Sync from SUSE:SLFO:Kernel:1.0 kernel-livepatch-MICRO-6-0_Update_8 revision fbba8cf4d5af6772762f03b72f78924f

This commit is contained in:
2025-08-25 13:08:39 +02:00
parent b427e65494
commit fecee5ca17
17 changed files with 9064 additions and 205 deletions
+188
View File
@@ -1,9 +1,197 @@
-------------------------------------------------------------------
Fri Aug 1 08:32:47 CEST 2025 - nstange@suse.de
- Bump up the version number in spec file
- commit c7034c9
-------------------------------------------------------------------
Thu Jul 31 14:43:40 CEST 2025 - nstange@suse.de
- rpm/config.sh: Fix $PATCHINFO_ID
- commit 34045dd
-------------------------------------------------------------------
Fri Jul 25 15:45:00 CEST 2025 - vincenzo.mezzela@suse.com
- Fix for CVE-2025-37797 ("net_sched: hfsc: Fix a UAF vulnerability in class handling")
Live patch for CVE-2025-37797. Upstream commit:
- 3df275ef0a6a ("net_sched: hfsc: Fix a UAF vulnerability in class handling")
KLP: CVE-2025-37797
References: bsc#1245793 CVE-2025-37797
- commit da31cee
-------------------------------------------------------------------
Wed Jul 23 15:53:41 CEST 2025 - ali.abdallah@suse.de
- Fix for CVE-2025-37752 ("net_sched: sch_sfq: move the limit validation")
Live patch for CVE-2025-37752. Upstream commit:
- b3bf8f63e617 ("net_sched: sch_sfq: move the limit validation")
KLP: CVE-2025-37752
References: bsc#1245776 CVE-2025-37752
- commit 8041577
-------------------------------------------------------------------
Mon Jul 21 16:10:14 CEST 2025 - ali.abdallah@suse.de
- Fix for CVE-2025-21702 ("pfifo_tail_enqueue: Drop new packet when sch->limit == 0")
Live patch for CVE-2025-21702. Upstream commit:
- 647cef20e649 ("pfifo_tail_enqueue: Drop new packet when sch->limit == 0")
KLP: CVE-2025-21702
References: bsc#1245797 CVE-2025-21702
- commit f983220
-------------------------------------------------------------------
Thu Jul 17 08:40:26 CEST 2025 - nstange@suse.de
- Update signing key spec in _buildenvs
- commit a4b2144
-------------------------------------------------------------------
Mon Jul 7 09:18:15 CEST 2025 - nstange@suse.de
- Add IBS _buildenv files + update PATCHINFO_ID after the initial submission
- commit 739a181
-------------------------------------------------------------------
Tue Jul 1 13:36:15 CEST 2025 - mbenes@suse.cz
- kernel-livepatch.spec: Update build dependencies for non-default flavors
Starting with commit 7c95ae0ac0bb ("mkspec: Exclude rt flavor from
kernel-syms dependencies (bsc#1244337).") kernel-syms does not pull
kernel-%variant-devel package for non-default %variant. It needs to be
required alongside.
Hence, add new BuildRequires for these cases (-rt flavor only at the
time).
- commit ead79af
-------------------------------------------------------------------
Thu Jun 26 13:24:09 CEST 2025 - mbenes@suse.cz
- Revert "Remove the support for different flavors"
The removal of flavors in spec file needs to go hand in hand with rpm
macros update unfortunately. It is a work in progress so revert the spec
file changes for now so that current builds do not fail.
This reverts commit 6254bb4ada3a5af59ea00493698f92edc0b4c9a2.
- commit 0ae16b9
-------------------------------------------------------------------
Thu Jun 26 12:26:41 CEST 2025 - mbenes@suse.cz
- scripts/tar-up.sh: Handle SLFO-Main_Update_0 package
SLFO-Main_Update_0 (and possibly its -RT variant) will be used by QA for
testing live patching in SLFO:Main project before a product like SLE16
is branched off.
Handle it in our scripts so that everything works properly.
- commit b8cab65
-------------------------------------------------------------------
Wed Jun 18 13:01:24 CEST 2025 - mbenes@suse.cz
- Remove the support for different flavors
There is a support for different kernel flavors from the beginning in
our spec file. Originally, there were -default and -xen flavors.
However, it is questionable. A live patch is built against a very
specific kernel binary. Different flavors of the same kernel source can
be easily different also in this respect.
Remove it then. The build process is driven by "variant" macro deriving
from a branch name. We can stick with that.
- commit 6254bb4
-------------------------------------------------------------------
Tue Jun 3 15:25:29 CEST 2025 - nstange@suse.de
- New branch for MICRO-6-0_Update_8
- commit 792998a
-------------------------------------------------------------------
Mon Apr 28 14:31:04 CEST 2025 - mbenes@suse.cz
- Remove old klp-convert support
There was an intention to use old/original klp-convert in our live
patches. It never happened. Kallsyms was used up until SLE15-SP6 where
everything was migrated to much lighter klp-convert-mini implementation.
Remove the old klp-convert support all together now.
- commit 1731556
-------------------------------------------------------------------
Mon Apr 28 14:00:44 CEST 2025 - mbenes@suse.cz
- Remove kallsyms infrastructure
Kernel kallsyms infrastructure is not used to resolving externalized
symbols on newer codestreams starting with SLE15-SP6. We can remove all
the scaffolding from live patches git repo.
- commit 5b8b913
-------------------------------------------------------------------
Fri Apr 25 14:11:19 CEST 2025 - mbenes@suse.cz
- uname_patch: Use klp-convert-mini instead of kallsyms
Newer codestreams starting with SLE15-SP6 use klp-convert-mini
infrastructure in the kernel. Convert uname_patch to use it instead of
the current kallsyms.
- commit 8f07a2e
-------------------------------------------------------------------
Wed Jan 15 13:14:12 CET 2025 - mpdesouza@suse.com
- kernel-livepatch.spec: Execute lp-mod-check.sh using a shell
Otherwise it might fail to execute due to missing execution bit when
pushed to IBS using osc-tiny.
- commit c120c76
-------------------------------------------------------------------
Wed Jan 15 13:14:11 CET 2025 - mpdesouza@suse.com
- register-patches.sh: Bump Source index
[nstange: update comment right before the S= assignment as well]
- commit 8301adf
-------------------------------------------------------------------
Tue Jan 14 15:00:46 CET 2025 - nstange@suse.de
- Implement post-build checks on the livepatch module
Implement checks for some common pitfalls to be run on
the final compiled livepatch module:
- no dependencies to other modules are allowed
- no .klp relas against jump tables.
[nstange: invoke directly from the kernel livepatch build,
instead of through the kernel's Kbuild modpost]
- commit 3152f76
-------------------------------------------------------------------
Tue Nov 12 08:09:07 CET 2024 - nstange@suse.de
- scripts/tar-up: copy _buildenv.* files
The IBS project reorganizations for the SLE Micro product family, more
specifically the absence of kernel submission maintenance projects,
make it necessary to provide _buildenv.* files in the top-level
livepatch project sources as an alternative means for instructing IBS
what target kernel to build against.
Make tar-up.sh to copy all _buildenv.* files found under rpm/ in the
source tree to the top-level destination directory to be uploaded to
IBS.
- commit 403970f
-------------------------------------------------------------------
Wed Oct 9 15:46:30 CEST 2024 - lhruska@suse.cz
- klp_trace.h: improvement for SLE15-SP6 external symbols
Because some parts of tracepoint macro (like traceiter definition) are hidden
behind the macro, so klp-build cannot even detect those symbols.
To avoid doing some heuristics detecting `traceiter` missing definition, this
patch modifies the `KLPR_DECLARE_TRACE` macro to add the KLP_RELOC_SYMBOL
to its symbols. To do this, it needs to know the module name, which SHOULD
be always defined in the same module we are trying to LP, so I added only one
parameter (module name) putting it to both LPed object name and also to
target object name parameters.
- commit 4215e6e
-------------------------------------------------------------------
Wed Oct 2 12:19:33 CEST 2024 - lhruska@suse.cz
- klp_trace: Add SLE15-SP6 support
- commit e4bee4a
-------------------------------------------------------------------
Mon Sep 2 13:02:29 CEST 2024 - nstange@suse.de
+16 -27
View File
@@ -19,9 +19,8 @@
%define variant %{nil}
Name: kernel-livepatch-MICRO-6-0_Update_8
Version: 1
Version: 2
Release: 1
%define module_num %(echo %version-%release | sed 'y/\./_/')
License: GPL-2.0
@@ -33,41 +32,34 @@ Source2: livepatch_main.c
Source3: config.sh
Source4: source-timestamp
Source5: shadow.h
Source6: kallsyms_relocs.h
Source7: kallsyms_relocs.c
Source8: klp_convert.h
Source9: klp_syscalls.h
Source10: klp_trace.h
Source6: klp_syscalls.h
Source7: klp_trace.h
Source8: lp-mod-checks.sh
# Auto expanded KLP_PATCHES_SOURCES:
BuildRequires: kernel-syms%{variant} kernel-livepatch-tools-devel libelf-devel
%if 0%{?use_klp_convert}
%if "%{?variant}"
BuildRequires: kernel%{variant}-livepatch-devel
%else
BuildRequires: kernel-default-livepatch-devel
%endif
Source9: bsc1245776.tar.bz2
Source10: bsc1245793.tar.bz2
Source11: bsc1245797.tar.bz2
%if "%variant" != ""
BuildRequires: kernel%variant-devel
%endif
BuildRequires: kernel-syms kernel-livepatch-tools-devel libelf-devel
ExclusiveArch: x86_64 s390x
%klp_module_package
%description
This is a live patch for SUSE Linux Enterprise Server kernel.
Source timestamp: 2025-06-03 15:25:29 +0200
GIT Revision: 792998a9d12fee27cbd08553c66f2abb63c0c0f3
Source timestamp: 2025-08-01 08:32:47 +0200
GIT Revision: c7034c9b72fc41c6ec27e62fdf6e192165841d7c
GIT Branch: MICRO-6-0_Update_8
%prep
%setup -c
# Auto expanded KLP_PATCHES_SETUP_SOURCES:
%setup -T -D -a 9 -a 10 -a 11
cp %_sourcedir/livepatch_main.c .
cp %_sourcedir/shadow.h .
cp %_sourcedir/kallsyms_relocs.h .
cp %_sourcedir/kallsyms_relocs.c .
cp %_sourcedir/Makefile .
cp %_sourcedir/klp_convert.h .
cp %_sourcedir/klp_syscalls.h .
cp %_sourcedir/klp_trace.h .
@@ -82,12 +74,9 @@ for flavor in %flavors_to_build; do
cp -r "$@" "obj/$flavor"
make -C %{kernel_source $flavor} M="$PWD/obj/$flavor" modules
%if 0%{?use_klp_convert}
module=$(find "obj/$flavor" -name 'livepatch*.ko' -printf '%f')
klp-convert /usr/src/linux-obj/%_target_cpu/$flavor/Symbols.list \
obj/$flavor/$module obj/$flavor/${module}_converted
mv obj/$flavor/${module}_converted obj/$flavor/$module
%endif
for module in $(find "obj/$flavor" -name '*.ko'); do
/bin/sh %_sourcedir/lp-mod-checks.sh "$module"
done
done
%install
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
+7 -1
View File
@@ -4,7 +4,7 @@ ccflags-y += -I$(obj)
obj-m := livepatch-@@RPMRELEASE@@.o
livepatch-@@RPMRELEASE@@-y := kallsyms_relocs.o livepatch_main.o uname_patch/livepatch_uname.o
livepatch-@@RPMRELEASE@@-y := uname_patch/livepatch_uname.o livepatch_main.o bsc1245776/livepatch_bsc1245776.o bsc1245793/livepatch_bsc1245793.o bsc1245797/livepatch_bsc1245797.o
default:
$(MAKE) -C $(KDIR) M=$(CURDIR) modules
@@ -12,3 +12,9 @@ default:
clean:
$(MAKE) -C $(KDIR) M=$(CURDIR) clean
CFLAGS_livepatch_bsc1245776.o += -Werror
CFLAGS_bsc1245776/livepatch_bsc1245776.o += -Werror
CFLAGS_livepatch_bsc1245793.o += -Werror
CFLAGS_bsc1245793/livepatch_bsc1245793.o += -Werror
CFLAGS_livepatch_bsc1245797.o += -Werror
CFLAGS_bsc1245797/livepatch_bsc1245797.o += -Werror
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
BIN
View File
Binary file not shown.
+2 -1
View File
@@ -1 +1,2 @@
IBS_PROJECT=SUSE:ALP:Source:Standard:Core:1.0:Build
IBS_PROJECT=SUSE:SLFO:Kernel:1.0:Build
PATCHINFO_ID=patchinfo.20250608121116370836.90520734224245
-129
View File
@@ -1,129 +0,0 @@
/*
* kallsyms_relocs.c - resolve non-exported symbols
*
* Copyright (C) 2018 SUSE
* Author: Nicolai Stange <nstange@suse.de>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kallsyms.h>
#include "kallsyms_relocs.h"
struct find_args
{
struct klp_kallsyms_reloc reloc;
unsigned long match_count;
};
static int __find_callback(void *data, const char *name, unsigned long addr)
{
struct find_args *args = data;
if (strcmp(args->reloc.symname, name))
return 0;
args->match_count++;
/*
* Finish the search when the symbol is found for the desired
* position or the position is not defined.
*/
if (!args->reloc.sympos || args->match_count == args->reloc.sympos) {
*args->reloc.addr = (void *)addr;
return 1;
}
return 0;
}
static
int (*klpe_module_kallsyms_on_each_symbol)(const char *modname,
int (*fn)(void *, const char *,
unsigned long),
void *data);
static int __klp_resolve_kallsyms_relocs(struct klp_kallsyms_reloc *relocs,
unsigned long count)
{
unsigned long i;
struct find_args args;
for (i = 0; i < count; ++i) {
*relocs[i].addr = NULL;
args.reloc = relocs[i];
args.match_count = 0;
if (args.reloc.objname) {
klpe_module_kallsyms_on_each_symbol(args.reloc.objname,
__find_callback,
&args);
} else {
kallsyms_on_each_symbol(__find_callback, &args);
}
if (!*relocs[i].addr) {
if (relocs[i].objname) {
pr_err("livepatch: symbol %s:%s not resolved\n",
relocs[i].objname, relocs[i].symname);
} else {
pr_err("livepatch: symbol %s not resolved\n",
relocs[i].symname);
}
return -ENOENT;
}
}
return 0;
}
struct module *(*klpe_find_module)(const char *name);
/* Bootstrap: resolve non-exported module_kallsyms_on_each_symbol() */
int klp_kallsyms_relocs_init(void)
{
static struct klp_kallsyms_reloc bootstrap_relocs[] = {
{ "module_kallsyms_on_each_symbol",
(void *)&klpe_module_kallsyms_on_each_symbol },
{ "find_module", (void *)&klpe_find_module },
};
/* Already initialized? */
if (klpe_module_kallsyms_on_each_symbol)
return 0;
/*
* All relocations are against symbols from vmlinux, the yet
* unresolved klpe_module_kallsyms_on_each_symbol() will not
* get invoked and the call below will work fine at this stage
* already.
*/
return __klp_resolve_kallsyms_relocs(bootstrap_relocs,
ARRAY_SIZE(bootstrap_relocs));
}
int klp_resolve_kallsyms_relocs(struct klp_kallsyms_reloc *relocs,
unsigned long count)
{
int ret;
ret = klp_kallsyms_relocs_init();
if (ret)
return ret;
return __klp_resolve_kallsyms_relocs(relocs, count);
}
-19
View File
@@ -1,19 +0,0 @@
#ifndef _KLP_KALLSYMS_RELOCS
#define _KLP_KALLSYMS_RELOCS
struct klp_kallsyms_reloc
{
const char *symname;
void **addr;
const char *objname;
unsigned long sympos;
};
int klp_kallsyms_relocs_init(void);
int klp_resolve_kallsyms_relocs(struct klp_kallsyms_reloc *relocs,
unsigned long count);
extern struct module *(*klpe_find_module)(const char *name);
#endif /* _KLP_KALLSYMS_RELOCS */
-16
View File
@@ -1,16 +0,0 @@
#ifndef _KLP_KLPCONVERT_H
#define _KLP_KLPCONVERT_H
#ifdef USE_KLP_CONVERT
#define KLP_SYM_LINKAGE extern
#define KLP_SYM(sym) sym
#else
#define KLP_SYM_LINKAGE static
#define KLP_SYM(sym) (*klp_##sym)
#endif
#endif
+72 -3
View File
@@ -35,7 +35,10 @@
PARAMS(void *__data, proto), \
PARAMS(__data, args))
#else /* LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0) */
#define KLPR_TRACE_EVENT(name, proto, args) \
KLPR_DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
#elif LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 0)
#define KLPR___DO_TRACE_CALL(name, args) (*klpe___traceiter_##name)(NULL, args)
@@ -93,9 +96,75 @@
cpu_online(raw_smp_processor_id()), \
PARAMS(void *__data, proto))
#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0) */
#define KLPR_TRACE_EVENT(name, proto, args) \
KLPR_DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
#else /* LINUX_VERSION_CODE >= KERNEL_VERSION(6, 4, 0) */
#define KLPR___DO_TRACE_CALL(name, args) __traceiter_##name(NULL, args)
#define KLPR___DO_TRACE(name, args, cond, rcuidle) \
do { \
int __maybe_unused __idx = 0; \
\
if (!(cond)) \
return; \
\
if (WARN_ON_ONCE(RCUIDLE_COND(rcuidle))) \
return; \
\
/* keep srcu and sched-rcu usage consistent */ \
preempt_disable_notrace(); \
\
/* \
* For rcuidle callers, use srcu since sched-rcu \
* doesn't work from the idle path. \
*/ \
if (rcuidle) { \
__idx = srcu_read_lock_notrace(&tracepoint_srcu);\
ct_irq_enter_irqson(); \
} \
\
KLPR___DO_TRACE_CALL(name, TP_ARGS(args)); \
\
if (rcuidle) { \
ct_irq_exit_irqson(); \
srcu_read_unlock_notrace(&tracepoint_srcu, __idx);\
} \
\
preempt_enable_notrace(); \
} while (0)
/* module - name of module the tracepoint is from for KLP_RELOC_SYMBOL macro */
#include <linux/livepatch.h>
#define KLPR___DECLARE_TRACE(module, name, proto, args, cond, data_proto) \
extern int __traceiter_##name(data_proto) \
KLP_RELOC_SYMBOL(module, module, __traceiter_##name); \
extern struct tracepoint __tracepoint_##name \
KLP_RELOC_SYMBOL(module, module, __tracepoint_##name); \
static inline void klpr_trace_##name(proto) \
{ \
if (static_key_enabled(&__tracepoint_##name.key)) \
KLPR___DO_TRACE(name, \
TP_ARGS(args), \
TP_CONDITION(cond), 0); \
if (IS_ENABLED(CONFIG_LOCKDEP) && (cond)) { \
WARN_ON_ONCE(!rcu_is_watching()); \
} \
} \
#define KLPR_DECLARE_TRACE(module, name, proto, args) \
KLPR___DECLARE_TRACE(module, name, PARAMS(proto), PARAMS(args), \
cpu_online(raw_smp_processor_id()), \
PARAMS(void *__data, proto))
#define KLPR_TRACE_EVENT(module, name, proto, args) \
KLPR_DECLARE_TRACE(module, name, PARAMS(proto), PARAMS(args))
#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(5, 12, 0) */
#endif /* _KLP_TRACE_H */
+38 -5
View File
@@ -25,6 +25,9 @@
#include "uname_patch/livepatch_uname.h"
/* Auto expanded KLP_PATCHES_INCLUDES: */
#include "bsc1245776/livepatch_bsc1245776.h"
#include "bsc1245793/livepatch_bsc1245793.h"
#include "bsc1245797/livepatch_bsc1245797.h"
static struct klp_object objs[] = {
@@ -42,6 +45,21 @@ static struct klp_object objs[] = {
.new_func = KLP_SYSCALL_COMPAT_STUB_SYM(klp_newuname),
},
#endif
{ .old_name = __stringify(pfifo_tail_enqueue), .new_func = klpp_pfifo_tail_enqueue, },
{ }
}
},
{
.name = "sch_hfsc",
.funcs = (struct klp_func[]) {
{ .old_name = __stringify(hfsc_change_class), .new_func = klpp_hfsc_change_class, },
{ }
}
},
{
.name = "sch_sfq",
.funcs = (struct klp_func[]) {
{ .old_name = __stringify(sfq_init), .new_func = klpp_sfq_init, },
{ }
}
},
@@ -60,18 +78,30 @@ static int __init klp_patch_init(void)
pr_info("livepatch: initializing\n");
retval = klp_patch_uname_init();
if (retval)
return retval;
/* Auto expanded KLP_PATCHES_INIT_CALLS: */
retval = livepatch_bsc1245776_init();
if (retval)
goto err_bsc1245776;
retval = livepatch_bsc1245793_init();
if (retval)
goto err_bsc1245793;
retval = livepatch_bsc1245797_init();
if (retval)
goto err_bsc1245797;
retval = klp_enable_patch(&patch);
if (!retval)
return retval;
/* Auto expanded KLP_PATCHES_INIT_ERR_HANDLERS: */
livepatch_bsc1245797_cleanup();
err_bsc1245797:
livepatch_bsc1245793_cleanup();
err_bsc1245793:
livepatch_bsc1245776_cleanup();
err_bsc1245776:
return retval;
}
@@ -81,6 +111,9 @@ static void __exit klp_patch_cleanup(void)
pr_info("livepatch: removed\n");
/* Auto expanded KLP_PATCHES_CLEANUP_CALLS: */
livepatch_bsc1245776_cleanup();
livepatch_bsc1245793_cleanup();
livepatch_bsc1245797_cleanup();
}
@@ -89,4 +122,4 @@ module_exit(klp_patch_cleanup);
MODULE_LICENSE("GPL");
MODULE_INFO(livepatch, "Y");
MODULE_INFO(klpgitrev, "792998a9d12fee27cbd08553c66f2abb63c0c0f3");
MODULE_INFO(klpgitrev, "c7034c9b72fc41c6ec27e62fdf6e192165841d7c");
+24
View File
@@ -0,0 +1,24 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0-or-later
# Checks whether livepatch module don't have any dependency on other modules
# or no relocation into __jump_table section.
obj=$1
IS_LP=$(/usr/sbin/modinfo $obj | grep '^livepatch:' | sed s'/^livepatch:[[:blank:]]*//')
if [ "x$IS_LP" != xY ]; then
exit 0;
fi
DEPS=$(/usr/sbin/modinfo $obj | grep '^depends:' | sed 's/^depends:[[:blank:]]*//')
if [ -n "$DEPS" ]; then
echo "error: dependency on livepatch $obj" >&2
exit 1
fi
RELOC=$(/usr/bin/readelf -W -S $obj | grep -E '\.klp\..*__jump_table')
if [ -n "$RELOC" ]; then
echo "error: .klp.*__jump_table section found in livepatch $obj" >&2
exit 1
fi
+2 -2
View File
@@ -1,3 +1,3 @@
2025-06-03 15:25:29 +0200
GIT Revision: 792998a9d12fee27cbd08553c66f2abb63c0c0f3
2025-08-01 08:32:47 +0200
GIT Revision: c7034c9b72fc41c6ec27e62fdf6e192165841d7c
GIT Branch: MICRO-6-0_Update_8
BIN
View File
Binary file not shown.