Skip to content

[fips-9] net: tls, update curr on splice as well - #332

Merged
bmastbergen merged 1 commit into
fips-9-compliant/5.14.0-284.30.1from
bmastbergen_fips-9-compliant/5.14.0-284.30.1/VULN-8917
Jun 17, 2025
Merged

[fips-9] net: tls, update curr on splice as well#332
bmastbergen merged 1 commit into
fips-9-compliant/5.14.0-284.30.1from
bmastbergen_fips-9-compliant/5.14.0-284.30.1/VULN-8917

Conversation

@bmastbergen

@bmastbergenbmastbergen commented Jun 10, 2025

Copy link
Copy Markdown
Collaborator

jira VULN-8917
cve CVE-2024-0646

Same as #317

commit-author John Fastabend <john.fastabend@gmail.com> commit c5a595000e2677e865a39f249c056bc05d6e55fd
upstream-diff used linux-stable LT-5.15 sha ba5efd8544fa62ae85daeb36077468bf2ce974ab
commit c5a595000e2677e865a39f249c056bc05d6e55fd upstream.
The curr pointer must also be updated on the splice similar to how we do this for other copy types.
Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Reported-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20231206232706.374377-2-john.fastabend@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ba5efd8544fa62ae85daeb36077468bf2ce974ab)
Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>

Build Log

/home/brett/kernel-src-tree
CLEAN arch/x86/tools
CLEAN scripts/basic
CLEAN scripts/kconfig
CLEAN include/config include/generated arch/x86/include/generated .config .config.old
[TIMER]{MRPROPER}: 12s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29"
Making olddefconfig
--
HOSTCC scripts/kconfig/util.o
HOSTLD scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
SYSHDR arch/x86/include/generated/uapi/asm/unistd_32.h
SYSHDR arch/x86/include/generated/uapi/asm/unistd_64.h
SYSHDR arch/x86/include/generated/uapi/asm/unistd_x32.h
SYSTBL arch/x86/include/generated/asm/syscalls_32.h
SYSHDR arch/x86/include/generated/asm/unistd_32_ia32.h
--
BTF [M] sound/x86/snd-hdmi-lpe-audio.ko
LD [M] sound/xen/snd_xen_front.ko
LD [M] virt/lib/irqbypass.ko
BTF [M] virt/lib/irqbypass.ko
BTF [M] sound/xen/snd_xen_front.ko
[TIMER]{BUILD}: 919s
Making Modules
INSTALL /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/arch/x86/crypto/blake2s-x86_64.ko
INSTALL /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko
INSTALL /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/arch/x86/crypto/blowfish-x86_64.ko
INSTALL /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/arch/x86/crypto/camellia-x86_64.ko
--
SIGN /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/sound/usb/snd-usb-audio.ko
SIGN /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/sound/usb/usx2y/snd-usb-usx2y.ko
SIGN /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/virt/lib/irqbypass.ko
SIGN /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+/kernel/sound/xen/snd_xen_front.ko
DEPMOD /lib/modules/5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+
[TIMER]{MODULES}: 7s
Making Install
sh ./arch/x86/boot/install.sh \
5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+ arch/x86/boot/bzImage \
System.map "/boot"
[TIMER]{INSTALL}: 56s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+ and Index to 2
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 12s
[TIMER]{BUILD}: 919s
[TIMER]{MODULES}: 7s
[TIMER]{INSTALL}: 56s
[TIMER]{TOTAL} 1013s
Rebooting in 10 seconds

Testing

kselftests were run before and after applying the fix

selftest-5.14.0-284.30.1.el9_2.ciqfips.0.12.3.x86_64.log

selftest-5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+.log

brett@lycia ~/ciq/vuln-8917 % grep ^ok selftest-5.14.0-284.30.1.el9_2.ciqfips.0.12.3.x86_64.log | wc -l
331
brett@lycia ~/ciq/vuln-8917 % grep ^ok selftest-5.14.0-b_f-9-c_5.14.0-284.30.1_VULN-8917-9c20d49bed29+.log | wc -l
335
brett@lycia ~/ciq/vuln-8917 %

@bmastbergen
net: tls, update curr on splice as well
9c20d49
jira VULN-8917
cve CVE-2024-0646
commit-author John Fastabend <john.fastabend@gmail.com>
commit c5a5950
upstream-diff used linux-stable LT-5.15 sha ba5efd8
commit c5a5950 upstream.
The curr pointer must also be updated on the splice similar to how
we do this for other copy types.
Fixes: d829e9c ("tls: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Reported-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20231206232706.374377-2-john.fastabend@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ba5efd8)
Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
thefossguy-ciq
thefossguy-ciq approved these changes Jun 11, 2025
View reviewed changes

@thefossguy-ciqthefossguy-ciq left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚤

PlaidCat
PlaidCat approved these changes Jun 17, 2025
View reviewed changes

@PlaidCatPlaidCat left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@bmastbergen
bmastbergen merged commit 15019b0 into fips-9-compliant/5.14.0-284.30.1Jun 17, 2025
@bmastbergen
bmastbergen deleted the bmastbergen_fips-9-compliant/5.14.0-284.30.1/VULN-8917 branch June 17, 2025 13:34
github-actionsBot pushed a commit that referenced this pull request Aug 21, 2026
@borkmann@kkdwvd
selftests/bpf: Add tests for fault prone loads out of RCU pointers
2b918fe
Cover the two loads which used to lose the BPF_PROBE_MEM rewrite, both reached
from an RCU read-side critical section. The purpose of this patch is to assert
load success in order to make sure to not trigger verifier_bug_if() on
bpf_may_fault_on_deref() due to forgotten rewrite of a probed pointer.
# LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t rcu_read_lock
[...]
#332/1 rcu_read_lock/success:OK
#332/2 rcu_read_lock/rcuptr_acquire:OK
#332/3 rcu_read_lock/negative_tests_inproper_region:OK
#332/4 rcu_read_lock/negative_tests_rcuptr_misuse:OK
#332 rcu_read_lock:OK
Summary: 1/4 PASSED, 0 SKIPPED, 0/0 FAILED
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260817141015.878071-2-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PlaidCatPlaidCatPlaidCat approved these changes
@thefossguy-ciqthefossguy-ciqthefossguy-ciq approved these changes
@kerneltoastkerneltoastAwaiting requested review from kerneltoast
@jainanmol84jainanmol84Awaiting requested review from jainanmol84

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bmastbergen@PlaidCat@thefossguy-ciq