5.14.0-503.34.1.el9_5

Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 5
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 503.33.1
+RHEL_RELEASE = 503.34.1
 
 #
 # ZSTREAM

arch/arm64/kernel/cacheinfo.c

@@ -101,16 +101,18 @@ int populate_cache_leaves(unsigned int cpu)
 	unsigned int level, idx;
 	enum cache_type type;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
-	struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+	struct cacheinfo *infos = this_cpu_ci->info_list;
 
 	for (idx = 0, level = 1; level <= this_cpu_ci->num_levels &&
-	     idx < this_cpu_ci->num_leaves; idx++, level++) {
+	     idx < this_cpu_ci->num_leaves; level++) {
 		type = get_cache_type(level);
 		if (type == CACHE_TYPE_SEPARATE) {
-			ci_leaf_init(this_leaf++, CACHE_TYPE_DATA, level);
-			ci_leaf_init(this_leaf++, CACHE_TYPE_INST, level);
+			if (idx + 1 >= this_cpu_ci->num_leaves)
+				break;
+			ci_leaf_init(&infos[idx++], CACHE_TYPE_DATA, level);
+			ci_leaf_init(&infos[idx++], CACHE_TYPE_INST, level);
 		} else {
-			ci_leaf_init(this_leaf++, type, level);
+			ci_leaf_init(&infos[idx++], type, level);
 		}
 	}
 	return 0;

crypto/rng.c

@@ -295,20 +295,21 @@ static ssize_t crypto_devrandom_read_iter(struct iov_iter *iter, bool reseed)
 		i = min_t(size_t, iov_iter_count(iter), sizeof(tmp));
 		err = crypto_rng_get_bytes(rng, tmp, i);
 		if (err) {
-			ret = err;
+			ret = ret ?: err;
 			break;
 		}
 
 		copied = copy_to_iter(tmp, i, iter);
 		ret += copied;
 
-		if (!iov_iter_count(iter) || copied != sizeof(tmp))
+		if (!iov_iter_count(iter) || copied != i)
 			break;
 
-		if (need_resched()) {
+		BUILD_BUG_ON(PAGE_SIZE % sizeof(tmp) != 0);
+		if (ret % PAGE_SIZE == 0) {
 			if (signal_pending(current))
 				break;
-			schedule();
+			cond_resched();
 		}
 	}
 
@@ -317,8 +318,7 @@ static ssize_t crypto_devrandom_read_iter(struct iov_iter *iter, bool reseed)
 	else
 		crypto_put_default_rng();
 	memzero_explicit(tmp, sizeof(tmp));
-
-	return ret;
+	return ret ? ret : -EFAULT;
 }
 
 static const struct random_extrng crypto_devrandom_rng = {

redhat/kernel.changelog-9.5

+* Mon Mar 17 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.34.1.el9_5]
+- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82734] {CVE-2025-21785}
+- crypto: rng - Fix extrng EFAULT handling (Herbert Xu) [RHEL-70643]
+Resolves: RHEL-70643, RHEL-82734
+
 * Wed Mar 12 2025 Chao YE <cye@redhat.com> [5.14.0-503.33.1.el9_5]
 - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-62266]
 - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-62266]