[ciqlts8 6] Easy(sh) vulns

[roxanan1996]

DESCRIPTION

These are commits that were pretty easy to backport.
Some were applied cleanly, some required only a prereq.
The last one had to be manually fix since the context is slightly changed due
to internal red hat kabi fix.
Otherwise, it should be straightforward to review.

Notes

1. After a discussion with Maple, I should send separate pull requests for each CVE if possible, or at least split them based on the subsystem. But that's for the future, I'll keep this one as it is.
2. Please check below the explanation about interdiff differences.

COMMITS

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

jira VULN-152932
cve CVE-2025-39757
commit-author Takashi Iwai <tiwai@suse.de>
commit ecfd41166b72b67d3bdeb88d224ff445f6163869

ALSA: usb-audio: Fix size validation in convert_chmap_v3()

jira VULN-152932
cve-bf CVE-2025-39757
commit-author Dan Carpenter <dan.carpenter@linaro.org>
commit 89f0addeee3cb2dc49837599330ed9c4612f05b0

net: sched: delete duplicate cleanup of backlog and qlen

jira VULN-155239
cve-pre CVE-2022-50356
commit-author Zhengchao Shao <shaozhengchao@huawei.com>
commit c19d893fbf3f2f8fa864ae39652c7fee939edde2

net: sched: sfb: fix null pointer access issue when sfb_init() fails

jira VULN-155239
cve CVE-2022-50356
commit-author Zhengchao Shao <shaozhengchao@huawei.com>
commit 2a3fc78210b9f0e85372a2435368962009f480fc

scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()

jira VULN-70476
cve-pre CVE-2022-50030
commit-author Dan Carpenter <dan.carpenter@oracle.com>
commit 9020be114a47bf7ff33e179b3bb0016b91a098e6

scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

jira VULN-70476
cve CVE-2022-50030
commit-author James Smart <jsmart2021@gmail.com>
commit f8191d40aa612981ce897e66cda6a88db8df17bb

ASoC: SOF: Intel: hda: Define rom_status_reg in sof_intel_dsp_desc

jira VULN-70503
cve-pre CVE-2022-50050
commit-author Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
commit 71778f7940f0b496aa1ca1134f3b70b425a59bab

ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()

jira VULN-70503
cve CVE-2022-50050
commit-author Takashi Iwai <tiwai@suse.de>
commit 94c1ceb043c1a002de9649bb630c8e8347645982

firmware: arm_scpi: convert platform driver to use dev_groups

jira VULN-70082
cve-pre CVE-2022-50087
commit-author Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 43b9ac937be6f2afb2f0cf060d40cea365c09d07

firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

jira VULN-70082
cve CVE-2022-50087
commit-author Sudeep Holla <sudeep.holla@arm.com>
commit 689640efc0a2c4e07e6f88affe6d42cd40cc3f85

fs: fix UAF/GPF bug in nilfs_mdt_destroy

jira VULN-155283
cve CVE-2022-50367
commit-author Dongliang Mu <mudongliangabcd@gmail.com>
commit 2e488f13755ffbb60f307e991b27024716a33b29
upstream-diff |
	Adjusted context in inode_init_always to due rh specific variable
	rh_reserved2 being initialized to 0 added in commit:
	dbb05b7432a1f9 ("Rebuild centos8 with kernel-4.18.0-80.el8")

TESTING

BUILD

> grep -E -B 5 -A 5 '\[TIMER\]|^Starting Build' /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-build-after.log
/home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-src-tree
Running make mrproper...
[TIMER]{MRPROPER}: 13s
x86_64 architecture detected, copying config
'configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2"
Making olddefconfig
--
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
--
  LD [M]  sound/usb/usx2y/snd-usb-usx2y.ko
  LD [M]  sound/virtio/virtio_snd.ko
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
[TIMER]{BUILD}: 2633s
Making Modules
  INSTALL arch/x86/crypto/blowfish-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx2.ko
  INSTALL arch/x86/crypto/camellia-x86_64.ko
--
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+
[TIMER]{MODULES}: 10s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 31s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+ and Index to 2
The default is /boot/loader/entries/d9e0711368554fce865850e4faca8049-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+.conf with index 2 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+
The default is /boot/loader/entries/d9e0711368554fce865850e4faca8049-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+.conf with index 2 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6_easy_vulns-a3868bcfb11b2+
Generating grub configuration file ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 13s
[TIMER]{BUILD}: 2633s
[TIMER]{MODULES}: 10s
[TIMER]{INSTALL}: 31s
[TIMER]{TOTAL} 2696s
Rebooting in 10 seconds

Kselftests

> /home/rnicolescu/ciq/kernel-tools/kselftest-diff.sh /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns
./kselftest-before.log
212
./kselftest-after.log
212
Before: ./kselftest-before.log
After: ./kselftest-after.log
Diff:
No differences found.

Check_kernel_commits

> python3 /home/rnicolescu/ciq/kernel-src-tree-tools/check_kernel_commits.py --repo /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-src-tree --pr_branch {rnicolescu}_ciqlts8_6_easy_vulns --base_branch origin/ciqlts8_6 --check-cves
All referenced commits exist upstream and have no Fixes: tags.

Run jira_pr_check

> python3 /home/rnicolescu/ciq/kernel-src-tree-tools/jira_pr_check.py --kernel-src-tree /home/rnicolescu/ciq/kernels/lts-8.6_easy_vulns/kernel-src-tree --merge-target {rnicolescu}_ciqlts8_6_easy_vulns --pr-branch origin/ciqlts8_6

## JIRA PR Check Results

✅ **No issues found!**


---
**Summary:** Checked 0 commit(s) total.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit fad75018ba11 (ALSA: usb-audio: Validate UAC3 cluster segment descriptors) → upstream ecfd41166b72
  Differences found:

diff -u b/sound/usb/stream.c b/sound/usb/stream.c
--- b/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -355,6 +360,9 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h
@@ -360,6 +365,9 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h

• ⚠️ PR commit 4ea57db54a1d (ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()) → upstream 94c1ceb043c1
  Differences found:

diff -u b/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
--- b/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -543,4 +543,4 @@
 		len += scnprintf(msg + len, sizeof(msg) - len, " 0x%x", value);
 	}
 
-	dev_printk(level, sdev->dev, "extended rom status: %s", msg);
+	dev_err(sdev->dev, "extended rom status: %s", msg);

• ⚠️ PR commit a3868bcfb11b (fs: fix UAF/GPF bug in nilfs_mdt_destroy) → upstream 2e488f13755f
  Differences found:

diff -u b/fs/inode.c b/fs/inode.c
--- b/fs/inode.c
+++ b/fs/inode.c
@@ -165,5 +165,5 @@
-	inode->i_wb_frn_history = 0;
-#endif
+
+	inode->rh_reserved2 = 0;
 
 	spin_lock_init(&inode->i_lock);
 	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);

This is an automated interdiff check for backported commits.

[roxanan1996]

🔍 Interdiff Analysis

* ⚠️ PR commit `fad75018ba11 (ALSA: usb-audio: Validate UAC3 cluster segment descriptors)` → upstream `ecfd41166b72`
  **Differences found:**

diff -u b/sound/usb/stream.c b/sound/usb/stream.c
--- b/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -355,6 +360,9 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h
@@ -360,6 +365,9 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			struct uac3_cluster_information_segment_descriptor *is = p;
 			unsigned char map;
 
+			if (cs_len < sizeof(*is))
+				break;
+
 			/*
 			 * TODO: this conversion is not complete, update it
 			 * after adding UAC3 values to asound.h

This is a bug in interdiff, the patch looks fine. Check colordiff log
colordiff.log
Colordiff checks the whole function context, you may see a small diff because commit
6aa8700 ("ALSA: usb-audio: Support multiple control interfaces")
was not backported. But it should not be, since it's a new feature and not relevant for this CVE fix.

* ⚠️ PR commit `4ea57db54a1d (ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf())` → upstream `94c1ceb043c1`
  **Differences found:**

diff -u b/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
--- b/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -543,4 +543,4 @@
 		len += scnprintf(msg + len, sizeof(msg) - len, " 0x%x", value);
 	}
 
-	dev_printk(level, sdev->dev, "extended rom status: %s", msg);
+	dev_err(sdev->dev, "extended rom status: %s", msg);

This is due to missing commit 34bfba9 ("ASoC: SOF: Intel: hda: Use DEBUG log level for optional prints").
Not relevant here

* ⚠️ PR commit `a3868bcfb11b (fs: fix UAF/GPF bug in nilfs_mdt_destroy)` → upstream `2e488f13755f`
  **Differences found:**

diff -u b/fs/inode.c b/fs/inode.c
--- b/fs/inode.c
+++ b/fs/inode.c
@@ -165,5 +165,5 @@
-	inode->i_wb_frn_history = 0;
-#endif
+
+	inode->rh_reserved2 = 0;
 
 	spin_lock_init(&inode->i_lock);
 	lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);

This is expected since inode->rh_reserved2 = 0 is red hat specific.

This is an automated interdiff check for backported commits.

[bmastbergen]

🥌