[PATCH v5.15 0/2] v5.15 backports for CVE-2023-52447

[Robert Kolchmeyer <rkolchmeyer@google.com>]

Hi all,

This patch series includes backports for the changes that fix CVE-2023-52447.

Commit e6c86c513f44 ("rcu-tasks: Provide rcu_trace_implies_rcu_gp()")
applied cleanly.

Commit 876673364161 ("bpf: Defer the free of inner map when necessary")
had one significant conflict, which was due to missing commit
8d5a8011b35d ("bpf: Batch call_rcu callbacks instead of SLAB_TYPESAFE_BY_RCU.").
The conflict was because of the switch to queue_work() from schedule_work() in
__bpf_map_put(). From what I can tell, the switch to queue_work() from
schedule_work() isn't relevant in the context of this bug, so I resolved the
conflict by keeping schedule_work() and not including 8d5a8011b35d
("bpf: Batch call_rcu callbacks instead of SLAB_TYPESAFE_BY_RCU.").

I also noticed that commit a6fb03a9c9c8
("bpf: add percpu stats for bpf_map elements insertions/deletions") is tagged as
a stable dependency of commit 876673364161. However, I don't see the functions
and fields added in that patch used at all in commit 876673364161. This patch
was backported to linux-6.1.y, but a `git grep` seems to show that
`bpf_map_init_elem_count` is never referenced in linux-6.1.y. It seems to me
that this patch is not actually a dependency of commit 876673364161, so I didn't
include it in this backport.

I ran the selftests added in commit 1624918be84a
("selftests/bpf: Add test cases for inner map"), and they passed with no KASAN
warnings. However, I did not manage to find a kernel on which these tests did
generate a KASAN warning, so the test result may not be very meaningful. Apart
from that, my typical build+boot test passed.


Hou Tao (1):
  bpf: Defer the free of inner map when necessary

Paul E. McKenney (1):
  rcu-tasks: Provide rcu_trace_implies_rcu_gp()

 include/linux/bpf.h      |  7 ++++++-
 include/linux/rcupdate.h | 12 ++++++++++++
 kernel/bpf/map_in_map.c  | 11 ++++++++---
 kernel/bpf/syscall.c     | 26 ++++++++++++++++++++++++--
 kernel/rcu/tasks.h       |  2 ++
 5 files changed, 52 insertions(+), 6 deletions(-)

-- 
2.44.0.278.ge034bb2e1d-goog