diff --git a/packages/kernel-6.1/1007-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch b/packages/kernel-6.1/1007-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch deleted file mode 100644 index 41e5e4d2..00000000 --- a/packages/kernel-6.1/1007-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch +++ /dev/null @@ -1,56 +0,0 @@ -From: Yuxiao Wang -Date: Tue, 9 Sep 2026 12:44:00 +0000 -Subject: [PATCH] nitro_enclaves: fix use-after-free on SLOT_ALLOC failure - -When ne_create_vm_ioctl() fails the SLOT_ALLOC request after -anon_inode_getfile() has succeeded, the error path calls -fput(enclave_file) and then frees ne_enclave. - -In normal userspace context, fput() defers the final __fput() via -task_work. ne_enclave_release() therefore runs after ne_enclave has -already been freed and dereferences ne_enclave->slot_uid, causing a -use-after-free: KASAN: slab-use-after-free in ne_enclave_release. - -The enclave has no slot allocated and is not yet linked into the -enclaves list on this error path, so ne_enclave_release() is expected -to return early when slot_uid is zero. However, reading slot_uid -already accesses the freed object. - -Clear enclave_file->private_data before fput() on the error path. -ne_enclave_release() then returns immediately when private_data is -NULL, leaving the ioctl error path as the sole owner of ne_enclave. -This is safe because the file has not been fd_install()'d yet. - -Tested on an AWS EC2 m5.2xlarge with CONFIG_KASAN=y. Without the -patch, the reproducer triggers a KASAN slab-use-after-free on every -SLOT_ALLOC failure. With the patch, no KASAN report is produced and -the SLOT_ALLOC error is still returned. Normal enclave creation and -teardown are unaffected. - -Fixes: 9c8eb50fe9e2 ("nitro_enclaves: Add logic for terminating an enclave") -Cc: stable@vger.kernel.org -Co-developed-by: Zhaofeng Chen -Signed-off-by: Zhaofeng Chen -Signed-off-by: Yuxiao Wang -Reviewed-by: Alexander Graf -Link: https://lore.kernel.org/stable/20260909124400.27857-1-graf@amazon.com/T/#u -Signed-off-by: Maher Homsi ---- - drivers/virt/nitro_enclaves/ne_misc_dev.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/virt/nitro_enclaves/ne_misc_dev.c b/drivers/virt/nitro_enclaves/ne_misc_dev.c -index c91300a..0d7bdad 100644 ---- a/drivers/virt/nitro_enclaves/ne_misc_dev.c -+++ b/drivers/virt/nitro_enclaves/ne_misc_dev.c -@@ -1706,6 +1706,7 @@ static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 __user *slot_ui - return enclave_fd; - - put_file: -+ enclave_file->private_data = NULL; - fput(enclave_file); - put_fd: - put_unused_fd(enclave_fd); --- -2.34.1 - diff --git a/packages/kernel-6.1/Cargo.toml b/packages/kernel-6.1/Cargo.toml index c032e8f9..120c43e1 100644 --- a/packages/kernel-6.1/Cargo.toml +++ b/packages/kernel-6.1/Cargo.toml @@ -13,8 +13,8 @@ path = "../packages.rs" [[package.metadata.build-package.external-files]] # Use latest-kernel-srpm-url.sh to get this. -url = "https://cdn.amazonlinux.com/al2023/blobstore/cabf7aca9f0c7f4a7de972ac73535aa5a2325eaa421b9754e68eedb403c34653/kernel-6.1.188-233.386.amzn2023.src.rpm" -sha512 = "d715246dc84480a5c997900c0114e5655e31fb4429b16ee096d6f5cc242a138858e1c092a4f2ab7dc52c1f0dce57dee0b203565367b6bacf7fe86a3cdb5ecabb" +url = "https://cdn.amazonlinux.com/al2023/blobstore/2b3e9e0c29344b3125c641d6e02546bb3bd2969c33d7d7fd7a831225f9b3277e/kernel-6.1.188-233.393.amzn2023.src.rpm" +sha512 = "1d992b7d90076dcb54d912f28165390e3a4fa81e2c1083ef4446488ec914e5b9edab8284dab9bbd1023bc91eb25f05785ddf168a92689b9a9a4e685e8142cab1" force-upstream = true [[package.metadata.build-package.external-files]] diff --git a/packages/kernel-6.1/kernel-6.1.spec b/packages/kernel-6.1/kernel-6.1.spec index 1f945240..5ac394ac 100644 --- a/packages/kernel-6.1/kernel-6.1.spec +++ b/packages/kernel-6.1/kernel-6.1.spec @@ -10,7 +10,7 @@ Summary: The Linux kernel License: GPL-2.0 WITH Linux-syscall-note URL: https://www.kernel.org/ # Use latest-kernel-srpm-url.sh to get this. -Source0: https://cdn.amazonlinux.com/al2023/blobstore/cabf7aca9f0c7f4a7de972ac73535aa5a2325eaa421b9754e68eedb403c34653/kernel-6.1.188-233.386.amzn2023.src.rpm +Source0: https://cdn.amazonlinux.com/al2023/blobstore/2b3e9e0c29344b3125c641d6e02546bb3bd2969c33d7d7fd7a831225f9b3277e/kernel-6.1.188-233.393.amzn2023.src.rpm Source1: gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc # Use latest-2.24-neuron-srpm-url.sh to get this. Source2: https://yum.repos.neuron.amazonaws.com/aws-neuronx-dkms-%{neuron_inf1_ver}.0.noarch.rpm @@ -60,8 +60,6 @@ Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch Patch1005: 1005-Revert-Revert-drm-fb_helper-improve-CONFIG_FB-depend.patch # Backport patch to ensure NUL-terminated task->comm buffer Patch1006: 1006-strscpy-write-destination-buffer-only-once.patch -# Fix use-after-free in the Nitro Enclaves enclave-creation error path -Patch1007: 1007-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch # Backport patch to disable LZ4 rolling decompression for EROFS Patch1008: 1008-erofs-disable-LZ4-rolling-decompression-for-now.patch