------------------------
Status0 kselftests--ciqlts9_4--run1.log
Status1 kselftests--ciqlts9_4--run2.log
Status2 kselftests--ciqlts9_4--run3.log
Status3 kselftests--ciqlts9_4-CVE-2025-21785--run1.log
TestCase Status0 Status1 Status2 Status3 Summary
filesystems/epoll:epoll_wakeup_test pass fail fail fail diff
net/forwarding:mirror_gre_vlan_bridge_1q.sh pass fail pass pass diff
net/forwarding:router_bridge_1d_lag.sh fail pass pass pass diff
net/forwarding:router_bridge_lag.sh pass pass fail pass diff
net/forwarding:vxlan_bridge_1d_ipv6.sh fail pass pass pass diff
net:fib_nexthops.sh pass pass fail pass diff
net:srv6_end_dt46_l3vpn_test.sh fail fail fail pass diff
net:srv6_end_dt4_l3vpn_test.sh pass fail pass fail diff
net:srv6_end_dt6_l3vpn_test.sh fail pass pass pass diff

All differences are contained within the reference kernel tests, except for net:srv6_end_dt46_l3vpn_test.sh which passed in the patched kernel. Many ciqlts9_4 tests reporting inconsistent results, similarly to #256. Added to the kselftests knowledge base https://gitlab.conclusive.pl/devices/rocky-patching/-/blob/master/rocky.yml?ref_type=heads

Specific tests: skipped

To be done on demand

[bmastbergen]

🥌

[thefossguy-ciq]

🚤

[bmastbergen]

🥌

[PlaidCat]