[ciqlts8_6] Patches for CVE-2022-23222

[thefossguy-ciq]

• Commit Message Requirements
• Built against Vault/LTS Environment
• kABI Check Passed, where Valid (Pre 9.4 RT does not have kABI stability)
• Boot Test
• Kernel SelfTest results
• Additional Tests as determined relevant

Kernel build logs

Kselftests

$ grep '^ok ' logs/kselftest/before.log | wc -l && grep '^ok ' logs/kselftest/after.log | wc -l

$ grep '^not ok ' logs/kselftest/before.log | wc -l && grep '^not ok ' logs/kselftest/after.log | wc -l

[thefossguy-ciq]

First push with a build, pushed so I have a history before a rebase (if any). Will fill in the fields once I have the logs.

[bmastbergen]

Your first five commits are part of what was originally a nine commit series:

bpf: Introduce composable reg, ret and arg types.
bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
bpf: Replace RET_XXX_OR_NULL with RET_XXX | PTR_MAYBE_NULL
bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL
bpf: Introduce MEM_RDONLY flag
bpf: Convert PTR_TO_MEM_OR_NULL to composable types.
bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM.
bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.
bpf/selftests: Test PTR_TO_RDONLY_MEM

Your other three commits were part of a backport to 5.15

Daniel Borkmann (4):
  bpf: Generalize check_ctx_reg for reuse with other types
  bpf: Generally fix helper register offset check
  bpf: Fix out of bounds access for ringbuf helpers
  bpf: Fix ringbuf memory type confusion when passing to helpers

Kumar Kartikeya Dwivedi (1):
  bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support

If you look at the commit history for fips-8-compliant/4.18.0-553.16.1 you'll see RH came up with something pretty close to the commit list above. They didn't backport the selftest from the first series or bpf: Extend kfunc with PTR_TO_CTX, ... from the second, and they included an additional fix bpf: Fix crash due to out of.... which i believe they did because of how it was backported out of sequence as mentioned in the 5.15 backport message I linked above.

brett@iconium ~/ciq/kernel-src-tree
 % git log --oneline origin/fips-8-compliant/4.18.0-553.16.1 | less
...
...
...
b5da9a8d1493e bpf: Mark PTR_TO_FUNC register initially with zero offset
106133a2db52f bpf: Fix out of bounds access for ringbuf helpers
24526f20cc888 bpf: Generally fix helper register offset check
92a2f9e9a1ae5 bpf: Generalize check_ctx_reg for reuse with other types
eb88e636998a4 bpf: Check PTR_TO_MEM | MEM_RDONLY in check_helper_mem_access
6d45992c4b715 bpf: Fix crash due to out of bounds access into reg2btf_ids.
e3a3fdc2cfeec bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.
4c9baa7ca4d23 bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM.
44a7c509e6b17 bpf: Convert PTR_TO_MEM_OR_NULL to composable types.
8dedef7f02ace bpf: Introduce MEM_RDONLY flag
98e752a512d76 bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL
faec44fe0f775 bpf: Replace RET_XXX_OR_NULL with RET_XXX | PTR_MAYBE_NULL
e8981445f9a53 bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
fe73f4bc875c4 bpf: Introduce composable reg, ret and arg types.
...
...
...

I think I'd be tempted to do it just like above. Interestingly the commit history there marks 98e752a512d76 bpf: Replace PTR_TO_XXX_OR_NULL with... as the fix for CVE-2022-23222, but that doesn't seem right. You'd also be picking up the fixes for CVE-2021-4204 and CVE-2022-0500 with all the commits above FWIW. If you look at the commit history for fips-8-compliant/4.18.0-553.16.1 you'll see that they pretty much all had conflicts while we tried to auto apply them, so unfortunately you won't get to cherry-pick their conflict resolution. My guess is its pretty close to what you've already done with the 8 you have though.

Just my .02

[thefossguy-ciq]

Yeah, I spent yesterday trying to find my way out of at least one patch and came to the same conclusion as you. Only thing remaining now is to properly backport patches. They were done out of order and I don't trust git-rebase on such an old tree with merge conflicts.