Skip to content

Commit 041cdb6

Browse files
[AUTO-CHERRYPICK] [Medium] Patch ceph for CVE-2012-2677 - branch 3.0-dev (#12613)
Co-authored-by: Kevin Lockwood <[email protected]>
1 parent 76defa8 commit 041cdb6

File tree

8 files changed

+542
-5
lines changed

8 files changed

+542
-5
lines changed

SPECS/ceph/CVE-2012-2677.patch

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
Edited filepath to reflect the file tree within ceph
2+
3+
Link: https://620468.bugs.gentoo.org/attachment.cgi?id=475060&action=diff&format=raw&headers=1
4+
--- a/src/boost/boost/pool/pool.hpp
5+
+++ a/src/boost/boost/pool/pool.hpp
6+
@@ -26,6 +26,8 @@
7+
8+
#include <boost/pool/poolfwd.hpp>
9+
10+
+// std::numeric_limits
11+
+#include <boost/limits.hpp>
12+
// boost::integer::static_lcm
13+
#include <boost/integer/common_factor_ct.hpp>
14+
// boost::simple_segregated_storage
15+
@@ -355,6 +357,15 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
16+
return s;
17+
}
18+
19+
+ size_type max_chunks() const
20+
+ { //! Calculated maximum number of memory chunks that can be allocated in a single call by this Pool.
21+
+ size_type partition_size = alloc_size();
22+
+ size_type POD_size = integer::static_lcm<sizeof(size_type), sizeof(void *)>::value + sizeof(size_type);
23+
+ size_type max_chunks = (std::numeric_limits<size_type>::max() - POD_size) / alloc_size();
24+
+
25+
+ return max_chunks;
26+
+ }
27+
+
28+
static void * & nextof(void * const ptr)
29+
{ //! \returns Pointer dereferenced.
30+
//! (Provided and used for the sake of code readability :)
31+
@@ -375,6 +386,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
32+
//! the first time that object needs to allocate system memory.
33+
//! The default is 32. This parameter may not be 0.
34+
//! \param nmax_size is the maximum number of chunks to allocate in one block.
35+
+ set_next_size(nnext_size);
36+
+ set_max_size(nmax_size);
37+
}
38+
39+
~pool()
40+
@@ -398,8 +411,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
41+
}
42+
void set_next_size(const size_type nnext_size)
43+
{ //! Set number of chunks to request from the system the next time that object needs to allocate system memory. This value should never be set to 0.
44+
- //! \returns nnext_size.
45+
- next_size = start_size = nnext_size;
46+
+ BOOST_USING_STD_MIN();
47+
+ next_size = start_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nnext_size, max_chunks());
48+
}
49+
size_type get_max_size() const
50+
{ //! \returns max_size.
51+
@@ -407,7 +420,8 @@ class pool: protected simple_segregated_storage < typename UserAllocator::size_t
52+
}
53+
void set_max_size(const size_type nmax_size)
54+
{ //! Set max_size.
55+
- max_size = nmax_size;
56+
+ BOOST_USING_STD_MIN();
57+
+ max_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(nmax_size, max_chunks());
58+
}
59+
size_type get_requested_size() const
60+
{ //! \returns the requested size passed into the constructor.
61+
@@ -708,9 +722,9 @@ void * pool<UserAllocator>::malloc_need_resize()
62+
63+
BOOST_USING_STD_MIN();
64+
if(!max_size)
65+
- next_size <<= 1;
66+
+ set_next_size(next_size << 1);
67+
else if( next_size*partition_size/requested_size < max_size)
68+
- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size);
69+
+ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size));
70+
71+
// initialize it,
72+
store().add_block(node.begin(), node.element_size(), partition_size);
73+
@@ -748,9 +762,9 @@ void * pool<UserAllocator>::ordered_malloc_need_resize()
74+
75+
BOOST_USING_STD_MIN();
76+
if(!max_size)
77+
- next_size <<= 1;
78+
+ set_next_size(next_size << 1);
79+
else if( next_size*partition_size/requested_size < max_size)
80+
- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size);
81+
+ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size));
82+
83+
// initialize it,
84+
// (we can use "add_block" here because we know that
85+
@@ -792,6 +806,8 @@ void * pool<UserAllocator>::ordered_malloc(const size_type n)
86+
{ //! Gets address of a chunk n, allocating new memory if not already available.
87+
//! \returns Address of chunk n if allocated ok.
88+
//! \returns 0 if not enough memory for n chunks.
89+
+ if (n > max_chunks())
90+
+ return 0;
91+
92+
const size_type partition_size = alloc_size();
93+
const size_type total_req_size = n * requested_size;
94+
@@ -840,9 +856,9 @@ void * pool<UserAllocator>::ordered_malloc(const size_type n)
95+
96+
BOOST_USING_STD_MIN();
97+
if(!max_size)
98+
- next_size <<= 1;
99+
+ set_next_size(next_size << 1);
100+
else if( next_size*partition_size/requested_size < max_size)
101+
- next_size = min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size*requested_size/ partition_size);
102+
+ set_next_size(min BOOST_PREVENT_MACRO_SUBSTITUTION(next_size << 1, max_size * requested_size / partition_size));
103+
104+
// insert it into the list,
105+
// handle border case.

SPECS/ceph/CVE-2020-10722.patch

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
From 73e1e5635f27e444abd0bf3ce2144c7378e29401 Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Tue, 4 Feb 2025 15:04:56 -0800
4+
Subject: [PATCH] [Medium] Patch ceph to fix CVE-2020-10722
5+
6+
Link: https://git.dpdk.org/dpdk/patch/?id=3ae4beb079ce242240c34376a066bbccd0c0b23e
7+
---
8+
src/seastar/dpdk/lib/librte_vhost/vhost_user.c | 6 +++---
9+
1 file changed, 3 insertions(+), 3 deletions(-)
10+
11+
diff --git a/src/seastar/dpdk/lib/librte_vhost/vhost_user.c b/src/seastar/dpdk/lib/librte_vhost/vhost_user.c
12+
index c9e29ece8..91fb802ba 100644
13+
--- a/src/seastar/dpdk/lib/librte_vhost/vhost_user.c
14+
+++ b/src/seastar/dpdk/lib/librte_vhost/vhost_user.c
15+
@@ -1434,10 +1434,10 @@ vhost_user_set_log_base(struct virtio_net **pdev, struct VhostUserMsg *msg,
16+
size = msg->payload.log.mmap_size;
17+
off = msg->payload.log.mmap_offset;
18+
19+
- /* Don't allow mmap_offset to point outside the mmap region */
20+
- if (off > size) {
21+
++ /* Check for mmap size and offset overflow. */
22+
++ if (off >= -size) {
23+
RTE_LOG(ERR, VHOST_CONFIG,
24+
- "log offset %#"PRIx64" exceeds log size %#"PRIx64"\n",
25+
++ "log offset %#"PRIx64" and log size %#"PRIx64" overflow\n",
26+
off, size);
27+
return RTE_VHOST_MSG_RESULT_ERR;
28+
}
29+
--
30+
2.34.1
31+

SPECS/ceph/CVE-2020-10723.patch

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 8558fe7d316167be9c0e1b25aabd4f96a5079250 Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Mon, 3 Feb 2025 16:23:59 -0800
4+
Subject: [PATCH] [Medium] Patch ceph for CVE-2020-10723
5+
6+
Link: https://git.dpdk.org/dpdk/patch/?id=c78d94189dced04def987a17f16097fcb197a186
7+
---
8+
src/seastar/dpdk/lib/librte_vhost/vhost_user.c | 2 +-
9+
1 file changed, 1 insertion(+), 1 deletion(-)
10+
11+
diff --git a/src/seastar/dpdk/lib/librte_vhost/vhost_user.c b/src/seastar/dpdk/lib/librte_vhost/vhost_user.c
12+
index c9e29ece8..1f84fc212 100644
13+
--- a/src/seastar/dpdk/lib/librte_vhost/vhost_user.c
14+
+++ b/src/seastar/dpdk/lib/librte_vhost/vhost_user.c
15+
@@ -1841,7 +1841,7 @@ static int
16+
vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
17+
struct VhostUserMsg *msg)
18+
{
19+
- uint16_t vring_idx;
20+
+ uint32_t vring_idx;
21+
22+
switch (msg->request.master) {
23+
case VHOST_USER_SET_VRING_KICK:
24+
--
25+
2.34.1
26+

SPECS/ceph/CVE-2020-10724.patch

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
From 57c19156f1c7075d2b27f48d62cedc3992811c2b Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Wed, 5 Feb 2025 12:55:00 -0800
4+
Subject: [PATCH] [Medium] Patch ceph for CVE-2020-10724
5+
6+
Link: https://git.dpdk.org/dpdk/patch/?id=acd4c92fa693bbea695f2bb42bb93fb8567c3ca5
7+
---
8+
.../dpdk/lib/librte_vhost/vhost_crypto.c | 17 +++++++++++++++++
9+
1 file changed, 17 insertions(+)
10+
11+
diff --git a/src/seastar/dpdk/lib/librte_vhost/vhost_crypto.c b/src/seastar/dpdk/lib/librte_vhost/vhost_crypto.c
12+
index 0edf12d52..9d569fcc5 100644
13+
--- a/src/seastar/dpdk/lib/librte_vhost/vhost_crypto.c
14+
+++ b/src/seastar/dpdk/lib/librte_vhost/vhost_crypto.c
15+
@@ -246,6 +246,11 @@ transform_cipher_param(struct rte_crypto_sym_xform *xform,
16+
if (unlikely(ret < 0))
17+
return ret;
18+
19+
+ if (param->cipher_key_len > VHOST_USER_CRYPTO_MAX_CIPHER_KEY_LENGTH) {
20+
+ VC_LOG_DBG("Invalid cipher key length\n");
21+
+ return -VIRTIO_CRYPTO_BADMSG;
22+
+ }
23+
+
24+
xform->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
25+
xform->cipher.algo = (enum rte_crypto_cipher_algorithm)ret;
26+
xform->cipher.key.length = param->cipher_key_len;
27+
@@ -296,6 +301,12 @@ transform_chain_param(struct rte_crypto_sym_xform *xforms,
28+
ret = cipher_algo_transform(param->cipher_algo);
29+
if (unlikely(ret < 0))
30+
return ret;
31+
+
32+
+ if (param->cipher_key_len > VHOST_USER_CRYPTO_MAX_CIPHER_KEY_LENGTH) {
33+
+ VC_LOG_DBG("Invalid cipher key length\n");
34+
+ return -VIRTIO_CRYPTO_BADMSG;
35+
+ }
36+
+
37+
xform_cipher->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
38+
xform_cipher->cipher.algo = (enum rte_crypto_cipher_algorithm)ret;
39+
xform_cipher->cipher.key.length = param->cipher_key_len;
40+
@@ -311,6 +322,12 @@ transform_chain_param(struct rte_crypto_sym_xform *xforms,
41+
ret = auth_algo_transform(param->hash_algo);
42+
if (unlikely(ret < 0))
43+
return ret;
44+
+
45+
+ if (param->auth_key_len > VHOST_USER_CRYPTO_MAX_HMAC_KEY_LENGTH) {
46+
+ VC_LOG_DBG("Invalid auth key length\n");
47+
+ return -VIRTIO_CRYPTO_BADMSG;
48+
+ }
49+
+
50+
xform_auth->auth.algo = (enum rte_crypto_auth_algorithm)ret;
51+
xform_auth->auth.digest_length = param->digest_len;
52+
xform_auth->auth.key.length = param->auth_key_len;
53+
--
54+
2.34.1
55+

SPECS/ceph/CVE-2021-24032.patch

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
From 9eb423834eec8a61773b2bd02b694d132459ade7 Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Wed, 5 Feb 2025 11:57:38 -0800
4+
Subject: [PATCH] [Medium] Patch ceph for CVE-2021-24032
5+
6+
Link: https://github.com/facebook/zstd/commit/a774c5797399040af62db21d8a9b9769e005430e.patch
7+
---
8+
src/zstd/programs/fileio.c | 9 +++------
9+
src/zstd/programs/util.c | 9 +++++++++
10+
src/zstd/programs/util.h | 7 ++++++-
11+
3 files changed, 18 insertions(+), 7 deletions(-)
12+
13+
diff --git a/src/zstd/programs/fileio.c b/src/zstd/programs/fileio.c
14+
index d72879d64..f4529840a 100644
15+
--- a/src/zstd/programs/fileio.c
16+
+++ b/src/zstd/programs/fileio.c
17+
@@ -611,14 +611,11 @@ FIO_openDstFile(FIO_prefs_t* const prefs,
18+
FIO_remove(dstFileName);
19+
} }
20+
21+
- { FILE* const f = fopen( dstFileName, "wb" );
22+
+ { const int old_umask = UTIL_umask(0177); /* u-x,go-rwx */
23+
+ FILE* const f = fopen( dstFileName, "wb" );
24+
+ UTIL_umask(old_umask);
25+
if (f == NULL) {
26+
DISPLAYLEVEL(1, "zstd: %s: %s\n", dstFileName, strerror(errno));
27+
- } else if (srcFileName != NULL
28+
- && strcmp (srcFileName, stdinmark)
29+
- && strcmp(dstFileName, nulmark) ) {
30+
- /* reduce rights on newly created dst file while compression is ongoing */
31+
- UTIL_chmod(dstFileName, 00600);
32+
}
33+
return f;
34+
}
35+
diff --git a/src/zstd/programs/util.c b/src/zstd/programs/util.c
36+
index ab1abd3b1..950697252 100644
37+
--- a/src/zstd/programs/util.c
38+
+++ b/src/zstd/programs/util.c
39+
@@ -137,6 +137,15 @@ int UTIL_chmod(char const* filename, mode_t permissions)
40+
return chmod(filename, permissions);
41+
}
42+
43+
+int UTIL_umask(int mode) {
44+
+#if PLATFORM_POSIX_VERSION > 0
45+
+ return umask(mode);
46+
+#else
47+
+ /* do nothing, fake return value */
48+
+ return mode;
49+
+#endif
50+
+}
51+
+
52+
int UTIL_setFileStat(const char *filename, stat_t *statbuf)
53+
{
54+
int res = 0;
55+
diff --git a/src/zstd/programs/util.h b/src/zstd/programs/util.h
56+
index 8e187e4f2..8b1f80bb1 100644
57+
--- a/src/zstd/programs/util.h
58+
+++ b/src/zstd/programs/util.h
59+
@@ -22,7 +22,7 @@ extern "C" {
60+
#include "platform.h" /* PLATFORM_POSIX_VERSION, ZSTD_NANOSLEEP_SUPPORT, ZSTD_SETPRIORITY_SUPPORT */
61+
#include <stddef.h> /* size_t, ptrdiff_t */
62+
#include <sys/types.h> /* stat, utime */
63+
-#include <sys/stat.h> /* stat, chmod */
64+
+#include <sys/stat.h> /* stat, chmod, umask */
65+
#include "../lib/common/mem.h" /* U64 */
66+
67+
68+
@@ -119,6 +119,11 @@ U64 UTIL_getTotalFileSize(const char* const * fileNamesTable, unsigned nbFiles);
69+
int UTIL_getFileStat(const char* infilename, stat_t* statbuf);
70+
int UTIL_setFileStat(const char* filename, stat_t* statbuf);
71+
int UTIL_chmod(char const* filename, mode_t permissions); /*< like chmod, but avoid changing permission of /dev/null */
72+
+/**
73+
+ * Wraps umask(). Does nothing when the platform doesn't have that concept.
74+
+ */
75+
+int UTIL_umask(int mode);
76+
+
77+
int UTIL_compareStr(const void *p1, const void *p2);
78+
const char* UTIL_getFileExtension(const char* infilename);
79+
80+
--
81+
2.34.1
82+

0 commit comments

Comments
 (0)