From 2aa4795a8cedee7baa4baf8a4b8645861b140a45 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 10 Nov 2015 07:41:35 -0500 Subject: [PATCH 01/27] CVE-2015-5307 kvm: DoS infinite loop in microcode AC exception (rhbz 1277172 1279688) --- ...und-infinite-loop-in-microcode-when-.patch | 92 +++++++++++++++++++ kernel.spec | 6 ++ 2 files changed, 98 insertions(+) create mode 100644 KVM-x86-work-around-infinite-loop-in-microcode-when-.patch diff --git a/KVM-x86-work-around-infinite-loop-in-microcode-when-.patch b/KVM-x86-work-around-infinite-loop-in-microcode-when-.patch new file mode 100644 index 000000000..013af11e1 --- /dev/null +++ b/KVM-x86-work-around-infinite-loop-in-microcode-when-.patch @@ -0,0 +1,92 @@ +From adceca1789584fe567828afb7246bd35a8549e94 Mon Sep 17 00:00:00 2001 +From: Eric Northup +Date: Tue, 10 Nov 2015 13:22:52 +0100 +Subject: [PATCH 1/2] KVM: x86: work around infinite loop in microcode when #AC + is delivered + +It was found that a guest can DoS a host by triggering an infinite +stream of "alignment check" (#AC) exceptions. This causes the +microcode to enter an infinite loop where the core never receives +another interrupt. The host kernel panics pretty quickly due to the +effects (CVE-2015-5307). + +Signed-off-by: Eric Northup +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +--- + arch/x86/include/uapi/asm/svm.h | 1 + + arch/x86/kvm/svm.c | 8 ++++++++ + arch/x86/kvm/vmx.c | 5 ++++- + 3 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h +index b5d7640abc5d..8a4add8e4639 100644 +--- a/arch/x86/include/uapi/asm/svm.h ++++ b/arch/x86/include/uapi/asm/svm.h +@@ -100,6 +100,7 @@ + { SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \ + { SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \ + { SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \ ++ { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \ + { SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \ + { SVM_EXIT_INTR, "interrupt" }, \ + { SVM_EXIT_NMI, "nmi" }, \ +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index f2c8e4917688..7203b3cc71b5 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1110,6 +1110,7 @@ static void init_vmcb(struct vcpu_svm *svm) + set_exception_intercept(svm, PF_VECTOR); + set_exception_intercept(svm, UD_VECTOR); + set_exception_intercept(svm, MC_VECTOR); ++ set_exception_intercept(svm, AC_VECTOR); + + set_intercept(svm, INTERCEPT_INTR); + set_intercept(svm, INTERCEPT_NMI); +@@ -1798,6 +1799,12 @@ static int ud_interception(struct vcpu_svm *svm) + return 1; + } + ++static int ac_interception(struct vcpu_svm *svm) ++{ ++ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0); ++ return 1; ++} ++ + static void svm_fpu_activate(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); +@@ -3362,6 +3369,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = { + [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception, + [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception, + [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception, ++ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception, + [SVM_EXIT_INTR] = intr_interception, + [SVM_EXIT_NMI] = nmi_interception, + [SVM_EXIT_SMI] = nop_on_interception, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 5eb56ed77c1f..106aa940d3c0 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1631,7 +1631,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu) + u32 eb; + + eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) | +- (1u << NM_VECTOR) | (1u << DB_VECTOR); ++ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR); + if ((vcpu->guest_debug & + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) == + (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) +@@ -5266,6 +5266,9 @@ static int handle_exception(struct kvm_vcpu *vcpu) + return handle_rmode_exception(vcpu, ex_no, error_code); + + switch (ex_no) { ++ case AC_VECTOR: ++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code); ++ return 1; + case DB_VECTOR: + dr6 = vmcs_readl(EXIT_QUALIFICATION); + if (!(vcpu->guest_debug & +-- +2.4.3 + diff --git a/kernel.spec b/kernel.spec index 079af5283..44bc2dd44 100644 --- a/kernel.spec +++ b/kernel.spec @@ -632,6 +632,9 @@ Patch544: ppp-slip-Validate-VJ-compression-slot-parameters-com.patch Patch545: drm-radeon-move-bl-encoder-assignment-into-bl-init.patch Patch546: drm-radeon-fix-dpms-when-driver-backlight-control-is.patch +#CVE-2015-5307 rhbz 1277172 1279688 +Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch + # END OF PATCH DEFINITIONS %endif @@ -2076,6 +2079,9 @@ fi # # %changelog +* Tue Nov 10 2015 Josh Boyer +- CVE-2015-5307 kvm: DoS infinite loop in microcode AC exception (rhbz 1277172 1279688) + * Thu Nov 5 2015 Peter Robinson - Disable Exynos IOMMU as it crashes From 11dc6a09a2f3564db6c5ee39636b03d58fd79c66 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 10 Nov 2015 07:48:23 -0500 Subject: [PATCH 02/27] CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) --- KVM-svm-unconditionally-intercept-DB.patch | 80 ++++++++++++++++++++++ kernel.spec | 4 ++ 2 files changed, 84 insertions(+) create mode 100644 KVM-svm-unconditionally-intercept-DB.patch diff --git a/KVM-svm-unconditionally-intercept-DB.patch b/KVM-svm-unconditionally-intercept-DB.patch new file mode 100644 index 000000000..021af4ccb --- /dev/null +++ b/KVM-svm-unconditionally-intercept-DB.patch @@ -0,0 +1,80 @@ +From 48bb9bb210c6c2f185d891e3e7a401d849409f84 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Tue, 10 Nov 2015 13:22:53 +0100 +Subject: [PATCH 2/2] KVM: svm: unconditionally intercept #DB + +This is needed to avoid the possibility that the guest triggers +an infinite stream of #DB exceptions (CVE-2015-8104). + +VMX is not affected: because it does not save DR6 in the VMCS, +it already intercepts #DB unconditionally. + +Reported-by: Jan Beulich +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +--- + arch/x86/kvm/svm.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 7203b3cc71b5..184e50b3c35a 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1111,6 +1111,7 @@ static void init_vmcb(struct vcpu_svm *svm) + set_exception_intercept(svm, UD_VECTOR); + set_exception_intercept(svm, MC_VECTOR); + set_exception_intercept(svm, AC_VECTOR); ++ set_exception_intercept(svm, DB_VECTOR); + + set_intercept(svm, INTERCEPT_INTR); + set_intercept(svm, INTERCEPT_NMI); +@@ -1645,20 +1646,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu, + mark_dirty(svm->vmcb, VMCB_SEG); + } + +-static void update_db_bp_intercept(struct kvm_vcpu *vcpu) ++static void update_bp_intercept(struct kvm_vcpu *vcpu) + { + struct vcpu_svm *svm = to_svm(vcpu); + +- clr_exception_intercept(svm, DB_VECTOR); + clr_exception_intercept(svm, BP_VECTOR); + +- if (svm->nmi_singlestep) +- set_exception_intercept(svm, DB_VECTOR); +- + if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) { +- if (vcpu->guest_debug & +- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP)) +- set_exception_intercept(svm, DB_VECTOR); + if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP) + set_exception_intercept(svm, BP_VECTOR); + } else +@@ -1764,7 +1758,6 @@ static int db_interception(struct vcpu_svm *svm) + if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP)) + svm->vmcb->save.rflags &= + ~(X86_EFLAGS_TF | X86_EFLAGS_RF); +- update_db_bp_intercept(&svm->vcpu); + } + + if (svm->vcpu.guest_debug & +@@ -3753,7 +3746,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu) + */ + svm->nmi_singlestep = true; + svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF); +- update_db_bp_intercept(vcpu); + } + + static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr) +@@ -4379,7 +4371,7 @@ static struct kvm_x86_ops svm_x86_ops = { + .vcpu_load = svm_vcpu_load, + .vcpu_put = svm_vcpu_put, + +- .update_db_bp_intercept = update_db_bp_intercept, ++ .update_db_bp_intercept = update_bp_intercept, + .get_msr = svm_get_msr, + .set_msr = svm_set_msr, + .get_segment_base = svm_get_segment_base, +-- +2.4.3 + diff --git a/kernel.spec b/kernel.spec index 44bc2dd44..905dd882b 100644 --- a/kernel.spec +++ b/kernel.spec @@ -635,6 +635,9 @@ Patch546: drm-radeon-fix-dpms-when-driver-backlight-control-is.patch #CVE-2015-5307 rhbz 1277172 1279688 Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch +#CVE-2015-8104 rhbz 1278496 1279691 +Patch551: KVM-svm-unconditionally-intercept-DB.patch + # END OF PATCH DEFINITIONS %endif @@ -2080,6 +2083,7 @@ fi # %changelog * Tue Nov 10 2015 Josh Boyer +- CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) - CVE-2015-5307 kvm: DoS infinite loop in microcode AC exception (rhbz 1277172 1279688) * Thu Nov 5 2015 Peter Robinson From 86635eb9e77d2befd917da5c7ccbf98a45df48cc Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 10 Nov 2015 08:46:29 -0500 Subject: [PATCH 03/27] Fix incorrect size calculations in megaraid with 64K pages (rhbz 1269300) --- kernel.spec | 4 ++ ...Do-not-use-PAGE_SIZE-for-max_sectors.patch | 50 +++++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100644 megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch diff --git a/kernel.spec b/kernel.spec index 905dd882b..e6595eb4b 100644 --- a/kernel.spec +++ b/kernel.spec @@ -638,6 +638,9 @@ Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch #CVE-2015-8104 rhbz 1278496 1279691 Patch551: KVM-svm-unconditionally-intercept-DB.patch +#rhbz 1269300 +Patch552: megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch + # END OF PATCH DEFINITIONS %endif @@ -2083,6 +2086,7 @@ fi # %changelog * Tue Nov 10 2015 Josh Boyer +- Fix incorrect size calculations in megaraid with 64K pages (rhbz 1269300) - CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) - CVE-2015-5307 kvm: DoS infinite loop in microcode AC exception (rhbz 1277172 1279688) diff --git a/megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch b/megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch new file mode 100644 index 000000000..769337dfa --- /dev/null +++ b/megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch @@ -0,0 +1,50 @@ +From c6f081c88ab76d5a40365b94c1f5839e099b2b2b Mon Sep 17 00:00:00 2001 +From: "sumit.saxena@avagotech.com" +Date: Thu, 15 Oct 2015 13:40:04 +0530 +Subject: [PATCH] megaraid_sas: Do not use PAGE_SIZE for max_sectors + +Do not use PAGE_SIZE marco to calculate max_sectors per I/O +request. Driver code assumes PAGE_SIZE will be always 4096 which can +lead to wrongly calculated value if PAGE_SIZE is not 4096. This issue +was reported in Ubuntu Bugzilla Bug #1475166. + +Cc: +Signed-off-by: Sumit Saxena +Signed-off-by: Kashyap Desai +Reviewed-by: Tomas Henzl +Reviewed-by: Martin K. Petersen +Signed-off-by: Martin K. Petersen +--- + drivers/scsi/megaraid/megaraid_sas.h | 2 ++ + drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h +index 20c37541963f..ebf821b94cb6 100644 +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -364,6 +364,8 @@ enum MR_EVT_ARGS { + MR_EVT_ARGS_GENERIC, + }; + ++ ++#define SGE_BUFFER_SIZE 4096 + /* + * define constants for device list query options + */ +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index eaa81e552fd2..a9eb10ebc6ed 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -4752,7 +4752,7 @@ static int megasas_init_fw(struct megasas_instance *instance) + + + instance->max_sectors_per_req = instance->max_num_sge * +- PAGE_SIZE / 512; ++ SGE_BUFFER_SIZE / 512; + if (tmp_sectors && (instance->max_sectors_per_req > tmp_sectors)) + instance->max_sectors_per_req = tmp_sectors; + +-- +2.4.3 + From e5132530e15d893817c64b72eb5d1af0fc39868c Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Tue, 10 Nov 2015 10:17:49 -0600 Subject: [PATCH 04/27] Linux v4.2.6 --- ...s-wakeup-quirk-for-LynxPoint-LP-cont.patch | 61 ------------------ ...pms-when-driver-backlight-control-is.patch | 62 ------------------- ...e-bl-encoder-assignment-into-bl-init.patch | 59 ------------------ kernel.spec | 16 ++--- si2157-Bounds-check-firmware.patch | 39 ------------ si2168-Bounds-check-firmware.patch | 50 --------------- sources | 2 +- 7 files changed, 5 insertions(+), 284 deletions(-) delete mode 100644 0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch delete mode 100644 drm-radeon-fix-dpms-when-driver-backlight-control-is.patch delete mode 100644 drm-radeon-move-bl-encoder-assignment-into-bl-init.patch delete mode 100644 si2157-Bounds-check-firmware.patch delete mode 100644 si2168-Bounds-check-firmware.patch diff --git a/0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch b/0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch deleted file mode 100644 index 884f685c8..000000000 --- a/0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch +++ /dev/null @@ -1,61 +0,0 @@ -From fd7cd061adcf5f7503515ba52b6a724642a839c8 Mon Sep 17 00:00:00 2001 -From: Laura Abbott -Date: Mon, 12 Oct 2015 11:30:13 +0300 -Subject: [PATCH] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers - -We received several reports of systems rebooting and powering on -after an attempted shutdown. Testing showed that setting -XHCI_SPURIOUS_WAKEUP quirk in addition to the XHCI_SPURIOUS_REBOOT -quirk allowed the system to shutdown as expected for LynxPoint-LP -xHCI controllers. Set the quirk back. - -Note that the quirk was originally introduced for LynxPoint and -LynxPoint-LP just for this same reason. See: - -commit 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell") - -It was later limited to only concern HP machines as it caused -regression on some machines, see both bug and commit: - -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171 -commit 6962d914f317 ("xhci: Limit the spurious wakeup fix only to HP machines") - -Later it was discovered that the powering on after shutdown -was limited to LynxPoint-LP (Haswell-ULT) and that some non-LP HP -machine suffered from spontaneous resume from S3 (which should -not be related to the SPURIOUS_WAKEUP quirk at all). An attempt -to fix this then removed the SPURIOUS_WAKEUP flag usage completely. - -commit b45abacde3d5 ("xhci: no switching back on non-ULT Haswell") - -Current understanding is that LynxPoint-LP (Haswell ULT) machines -need the SPURIOUS_WAKEUP quirk, otherwise they will restart, and -plain Lynxpoint (Haswell) machines may _not_ have the quirk -set otherwise they again will restart. - -Signed-off-by: Laura Abbott -Cc: Takashi Iwai -Cc: Oliver Neukum -[Added more history to commit message -Mathias] -Cc: stable -Signed-off-by: Mathias Nyman -Signed-off-by: Greg Kroah-Hartman ---- - drivers/usb/host/xhci-pci.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index c79d336..c47d3e4 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -147,6 +147,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) { - xhci->quirks |= XHCI_SPURIOUS_REBOOT; -+ xhci->quirks |= XHCI_SPURIOUS_WAKEUP; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI || --- -2.4.3 - diff --git a/drm-radeon-fix-dpms-when-driver-backlight-control-is.patch b/drm-radeon-fix-dpms-when-driver-backlight-control-is.patch deleted file mode 100644 index ab7597154..000000000 --- a/drm-radeon-fix-dpms-when-driver-backlight-control-is.patch +++ /dev/null @@ -1,62 +0,0 @@ -From ae93580ee59c02395c1711d3e6b90546b8137b86 Mon Sep 17 00:00:00 2001 -From: Alex Deucher -Date: Tue, 27 Oct 2015 10:56:44 -0400 -Subject: [PATCH 2/2] drm/radeon: fix dpms when driver backlight control is - disabled -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -If driver backlight control is disabled, either by driver -parameter or default per-asic setting, revert to the old behavior. - -Fixes a regression in commit: -4281f46ef839050d2ef60348f661eb463c21cc2e - -Reviewed-by: Michel Dänzer -Signed-off-by: Alex Deucher -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/radeon/atombios_encoders.c | 18 ++++++++++++++---- - 1 file changed, 14 insertions(+), 4 deletions(-) - -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index 933fd1bc849b..bb292143997e 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -1625,9 +1625,14 @@ radeon_atom_encoder_dpms_avivo(struct drm_encoder *encoder, int mode) - } else - atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); - if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { -- struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv; -+ if (rdev->mode_info.bl_encoder) { -+ struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv; - -- atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ } else { -+ args.ucAction = ATOM_LCD_BLON; -+ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); -+ } - } - break; - case DRM_MODE_DPMS_STANDBY: -@@ -1707,8 +1712,13 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode) - if (ASIC_IS_DCE4(rdev)) - atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0); - } -- if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) -- atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) { -+ if (rdev->mode_info.bl_encoder) -+ atombios_set_backlight_level(radeon_encoder, dig->backlight_level); -+ else -+ atombios_dig_transmitter_setup(encoder, -+ ATOM_TRANSMITTER_ACTION_LCD_BLON, 0, 0); -+ } - if (ext_encoder) - atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE); - break; --- -2.4.3 - diff --git a/drm-radeon-move-bl-encoder-assignment-into-bl-init.patch b/drm-radeon-move-bl-encoder-assignment-into-bl-init.patch deleted file mode 100644 index b6cc5741d..000000000 --- a/drm-radeon-move-bl-encoder-assignment-into-bl-init.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 4cee6a9057d5e13911f0cb6e143d11dc1a3245dd Mon Sep 17 00:00:00 2001 -From: Alex Deucher -Date: Wed, 28 Oct 2015 14:26:32 -0400 -Subject: [PATCH 1/2] drm/radeon: move bl encoder assignment into bl init -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -So that the bl encoder will be null if the GPU does not -control the backlight. - -Reviewed-by: Michel Dänzer -Signed-off-by: Alex Deucher -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/radeon/atombios_encoders.c | 1 + - drivers/gpu/drm/radeon/radeon_encoders.c | 1 - - drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 1 + - 3 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index 65adb9c72377..933fd1bc849b 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -237,6 +237,7 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder, - backlight_update_status(bd); - - DRM_INFO("radeon atom DIG backlight initialized\n"); -+ rdev->mode_info.bl_encoder = radeon_encoder; - - return; - -diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c -index ef99917f000d..c6ee80216cf4 100644 ---- a/drivers/gpu/drm/radeon/radeon_encoders.c -+++ b/drivers/gpu/drm/radeon/radeon_encoders.c -@@ -194,7 +194,6 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder, - radeon_atom_backlight_init(radeon_encoder, connector); - else - radeon_legacy_backlight_init(radeon_encoder, connector); -- rdev->mode_info.bl_encoder = radeon_encoder; - } - } - -diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c -index 45715307db71..30de43366eae 100644 ---- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c -+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c -@@ -441,6 +441,7 @@ void radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder, - backlight_update_status(bd); - - DRM_INFO("radeon legacy LVDS backlight initialized\n"); -+ rdev->mode_info.bl_encoder = radeon_encoder; - - return; - --- -2.4.3 - diff --git a/kernel.spec b/kernel.spec index e6595eb4b..3cc6d6ee9 100644 --- a/kernel.spec +++ b/kernel.spec @@ -52,7 +52,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 5 +%define stable_update 6 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -613,25 +613,14 @@ Patch523: RDS-verify-the-underlying-transport-exists-before-cr.patch #CVE-2015-7990 rhbz 1276437 1276438 Patch524: RDS-fix-race-condition-when-sending-a-message-on-unb.patch -#rhbz 1265978 -Patch536: si2168-Bounds-check-firmware.patch -Patch537: si2157-Bounds-check-firmware.patch - #rhbz 1272172 Patch540: 0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch Patch541: 0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch -#rhbz 1257131 -Patch542: 0001-xhci-Add-spurious-wakeup-quirk-for-LynxPoint-LP-cont.patch - #CVE-2015-7799 rhbz 1271134 1271135 Patch543: isdn_ppp-Add-checks-for-allocation-failure-in-isdn_p.patch Patch544: ppp-slip-Validate-VJ-compression-slot-parameters-com.patch -#rhbz 1278407 -Patch545: drm-radeon-move-bl-encoder-assignment-into-bl-init.patch -Patch546: drm-radeon-fix-dpms-when-driver-backlight-control-is.patch - #CVE-2015-5307 rhbz 1277172 1279688 Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch @@ -2085,6 +2074,9 @@ fi # # %changelog +* Tue Nov 10 2015 Justin M. Forbes - 4.2.6-300 +- Linux v4.2.6 + * Tue Nov 10 2015 Josh Boyer - Fix incorrect size calculations in megaraid with 64K pages (rhbz 1269300) - CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception (rhbz 1278496 1279691) diff --git a/si2157-Bounds-check-firmware.patch b/si2157-Bounds-check-firmware.patch deleted file mode 100644 index 284006160..000000000 --- a/si2157-Bounds-check-firmware.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 526fbce5b0e44c67a97c57656b3be9911f0a9b9b Mon Sep 17 00:00:00 2001 -From: Laura Abbott -Date: Tue, 29 Sep 2015 16:59:20 -0700 -Subject: [PATCH 2/2] si2157: Bounds check firmware -To: Antti Palosaari -To: Mauro Carvalho Chehab -Cc: Olli Salonen -Cc: linux-media@vger.kernel.org -Cc: linux-kernel@vger.kernel.org - -When reading the firmware and sending commands, the length -must be bounds checked to avoid overrunning the size of the command -buffer and smashing the stack if the firmware is not in the -expected format. Add the proper check. - -Cc: stable@kernel.org -Signed-off-by: Laura Abbott ---- - drivers/media/tuners/si2157.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c -index 5073821..ce157ed 100644 ---- a/drivers/media/tuners/si2157.c -+++ b/drivers/media/tuners/si2157.c -@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_frontend *fe) - - for (remaining = fw->size; remaining > 0; remaining -= 17) { - len = fw->data[fw->size - remaining]; -+ if (len > SI2157_ARGLEN) { -+ dev_err(&client->dev, "Bad firmware length\n"); -+ goto err_release_firmware; -+ } - memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len); - cmd.wlen = len; - cmd.rlen = 1; --- -2.4.3 - diff --git a/si2168-Bounds-check-firmware.patch b/si2168-Bounds-check-firmware.patch deleted file mode 100644 index e9c5bcc50..000000000 --- a/si2168-Bounds-check-firmware.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 43018528944fa4965a4048fee91d76b47dcaf60e Mon Sep 17 00:00:00 2001 -From: Laura Abbott -Date: Mon, 28 Sep 2015 14:10:34 -0700 -Subject: [PATCH 1/2] si2168: Bounds check firmware -To: Antti Palosaari -To: Mauro Carvalho Chehab -Cc: Olli Salonen -Cc: linux-media@vger.kernel.org -Cc: linux-kernel@vger.kernel.org -Cc: Stuart Auchterlonie - - -When reading the firmware and sending commands, the length must -be bounds checked to avoid overrunning the size of the command -buffer and smashing the stack if the firmware is not in the expected -format: - -si2168 11-0064: found a 'Silicon Labs Si2168-B40' -si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw' -si2168 11-0064: firmware download failed -95 -Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f - -Add the proper check. - -Cc: stable@kernel.org -Reported-by: Stuart Auchterlonie -Reviewed-by: Antti Palosaari -Signed-off-by: Laura Abbott ---- - drivers/media/dvb-frontends/si2168.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c -index 81788c5..821a8f4 100644 ---- a/drivers/media/dvb-frontends/si2168.c -+++ b/drivers/media/dvb-frontends/si2168.c -@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_frontend *fe) - /* firmware is in the new format */ - for (remaining = fw->size; remaining > 0; remaining -= 17) { - len = fw->data[fw->size - remaining]; -+ if (len > SI2168_ARGLEN) { -+ ret = -EINVAL; -+ break; -+ } - memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len); - cmd.wlen = len; - cmd.rlen = 1; --- -2.4.3 - diff --git a/sources b/sources index 6a576122e..95e48c5fa 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 3d5ea06d767e2f35c999eeadafc76523 linux-4.2.tar.xz 4c964bfba54d65b5b54cc898baddecad perf-man-4.2.tar.gz -19e47863ca441b2e11f90f25fb6c41ec patch-4.2.5.xz +408f9975969da326b5804a04dbf0d4de patch-4.2.6.xz From d72641382bef284b7685f323812b0ea79c40d8d5 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 10 Nov 2015 11:21:12 -0500 Subject: [PATCH 05/27] Fix Yoga 900 rfkill switch issues (rhbz 1275490) --- ...dd-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch | 41 +++++++++++++++++++ kernel.spec | 6 +++ 2 files changed, 47 insertions(+) create mode 100644 ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch diff --git a/ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch b/ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch new file mode 100644 index 000000000..9f6e5db1c --- /dev/null +++ b/ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch @@ -0,0 +1,41 @@ +From 332faabbaab64876396be48f1a1cf72b31d53a9d Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 9 Nov 2015 17:09:05 +0100 +Subject: [PATCH] ideapad-laptop: Add Lenovo Yoga 900 to no_hw_rfkill dmi list + +Like some of the other Yoga models the Lenovo Yoga 900 does not have a +hw rfkill switch, and trying to read the hw rfkill switch through the +ideapad module causes it to always reported blocking breaking wifi. + +This commit adds the Lenovo Yoga 900 to the no_hw_rfkill dmi list, fixing +the wifi breakage. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1275490 +Cc: stable@vger.kernel.org +Reported-and-tested-by: Kevin Fenzi +Signed-off-by: Hans de Goede +--- + drivers/platform/x86/ideapad-laptop.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index fce49f3c6ed6..d4a48b4d161a 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -873,6 +873,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"), + }, + }, ++ { ++ .ident = "Lenovo Yoga 900", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 900"), ++ }, ++ }, + {} + }; + +-- +2.4.3 + diff --git a/kernel.spec b/kernel.spec index 3cc6d6ee9..358b02f8c 100644 --- a/kernel.spec +++ b/kernel.spec @@ -630,6 +630,9 @@ Patch551: KVM-svm-unconditionally-intercept-DB.patch #rhbz 1269300 Patch552: megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch +#rhbz 1275490 +Patch553: ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch + # END OF PATCH DEFINITIONS %endif @@ -2074,6 +2077,9 @@ fi # # %changelog +* Tue Nov 10 2015 Josh Boyer +- Fix Yoga 900 rfkill switch issues (rhbz 1275490) + * Tue Nov 10 2015 Justin M. Forbes - 4.2.6-300 - Linux v4.2.6 From f4cab3b760945bb697b98d0beddef04fee71f09f Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 16 Nov 2015 14:39:09 -0500 Subject: [PATCH 06/27] Fix ipset netfilter issues (rhbz 1279189) --- kernel.spec | 8 + netfilter-ipset-Fix-extension-alignment.patch | 481 ++++++++++++++++++ ...ilter-ipset-Fix-hash-type-expiration.patch | 30 ++ ...Fix-hash-type-expire-release-empty-h.patch | 47 ++ 4 files changed, 566 insertions(+) create mode 100644 netfilter-ipset-Fix-extension-alignment.patch create mode 100644 netfilter-ipset-Fix-hash-type-expiration.patch create mode 100644 netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch diff --git a/kernel.spec b/kernel.spec index 358b02f8c..ee6b04d1c 100644 --- a/kernel.spec +++ b/kernel.spec @@ -633,6 +633,11 @@ Patch552: megaraid_sas-Do-not-use-PAGE_SIZE-for-max_sectors.patch #rhbz 1275490 Patch553: ideapad-laptop-Add-Lenovo-Yoga-900-to-no_hw_rfkill-d.patch +#rhbz 1279189 +Patch556: netfilter-ipset-Fix-extension-alignment.patch +Patch557: netfilter-ipset-Fix-hash-type-expiration.patch +Patch558: netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch + # END OF PATCH DEFINITIONS %endif @@ -2077,6 +2082,9 @@ fi # # %changelog +* Mon Nov 16 2015 Josh Boyer +- Fix ipset netfilter issues (rhbz 1279189) + * Tue Nov 10 2015 Josh Boyer - Fix Yoga 900 rfkill switch issues (rhbz 1275490) diff --git a/netfilter-ipset-Fix-extension-alignment.patch b/netfilter-ipset-Fix-extension-alignment.patch new file mode 100644 index 000000000..0a955e246 --- /dev/null +++ b/netfilter-ipset-Fix-extension-alignment.patch @@ -0,0 +1,481 @@ +From 55301931f78c0fdbb8f76dfdb3f914e9eef1f273 Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Sat, 7 Nov 2015 11:21:47 +0100 +Subject: [PATCH 1/3] netfilter: ipset: Fix extension alignment + +The data extensions in ipset lacked the proper memory alignment and +thus could lead to kernel crash on several architectures. Therefore +the structures have been reorganized and alignment attributes added +where needed. The patch was tested on armv7h by Gerhard Wiesinger and +on x86_64, sparc64 by Jozsef Kadlecsik. + +Reported-by: Gerhard Wiesinger +Tested-by: Gerhard Wiesinger +Tested-by: Jozsef Kadlecsik +Signed-off-by: Jozsef Kadlecsik +--- + include/linux/netfilter/ipset/ip_set.h | 2 +- + net/netfilter/ipset/ip_set_bitmap_gen.h | 17 +++----- + net/netfilter/ipset/ip_set_bitmap_ip.c | 14 ++----- + net/netfilter/ipset/ip_set_bitmap_ipmac.c | 64 ++++++++++++++----------------- + net/netfilter/ipset/ip_set_bitmap_port.c | 18 ++++----- + net/netfilter/ipset/ip_set_core.c | 14 ++++--- + net/netfilter/ipset/ip_set_hash_gen.h | 11 ++++-- + net/netfilter/ipset/ip_set_list_set.c | 5 ++- + 8 files changed, 65 insertions(+), 80 deletions(-) + +diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h +index 48bb01edcf30..0e1f433cc4b7 100644 +--- a/include/linux/netfilter/ipset/ip_set.h ++++ b/include/linux/netfilter/ipset/ip_set.h +@@ -421,7 +421,7 @@ extern void ip_set_free(void *members); + extern int ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr); + extern int ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr); + extern size_t ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], +- size_t len); ++ size_t len, size_t align); + extern int ip_set_get_extensions(struct ip_set *set, struct nlattr *tb[], + struct ip_set_ext *ext); + +diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h +index d05e759ed0fa..b0bc475f641e 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_gen.h ++++ b/net/netfilter/ipset/ip_set_bitmap_gen.h +@@ -33,7 +33,7 @@ + #define mtype_gc IPSET_TOKEN(MTYPE, _gc) + #define mtype MTYPE + +-#define get_ext(set, map, id) ((map)->extensions + (set)->dsize * (id)) ++#define get_ext(set, map, id) ((map)->extensions + ((set)->dsize * (id))) + + static void + mtype_gc_init(struct ip_set *set, void (*gc)(unsigned long ul_set)) +@@ -67,12 +67,9 @@ mtype_destroy(struct ip_set *set) + del_timer_sync(&map->gc); + + ip_set_free(map->members); +- if (set->dsize) { +- if (set->extensions & IPSET_EXT_DESTROY) +- mtype_ext_cleanup(set); +- ip_set_free(map->extensions); +- } +- kfree(map); ++ if (set->dsize && set->extensions & IPSET_EXT_DESTROY) ++ mtype_ext_cleanup(set); ++ ip_set_free(map); + + set->data = NULL; + } +@@ -92,16 +89,14 @@ mtype_head(struct ip_set *set, struct sk_buff *skb) + { + const struct mtype *map = set->data; + struct nlattr *nested; ++ size_t memsize = sizeof(*map) + map->memsize; + + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) + goto nla_put_failure; + if (mtype_do_head(skb, map) || + nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) || +- nla_put_net32(skb, IPSET_ATTR_MEMSIZE, +- htonl(sizeof(*map) + +- map->memsize + +- set->dsize * map->elements))) ++ nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize))) + goto nla_put_failure; + if (unlikely(ip_set_put_flags(skb, set))) + goto nla_put_failure; +diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c +index 64a564334418..4783efff0bde 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ip.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ip.c +@@ -41,7 +41,6 @@ MODULE_ALIAS("ip_set_bitmap:ip"); + /* Type structure */ + struct bitmap_ip { + void *members; /* the set members */ +- void *extensions; /* data extensions */ + u32 first_ip; /* host byte order, included in range */ + u32 last_ip; /* host byte order, included in range */ + u32 elements; /* number of max elements in the set */ +@@ -49,6 +48,8 @@ struct bitmap_ip { + size_t memsize; /* members size */ + u8 netmask; /* subnet netmask */ + struct timer_list gc; /* garbage collection */ ++ unsigned char extensions[0] /* data extensions */ ++ __aligned(__alignof__(u64)); + }; + + /* ADT structure for generic function args */ +@@ -224,13 +225,6 @@ init_map_ip(struct ip_set *set, struct bitmap_ip *map, + map->members = ip_set_alloc(map->memsize); + if (!map->members) + return false; +- if (set->dsize) { +- map->extensions = ip_set_alloc(set->dsize * elements); +- if (!map->extensions) { +- kfree(map->members); +- return false; +- } +- } + map->first_ip = first_ip; + map->last_ip = last_ip; + map->elements = elements; +@@ -316,13 +310,13 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + pr_debug("hosts %u, elements %llu\n", + hosts, (unsigned long long)elements); + +- map = kzalloc(sizeof(*map), GFP_KERNEL); ++ set->dsize = ip_set_elem_len(set, tb, 0, 0); ++ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); + if (!map) + return -ENOMEM; + + map->memsize = bitmap_bytes(0, elements - 1); + set->variant = &bitmap_ip; +- set->dsize = ip_set_elem_len(set, tb, 0); + if (!init_map_ip(set, map, first_ip, last_ip, + elements, hosts, netmask)) { + kfree(map); +diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +index 1430535118fb..29dde208381d 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +@@ -47,24 +47,26 @@ enum { + /* Type structure */ + struct bitmap_ipmac { + void *members; /* the set members */ +- void *extensions; /* MAC + data extensions */ + u32 first_ip; /* host byte order, included in range */ + u32 last_ip; /* host byte order, included in range */ + u32 elements; /* number of max elements in the set */ + size_t memsize; /* members size */ + struct timer_list gc; /* garbage collector */ ++ unsigned char extensions[0] /* MAC + data extensions */ ++ __aligned(__alignof__(u64)); + }; + + /* ADT structure for generic function args */ + struct bitmap_ipmac_adt_elem { ++ unsigned char ether[ETH_ALEN] __aligned(2); + u16 id; +- unsigned char *ether; ++ u16 add_mac; + }; + + struct bitmap_ipmac_elem { + unsigned char ether[ETH_ALEN]; + unsigned char filled; +-} __attribute__ ((aligned)); ++} __aligned(__alignof__(u64)); + + static inline u32 + ip_to_id(const struct bitmap_ipmac *m, u32 ip) +@@ -72,11 +74,11 @@ ip_to_id(const struct bitmap_ipmac *m, u32 ip) + return ip - m->first_ip; + } + +-static inline struct bitmap_ipmac_elem * +-get_elem(void *extensions, u16 id, size_t dsize) +-{ +- return (struct bitmap_ipmac_elem *)(extensions + id * dsize); +-} ++#define get_elem(extensions, id, dsize) \ ++ (struct bitmap_ipmac_elem *)(extensions + (id) * (dsize)) ++ ++#define get_const_elem(extensions, id, dsize) \ ++ (const struct bitmap_ipmac_elem *)(extensions + (id) * (dsize)) + + /* Common functions */ + +@@ -88,10 +90,9 @@ bitmap_ipmac_do_test(const struct bitmap_ipmac_adt_elem *e, + + if (!test_bit(e->id, map->members)) + return 0; +- elem = get_elem(map->extensions, e->id, dsize); +- if (elem->filled == MAC_FILLED) +- return !e->ether || +- ether_addr_equal(e->ether, elem->ether); ++ elem = get_const_elem(map->extensions, e->id, dsize); ++ if (e->add_mac && elem->filled == MAC_FILLED) ++ return ether_addr_equal(e->ether, elem->ether); + /* Trigger kernel to fill out the ethernet address */ + return -EAGAIN; + } +@@ -103,7 +104,7 @@ bitmap_ipmac_gc_test(u16 id, const struct bitmap_ipmac *map, size_t dsize) + + if (!test_bit(id, map->members)) + return 0; +- elem = get_elem(map->extensions, id, dsize); ++ elem = get_const_elem(map->extensions, id, dsize); + /* Timer not started for the incomplete elements */ + return elem->filled == MAC_FILLED; + } +@@ -133,7 +134,7 @@ bitmap_ipmac_add_timeout(unsigned long *timeout, + * and we can reuse it later when MAC is filled out, + * possibly by the kernel + */ +- if (e->ether) ++ if (e->add_mac) + ip_set_timeout_set(timeout, t); + else + *timeout = t; +@@ -150,7 +151,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, + elem = get_elem(map->extensions, e->id, dsize); + if (test_bit(e->id, map->members)) { + if (elem->filled == MAC_FILLED) { +- if (e->ether && ++ if (e->add_mac && + (flags & IPSET_FLAG_EXIST) && + !ether_addr_equal(e->ether, elem->ether)) { + /* memcpy isn't atomic */ +@@ -159,7 +160,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, + ether_addr_copy(elem->ether, e->ether); + } + return IPSET_ADD_FAILED; +- } else if (!e->ether) ++ } else if (!e->add_mac) + /* Already added without ethernet address */ + return IPSET_ADD_FAILED; + /* Fill the MAC address and trigger the timer activation */ +@@ -168,7 +169,7 @@ bitmap_ipmac_do_add(const struct bitmap_ipmac_adt_elem *e, + ether_addr_copy(elem->ether, e->ether); + elem->filled = MAC_FILLED; + return IPSET_ADD_START_STORED_TIMEOUT; +- } else if (e->ether) { ++ } else if (e->add_mac) { + /* We can store MAC too */ + ether_addr_copy(elem->ether, e->ether); + elem->filled = MAC_FILLED; +@@ -191,7 +192,7 @@ bitmap_ipmac_do_list(struct sk_buff *skb, const struct bitmap_ipmac *map, + u32 id, size_t dsize) + { + const struct bitmap_ipmac_elem *elem = +- get_elem(map->extensions, id, dsize); ++ get_const_elem(map->extensions, id, dsize); + + return nla_put_ipaddr4(skb, IPSET_ATTR_IP, + htonl(map->first_ip + id)) || +@@ -213,7 +214,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, + { + struct bitmap_ipmac *map = set->data; + ipset_adtfn adtfn = set->variant->adt[adt]; +- struct bitmap_ipmac_adt_elem e = { .id = 0 }; ++ struct bitmap_ipmac_adt_elem e = { .id = 0, .add_mac = 1 }; + struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); + u32 ip; + +@@ -231,7 +232,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, + return -EINVAL; + + e.id = ip_to_id(map, ip); +- e.ether = eth_hdr(skb)->h_source; ++ memcpy(e.ether, eth_hdr(skb)->h_source, ETH_ALEN); + + return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); + } +@@ -265,11 +266,10 @@ bitmap_ipmac_uadt(struct ip_set *set, struct nlattr *tb[], + return -IPSET_ERR_BITMAP_RANGE; + + e.id = ip_to_id(map, ip); +- if (tb[IPSET_ATTR_ETHER]) +- e.ether = nla_data(tb[IPSET_ATTR_ETHER]); +- else +- e.ether = NULL; +- ++ if (tb[IPSET_ATTR_ETHER]) { ++ memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN); ++ e.add_mac = 1; ++ } + ret = adtfn(set, &e, &ext, &ext, flags); + + return ip_set_eexist(ret, flags) ? 0 : ret; +@@ -300,13 +300,6 @@ init_map_ipmac(struct ip_set *set, struct bitmap_ipmac *map, + map->members = ip_set_alloc(map->memsize); + if (!map->members) + return false; +- if (set->dsize) { +- map->extensions = ip_set_alloc(set->dsize * elements); +- if (!map->extensions) { +- kfree(map->members); +- return false; +- } +- } + map->first_ip = first_ip; + map->last_ip = last_ip; + map->elements = elements; +@@ -361,14 +354,15 @@ bitmap_ipmac_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + if (elements > IPSET_BITMAP_MAX_RANGE + 1) + return -IPSET_ERR_BITMAP_RANGE_SIZE; + +- map = kzalloc(sizeof(*map), GFP_KERNEL); ++ set->dsize = ip_set_elem_len(set, tb, ++ sizeof(struct bitmap_ipmac_elem), ++ __alignof__(struct bitmap_ipmac_elem)); ++ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); + if (!map) + return -ENOMEM; + + map->memsize = bitmap_bytes(0, elements - 1); + set->variant = &bitmap_ipmac; +- set->dsize = ip_set_elem_len(set, tb, +- sizeof(struct bitmap_ipmac_elem)); + if (!init_map_ipmac(set, map, first_ip, last_ip, elements)) { + kfree(map); + return -ENOMEM; +diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c +index 5338ccd5da46..7f0c733358a4 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_port.c ++++ b/net/netfilter/ipset/ip_set_bitmap_port.c +@@ -35,12 +35,13 @@ MODULE_ALIAS("ip_set_bitmap:port"); + /* Type structure */ + struct bitmap_port { + void *members; /* the set members */ +- void *extensions; /* data extensions */ + u16 first_port; /* host byte order, included in range */ + u16 last_port; /* host byte order, included in range */ + u32 elements; /* number of max elements in the set */ + size_t memsize; /* members size */ + struct timer_list gc; /* garbage collection */ ++ unsigned char extensions[0] /* data extensions */ ++ __aligned(__alignof__(u64)); + }; + + /* ADT structure for generic function args */ +@@ -209,13 +210,6 @@ init_map_port(struct ip_set *set, struct bitmap_port *map, + map->members = ip_set_alloc(map->memsize); + if (!map->members) + return false; +- if (set->dsize) { +- map->extensions = ip_set_alloc(set->dsize * map->elements); +- if (!map->extensions) { +- kfree(map->members); +- return false; +- } +- } + map->first_port = first_port; + map->last_port = last_port; + set->timeout = IPSET_NO_TIMEOUT; +@@ -232,6 +226,7 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + { + struct bitmap_port *map; + u16 first_port, last_port; ++ u32 elements; + + if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || + !ip_set_attr_netorder(tb, IPSET_ATTR_PORT_TO) || +@@ -248,14 +243,15 @@ bitmap_port_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + last_port = tmp; + } + +- map = kzalloc(sizeof(*map), GFP_KERNEL); ++ elements = last_port - first_port + 1; ++ set->dsize = ip_set_elem_len(set, tb, 0, 0); ++ map = ip_set_alloc(sizeof(*map) + elements * set->dsize); + if (!map) + return -ENOMEM; + +- map->elements = last_port - first_port + 1; ++ map->elements = elements; + map->memsize = bitmap_bytes(0, map->elements); + set->variant = &bitmap_port; +- set->dsize = ip_set_elem_len(set, tb, 0); + if (!init_map_port(set, map, first_port, last_port)) { + kfree(map); + return -ENOMEM; +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index 338b4047776f..cab4bc06cddd 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -364,25 +364,27 @@ add_extension(enum ip_set_ext_id id, u32 flags, struct nlattr *tb[]) + } + + size_t +-ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len) ++ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len, ++ size_t align) + { + enum ip_set_ext_id id; +- size_t offset = len; + u32 cadt_flags = 0; + + if (tb[IPSET_ATTR_CADT_FLAGS]) + cadt_flags = ip_set_get_h32(tb[IPSET_ATTR_CADT_FLAGS]); + if (cadt_flags & IPSET_FLAG_WITH_FORCEADD) + set->flags |= IPSET_CREATE_FLAG_FORCEADD; ++ if (!align) ++ align = 1; + for (id = 0; id < IPSET_EXT_ID_MAX; id++) { + if (!add_extension(id, cadt_flags, tb)) + continue; +- offset = ALIGN(offset, ip_set_extensions[id].align); +- set->offset[id] = offset; ++ len = ALIGN(len, ip_set_extensions[id].align); ++ set->offset[id] = len; + set->extensions |= ip_set_extensions[id].type; +- offset += ip_set_extensions[id].len; ++ len += ip_set_extensions[id].len; + } +- return offset; ++ return ALIGN(len, align); + } + EXPORT_SYMBOL_GPL(ip_set_elem_len); + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 691b54fcaf2a..4ff22194ce55 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -72,8 +72,9 @@ struct hbucket { + DECLARE_BITMAP(used, AHASH_MAX_TUNED); + u8 size; /* size of the array */ + u8 pos; /* position of the first free entry */ +- unsigned char value[0]; /* the array of the values */ +-} __attribute__ ((aligned)); ++ unsigned char value[0] /* the array of the values */ ++ __aligned(__alignof__(u64)); ++}; + + /* The hash table: the table size stored here in order to make resizing easy */ + struct htable { +@@ -1323,12 +1324,14 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, + #endif + set->variant = &IPSET_TOKEN(HTYPE, 4_variant); + set->dsize = ip_set_elem_len(set, tb, +- sizeof(struct IPSET_TOKEN(HTYPE, 4_elem))); ++ sizeof(struct IPSET_TOKEN(HTYPE, 4_elem)), ++ __alignof__(struct IPSET_TOKEN(HTYPE, 4_elem))); + #ifndef IP_SET_PROTO_UNDEF + } else { + set->variant = &IPSET_TOKEN(HTYPE, 6_variant); + set->dsize = ip_set_elem_len(set, tb, +- sizeof(struct IPSET_TOKEN(HTYPE, 6_elem))); ++ sizeof(struct IPSET_TOKEN(HTYPE, 6_elem)), ++ __alignof__(struct IPSET_TOKEN(HTYPE, 6_elem))); + } + #endif + if (tb[IPSET_ATTR_TIMEOUT]) { +diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c +index 5a30ce6e8c90..bbede95c9f68 100644 +--- a/net/netfilter/ipset/ip_set_list_set.c ++++ b/net/netfilter/ipset/ip_set_list_set.c +@@ -31,7 +31,7 @@ struct set_elem { + struct rcu_head rcu; + struct list_head list; + ip_set_id_t id; +-}; ++} __aligned(__alignof__(u64)); + + struct set_adt_elem { + ip_set_id_t id; +@@ -618,7 +618,8 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], + size = IP_SET_LIST_MIN_SIZE; + + set->variant = &set_variant; +- set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem)); ++ set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem), ++ __alignof__(struct set_elem)); + if (!init_list_set(net, set, size)) + return -ENOMEM; + if (tb[IPSET_ATTR_TIMEOUT]) { +-- +2.4.3 + diff --git a/netfilter-ipset-Fix-hash-type-expiration.patch b/netfilter-ipset-Fix-hash-type-expiration.patch new file mode 100644 index 000000000..16ba4387f --- /dev/null +++ b/netfilter-ipset-Fix-hash-type-expiration.patch @@ -0,0 +1,30 @@ +From 7210b25e452780f0792e04dd9f84f3a02c582ab7 Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Sat, 7 Nov 2015 11:23:34 +0100 +Subject: [PATCH 2/3] netfilter: ipset: Fix hash:* type expiration + +Incorrect index was used when the data blob was shrinked at expiration, +which could lead to falsely expired entries and memory leak when +the comment extension was used too. + +Signed-off-by: Jozsef Kadlecsik +--- + net/netfilter/ipset/ip_set_hash_gen.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 4ff22194ce55..fa4f6374bb73 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -523,7 +523,7 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) + continue; + data = ahash_data(n, j, dsize); + memcpy(tmp->value + d * dsize, data, dsize); +- set_bit(j, tmp->used); ++ set_bit(d, tmp->used); + d++; + } + tmp->pos = d; +-- +2.4.3 + diff --git a/netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch b/netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch new file mode 100644 index 000000000..1f0d86373 --- /dev/null +++ b/netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch @@ -0,0 +1,47 @@ +From 03fdcf282c8fe212efae0d1229fb8594ffe60b17 Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Sat, 7 Nov 2015 11:24:51 +0100 +Subject: [PATCH 3/3] netfilter: ipset: Fix hash type expire: release empty + hash bucket block + +When all entries are expired/all slots are empty, release the bucket. + +Signed-off-by: Jozsef Kadlecsik +--- + net/netfilter/ipset/ip_set_hash_gen.h | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index fa4f6374bb73..e5336ab36d67 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -476,7 +476,7 @@ static void + mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) + { + struct htable *t; +- struct hbucket *n; ++ struct hbucket *n, *tmp; + struct mtype_elem *data; + u32 i, j, d; + #ifdef IP_SET_HASH_WITH_NETS +@@ -511,9 +511,14 @@ mtype_expire(struct ip_set *set, struct htype *h, u8 nets_length, size_t dsize) + } + } + if (d >= AHASH_INIT_SIZE) { +- struct hbucket *tmp = kzalloc(sizeof(*tmp) + +- (n->size - AHASH_INIT_SIZE) * dsize, +- GFP_ATOMIC); ++ if (d >= n->size) { ++ rcu_assign_pointer(hbucket(t, i), NULL); ++ kfree_rcu(n, rcu); ++ continue; ++ } ++ tmp = kzalloc(sizeof(*tmp) + ++ (n->size - AHASH_INIT_SIZE) * dsize, ++ GFP_ATOMIC); + if (!tmp) + /* Still try to delete expired elements */ + continue; +-- +2.4.3 + From 135f0cf49721026e8a3393eb5e93d8a12d7f2df4 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Fri, 20 Nov 2015 11:09:41 -0600 Subject: [PATCH 07/27] Fix for GRE tunnel running in IPSec (rhbz 1272571) --- ...ing-RTF_CACHE-from-a-rt-that-is-not-.patch | 91 +++++++++++++++++++ kernel.spec | 6 ++ 2 files changed, 97 insertions(+) create mode 100644 0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch diff --git a/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch b/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch new file mode 100644 index 000000000..3390024d2 --- /dev/null +++ b/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch @@ -0,0 +1,91 @@ +From 0d3f6d297bfb7af24d0508460fdb3d1ec4903fa3 Mon Sep 17 00:00:00 2001 +From: Martin KaFai Lau +Date: Wed, 11 Nov 2015 11:51:06 -0800 +Subject: [PATCH] ipv6: Avoid creating RTF_CACHE from a rt that is not managed + by fib6 tree + +The original bug report: +https://bugzilla.redhat.com/show_bug.cgi?id=1272571 + +The setup has a IPv4 GRE tunnel running in a IPSec. The bug +happens when ndisc starts sending router solicitation at the gre +interface. The simplified oops stack is like: + +__lock_acquire+0x1b2/0x1c30 +lock_acquire+0xb9/0x140 +_raw_write_lock_bh+0x3f/0x50 +__ip6_ins_rt+0x2e/0x60 +ip6_ins_rt+0x49/0x50 +~~~~~~~~ +__ip6_rt_update_pmtu.part.54+0x145/0x250 +ip6_rt_update_pmtu+0x2e/0x40 +~~~~~~~~ +ip_tunnel_xmit+0x1f1/0xf40 +__gre_xmit+0x7a/0x90 +ipgre_xmit+0x15a/0x220 +dev_hard_start_xmit+0x2bd/0x480 +__dev_queue_xmit+0x696/0x730 +dev_queue_xmit+0x10/0x20 +neigh_direct_output+0x11/0x20 +ip6_finish_output2+0x21f/0x770 +ip6_finish_output+0xa7/0x1d0 +ip6_output+0x56/0x190 +~~~~~~~~ +ndisc_send_skb+0x1d9/0x400 +ndisc_send_rs+0x88/0xc0 +~~~~~~~~ + +The rt passed to ip6_rt_update_pmtu() is created by +icmp6_dst_alloc() and it is not managed by the fib6 tree, +so its rt6i_table == NULL. When __ip6_rt_update_pmtu() creates +a RTF_CACHE clone, the newly created clone also has rt6i_table == NULL +and it causes the ip6_ins_rt() oops. + +During pmtu update, we only want to create a RTF_CACHE clone +from a rt which is currently managed (or owned) by the +fib6 tree. It means either rt->rt6i_node != NULL or +rt is a RTF_PCPU clone. + +It is worth to note that rt6i_table may not be NULL even it is +not (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()). +Hence, rt6i_node is a better check instead of rt6i_table. + +Fixes: 45e4fd26683c ("ipv6: Only create RTF_CACHE routes after encountering pmtu") +Signed-off-by: Martin KaFai Lau +Reported-by: Chris Siebenmann +Cc: Chris Siebenmann +Cc: Hannes Frederic Sowa +Signed-off-by: David S. Miller +--- + net/ipv6/route.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index c8bc9b4..74907c5 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1322,6 +1322,12 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu) + rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires); + } + ++static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) ++{ ++ return !(rt->rt6i_flags & RTF_CACHE) && ++ (rt->rt6i_flags & RTF_PCPU || rt->rt6i_node); ++} ++ + static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + const struct ipv6hdr *iph, u32 mtu) + { +@@ -1335,7 +1341,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + if (mtu >= dst_mtu(dst)) + return; + +- if (rt6->rt6i_flags & RTF_CACHE) { ++ if (!rt6_cache_allowed_for_pmtu(rt6)) { + rt6_do_update_pmtu(rt6, mtu); + } else { + const struct in6_addr *daddr, *saddr; +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index ee6b04d1c..b30ea32d9 100644 --- a/kernel.spec +++ b/kernel.spec @@ -638,6 +638,9 @@ Patch556: netfilter-ipset-Fix-extension-alignment.patch Patch557: netfilter-ipset-Fix-hash-type-expiration.patch Patch558: netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch +#rhbz 1272571 +Patch559: 0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch + # END OF PATCH DEFINITIONS %endif @@ -2082,6 +2085,9 @@ fi # # %changelog +* Fri Nov 20 2015 Justin M. Forbes +- Fix for GRE tunnel running in IPSec (rhbz 1272571) + * Mon Nov 16 2015 Josh Boyer - Fix ipset netfilter issues (rhbz 1279189) From 6064addb62169af15184884ee30f6719a1e82a45 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Fri, 20 Nov 2015 15:57:53 -0600 Subject: [PATCH 08/27] Fix KVM on specific hardware (rhbz 1278688) --- ...m_userspace_memory_region-in-x86_set.patch | 169 ++++++++++++++++++ ...p-private-slots-in-__x86_set_memory_.patch | 134 ++++++++++++++ ...M-x86-fix-previous-commit-for-32-bit.patch | 30 ++++ 3 files changed, 333 insertions(+) create mode 100644 0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch create mode 100644 0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch create mode 100644 0003-KVM-x86-fix-previous-commit-for-32-bit.patch diff --git a/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch b/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch new file mode 100644 index 000000000..6395b1746 --- /dev/null +++ b/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch @@ -0,0 +1,169 @@ +From 1d8007bdee074fdffcf3539492d8a151a1fb3436 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Mon, 12 Oct 2015 13:38:32 +0200 +Subject: [PATCH] KVM: x86: build kvm_userspace_memory_region in + x86_set_memory_region +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The next patch will make x86_set_memory_region fill the +userspace_addr. Since the struct is not used untouched +anymore, it makes sense to build it in x86_set_memory_region +directly; it also simplifies the callers. + +Reported-by: Alexandre DERUMIER +Cc: stable@vger.kernel.org +Fixes: 9da0e4d5ac969909f6b435ce28ea28135a9cbd69 +Reviewed-by: Radim Krčmář +Signed-off-by: Paolo Bonzini +--- + arch/x86/include/asm/kvm_host.h | 6 ++---- + arch/x86/kvm/vmx.c | 26 ++++++-------------------- + arch/x86/kvm/x86.c | 31 +++++++++++++------------------ + 3 files changed, 21 insertions(+), 42 deletions(-) + +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 49ec903..4e7ad7e 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -1199,9 +1199,7 @@ void kvm_complete_insn_gp(struct kvm_vcpu *vcpu, int err); + + int kvm_is_in_guest(void); + +-int __x86_set_memory_region(struct kvm *kvm, +- const struct kvm_userspace_memory_region *mem); +-int x86_set_memory_region(struct kvm *kvm, +- const struct kvm_userspace_memory_region *mem); ++int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size); ++int x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size); + + #endif /* _ASM_X86_KVM_HOST_H */ +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 18c30b4..8461e0c 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -4105,17 +4105,13 @@ static void seg_setup(int seg) + static int alloc_apic_access_page(struct kvm *kvm) + { + struct page *page; +- struct kvm_userspace_memory_region kvm_userspace_mem; + int r = 0; + + mutex_lock(&kvm->slots_lock); + if (kvm->arch.apic_access_page_done) + goto out; +- kvm_userspace_mem.slot = APIC_ACCESS_PAGE_PRIVATE_MEMSLOT; +- kvm_userspace_mem.flags = 0; +- kvm_userspace_mem.guest_phys_addr = APIC_DEFAULT_PHYS_BASE; +- kvm_userspace_mem.memory_size = PAGE_SIZE; +- r = __x86_set_memory_region(kvm, &kvm_userspace_mem); ++ r = __x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT, ++ APIC_DEFAULT_PHYS_BASE, PAGE_SIZE); + if (r) + goto out; + +@@ -4140,17 +4136,12 @@ static int alloc_identity_pagetable(struct kvm *kvm) + { + /* Called with kvm->slots_lock held. */ + +- struct kvm_userspace_memory_region kvm_userspace_mem; + int r = 0; + + BUG_ON(kvm->arch.ept_identity_pagetable_done); + +- kvm_userspace_mem.slot = IDENTITY_PAGETABLE_PRIVATE_MEMSLOT; +- kvm_userspace_mem.flags = 0; +- kvm_userspace_mem.guest_phys_addr = +- kvm->arch.ept_identity_map_addr; +- kvm_userspace_mem.memory_size = PAGE_SIZE; +- r = __x86_set_memory_region(kvm, &kvm_userspace_mem); ++ r = __x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT, ++ kvm->arch.ept_identity_map_addr, PAGE_SIZE); + + return r; + } +@@ -4949,14 +4940,9 @@ static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu) + static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr) + { + int ret; +- struct kvm_userspace_memory_region tss_mem = { +- .slot = TSS_PRIVATE_MEMSLOT, +- .guest_phys_addr = addr, +- .memory_size = PAGE_SIZE * 3, +- .flags = 0, +- }; + +- ret = x86_set_memory_region(kvm, &tss_mem); ++ ret = x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, addr, ++ PAGE_SIZE * 3); + if (ret) + return ret; + kvm->arch.tss_addr = addr; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 373328b..b12665b 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7721,18 +7721,21 @@ void kvm_arch_sync_events(struct kvm *kvm) + kvm_free_pit(kvm); + } + +-int __x86_set_memory_region(struct kvm *kvm, +- const struct kvm_userspace_memory_region *mem) ++int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) + { + int i, r; + + /* Called with kvm->slots_lock held. */ +- BUG_ON(mem->slot >= KVM_MEM_SLOTS_NUM); ++ if (WARN_ON(id >= KVM_MEM_SLOTS_NUM)) ++ return -EINVAL; + + for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { +- struct kvm_userspace_memory_region m = *mem; ++ struct kvm_userspace_memory_region m; + +- m.slot |= i << 16; ++ m.slot = id | (i << 16); ++ m.flags = 0; ++ m.guest_phys_addr = gpa; ++ m.memory_size = size; + r = __kvm_set_memory_region(kvm, &m); + if (r < 0) + return r; +@@ -7742,13 +7745,12 @@ int __x86_set_memory_region(struct kvm *kvm, + } + EXPORT_SYMBOL_GPL(__x86_set_memory_region); + +-int x86_set_memory_region(struct kvm *kvm, +- const struct kvm_userspace_memory_region *mem) ++int x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) + { + int r; + + mutex_lock(&kvm->slots_lock); +- r = __x86_set_memory_region(kvm, mem); ++ r = __x86_set_memory_region(kvm, id, gpa, size); + mutex_unlock(&kvm->slots_lock); + + return r; +@@ -7763,16 +7765,9 @@ void kvm_arch_destroy_vm(struct kvm *kvm) + * unless the the memory map has changed due to process exit + * or fd copying. + */ +- struct kvm_userspace_memory_region mem; +- memset(&mem, 0, sizeof(mem)); +- mem.slot = APIC_ACCESS_PAGE_PRIVATE_MEMSLOT; +- x86_set_memory_region(kvm, &mem); +- +- mem.slot = IDENTITY_PAGETABLE_PRIVATE_MEMSLOT; +- x86_set_memory_region(kvm, &mem); +- +- mem.slot = TSS_PRIVATE_MEMSLOT; +- x86_set_memory_region(kvm, &mem); ++ x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT, 0, 0); ++ x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT, 0, 0); ++ x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, 0, 0); + } + kvm_iommu_unmap_guest(kvm); + kfree(kvm->arch.vpic); diff --git a/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch b/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch new file mode 100644 index 000000000..261c6e10f --- /dev/null +++ b/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch @@ -0,0 +1,134 @@ +From f0d648bdf0a5bbc91da6099d5282f77996558ea4 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Mon, 12 Oct 2015 13:56:27 +0200 +Subject: [PATCH] KVM: x86: map/unmap private slots in __x86_set_memory_region +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Otherwise, two copies (one of them never populated and thus bogus) +are allocated for the regular and SMM address spaces. This breaks +SMM with EPT but without unrestricted guest support, because the +SMM copy of the identity page map is all zeros. + +By moving the allocation to the caller we also remove the last +vestiges of kernel-allocated memory regions (not accessible anymore +in userspace since commit b74a07beed0e, "KVM: Remove kernel-allocated +memory regions", 2010-06-21); that is a nice bonus. + +Reported-by: Alexandre DERUMIER +Cc: stable@vger.kernel.org +Fixes: 9da0e4d5ac969909f6b435ce28ea28135a9cbd69 +Reviewed-by: Radim Krčmář +Signed-off-by: Paolo Bonzini +--- + arch/x86/kvm/x86.c | 62 ++++++++++++++++++++++++++---------------------------- + 1 file changed, 30 insertions(+), 32 deletions(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 7bf8096..3ac33f8 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7477,23 +7477,53 @@ void kvm_arch_sync_events(struct kvm *kvm) + int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) + { + int i, r; ++ u64 hva; ++ struct kvm_memslots *slots = kvm_memslots(kvm); ++ struct kvm_memory_slot *slot, old; + + /* Called with kvm->slots_lock held. */ + if (WARN_ON(id >= KVM_MEM_SLOTS_NUM)) + return -EINVAL; + ++ slot = id_to_memslot(slots, id); ++ if (size) { ++ if (WARN_ON(slot->npages)) ++ return -EEXIST; ++ ++ /* ++ * MAP_SHARED to prevent internal slot pages from being moved ++ * by fork()/COW. ++ */ ++ hva = vm_mmap(NULL, 0, size, PROT_READ | PROT_WRITE, ++ MAP_SHARED | MAP_ANONYMOUS, 0); ++ if (IS_ERR((void *)hva)) ++ return PTR_ERR((void *)hva); ++ } else { ++ if (!slot->npages) ++ return 0; ++ ++ hva = 0; ++ } ++ ++ old = *slot; + for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { + struct kvm_userspace_memory_region m; + + m.slot = id | (i << 16); + m.flags = 0; + m.guest_phys_addr = gpa; ++ m.userspace_addr = hva; + m.memory_size = size; + r = __kvm_set_memory_region(kvm, &m); + if (r < 0) + return r; + } + ++ if (!size) { ++ r = vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE); ++ WARN_ON(r < 0); ++ } ++ + return 0; + } + EXPORT_SYMBOL_GPL(__x86_set_memory_region); +@@ -7623,27 +7653,6 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, + const struct kvm_userspace_memory_region *mem, + enum kvm_mr_change change) + { +- /* +- * Only private memory slots need to be mapped here since +- * KVM_SET_MEMORY_REGION ioctl is no longer supported. +- */ +- if ((memslot->id >= KVM_USER_MEM_SLOTS) && (change == KVM_MR_CREATE)) { +- unsigned long userspace_addr; +- +- /* +- * MAP_SHARED to prevent internal slot pages from being moved +- * by fork()/COW. +- */ +- userspace_addr = vm_mmap(NULL, 0, memslot->npages * PAGE_SIZE, +- PROT_READ | PROT_WRITE, +- MAP_SHARED | MAP_ANONYMOUS, 0); +- +- if (IS_ERR((void *)userspace_addr)) +- return PTR_ERR((void *)userspace_addr); +- +- memslot->userspace_addr = userspace_addr; +- } +- + return 0; + } + +@@ -7705,17 +7714,6 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, + { + int nr_mmu_pages = 0; + +- if (change == KVM_MR_DELETE && old->id >= KVM_USER_MEM_SLOTS) { +- int ret; +- +- ret = vm_munmap(old->userspace_addr, +- old->npages * PAGE_SIZE); +- if (ret < 0) +- printk(KERN_WARNING +- "kvm_vm_ioctl_set_memory_region: " +- "failed to munmap memory\n"); +- } +- + if (!kvm->arch.n_requested_mmu_pages) + nr_mmu_pages = kvm_mmu_calculate_mmu_pages(kvm); + +-- +2.5.0 + diff --git a/0003-KVM-x86-fix-previous-commit-for-32-bit.patch b/0003-KVM-x86-fix-previous-commit-for-32-bit.patch new file mode 100644 index 000000000..df99e60f0 --- /dev/null +++ b/0003-KVM-x86-fix-previous-commit-for-32-bit.patch @@ -0,0 +1,30 @@ +From 25188b9986cf6b0cadcf1bc1d1693a2e9c50ed47 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Wed, 14 Oct 2015 15:51:08 +0200 +Subject: [PATCH] KVM: x86: fix previous commit for 32-bit + +Unfortunately I only noticed this after pushing. + +Fixes: f0d648bdf0a5bbc91da6099d5282f77996558ea4 +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini +--- + arch/x86/kvm/x86.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 6e03546..9a9a198 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7482,7 +7482,7 @@ void kvm_arch_sync_events(struct kvm *kvm) + int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) + { + int i, r; +- u64 hva; ++ unsigned long hva; + struct kvm_memslots *slots = kvm_memslots(kvm); + struct kvm_memory_slot *slot, old; + +-- +2.5.0 + From 72aba9054ae0c3aa60595eb9481f43a22f1c5b39 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Fri, 20 Nov 2015 15:59:38 -0600 Subject: [PATCH 09/27] Fix KVM on specific hardware (rhbz 1278688) --- kernel.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel.spec b/kernel.spec index b30ea32d9..24c977b87 100644 --- a/kernel.spec +++ b/kernel.spec @@ -40,7 +40,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 300 +%global baserelease 301 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -641,6 +641,11 @@ Patch558: netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch #rhbz 1272571 Patch559: 0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch +#rhbz 1278688 +Patch560: 0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch +Patch561: 0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch +Patch562: 0003-KVM-x86-fix-previous-commit-for-32-bit.patch + # END OF PATCH DEFINITIONS %endif @@ -2087,6 +2092,7 @@ fi %changelog * Fri Nov 20 2015 Justin M. Forbes - Fix for GRE tunnel running in IPSec (rhbz 1272571) +- Fix KVM on specific hardware (rhbz 1278688) * Mon Nov 16 2015 Josh Boyer - Fix ipset netfilter issues (rhbz 1279189) From 013ffed6574d7f8cc7fd65f39919f6e27b169403 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 30 Nov 2015 08:24:14 -0500 Subject: [PATCH 10/27] CVE-2015-8374 btrfs: info leak when truncating compressed/inlined extents (rhbz 1286261 1286262) --- ...tion-of-compressed-and-inlined-exten.patch | 288 ++++++++++++++++++ kernel.spec | 6 + 2 files changed, 294 insertions(+) create mode 100644 Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch diff --git a/Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch b/Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch new file mode 100644 index 000000000..1212966ef --- /dev/null +++ b/Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch @@ -0,0 +1,288 @@ +From 0305cd5f7fca85dae392b9ba85b116896eb7c1c7 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Fri, 16 Oct 2015 12:34:25 +0100 +Subject: [PATCH] Btrfs: fix truncation of compressed and inlined extents + +When truncating a file to a smaller size which consists of an inline +extent that is compressed, we did not discard (or made unusable) the +data between the new file size and the old file size, wasting metadata +space and allowing for the truncated data to be leaked and the data +corruption/loss mentioned below. +We were also not correctly decrementing the number of bytes used by the +inode, we were setting it to zero, giving a wrong report for callers of +the stat(2) syscall. The fsck tool also reported an error about a mismatch +between the nbytes of the file versus the real space used by the file. + +Now because we weren't discarding the truncated region of the file, it +was possible for a caller of the clone ioctl to actually read the data +that was truncated, allowing for a security breach without requiring root +access to the system, using only standard filesystem operations. The +scenario is the following: + + 1) User A creates a file which consists of an inline and compressed + extent with a size of 2000 bytes - the file is not accessible to + any other users (no read, write or execution permission for anyone + else); + + 2) The user truncates the file to a size of 1000 bytes; + + 3) User A makes the file world readable; + + 4) User B creates a file consisting of an inline extent of 2000 bytes; + + 5) User B issues a clone operation from user A's file into its own + file (using a length argument of 0, clone the whole range); + + 6) User B now gets to see the 1000 bytes that user A truncated from + its file before it made its file world readbale. User B also lost + the bytes in the range [1000, 2000[ bytes from its own file, but + that might be ok if his/her intention was reading stale data from + user A that was never supposed to be public. + +Note that this contrasts with the case where we truncate a file from 2000 +bytes to 1000 bytes and then truncate it back from 1000 to 2000 bytes. In +this case reading any byte from the range [1000, 2000[ will return a value +of 0x00, instead of the original data. + +This problem exists since the clone ioctl was added and happens both with +and without my recent data loss and file corruption fixes for the clone +ioctl (patch "Btrfs: fix file corruption and data loss after cloning +inline extents"). + +So fix this by truncating the compressed inline extents as we do for the +non-compressed case, which involves decompressing, if the data isn't already +in the page cache, compressing the truncated version of the extent, writing +the compressed content into the inline extent and then truncate it. + +The following test case for fstests reproduces the problem. In order for +the test to pass both this fix and my previous fix for the clone ioctl +that forbids cloning a smaller inline extent into a larger one, +which is titled "Btrfs: fix file corruption and data loss after cloning +inline extents", are needed. Without that other fix the test fails in a +different way that does not leak the truncated data, instead part of +destination file gets replaced with zeroes (because the destination file +has a larger inline extent than the source). + + seq=`basename $0` + seqres=$RESULT_DIR/$seq + echo "QA output created by $seq" + tmp=/tmp/$$ + status=1 # failure is the default! + trap "_cleanup; exit \$status" 0 1 2 3 15 + + _cleanup() + { + rm -f $tmp.* + } + + # get standard environment, filters and checks + . ./common/rc + . ./common/filter + + # real QA test starts here + _need_to_be_root + _supported_fs btrfs + _supported_os Linux + _require_scratch + _require_cloner + + rm -f $seqres.full + + _scratch_mkfs >>$seqres.full 2>&1 + _scratch_mount "-o compress" + + # Create our test files. File foo is going to be the source of a clone operation + # and consists of a single inline extent with an uncompressed size of 512 bytes, + # while file bar consists of a single inline extent with an uncompressed size of + # 256 bytes. For our test's purpose, it's important that file bar has an inline + # extent with a size smaller than foo's inline extent. + $XFS_IO_PROG -f -c "pwrite -S 0xa1 0 128" \ + -c "pwrite -S 0x2a 128 384" \ + $SCRATCH_MNT/foo | _filter_xfs_io + $XFS_IO_PROG -f -c "pwrite -S 0xbb 0 256" $SCRATCH_MNT/bar | _filter_xfs_io + + # Now durably persist all metadata and data. We do this to make sure that we get + # on disk an inline extent with a size of 512 bytes for file foo. + sync + + # Now truncate our file foo to a smaller size. Because it consists of a + # compressed and inline extent, btrfs did not shrink the inline extent to the + # new size (if the extent was not compressed, btrfs would shrink it to 128 + # bytes), it only updates the inode's i_size to 128 bytes. + $XFS_IO_PROG -c "truncate 128" $SCRATCH_MNT/foo + + # Now clone foo's inline extent into bar. + # This clone operation should fail with errno EOPNOTSUPP because the source + # file consists only of an inline extent and the file's size is smaller than + # the inline extent of the destination (128 bytes < 256 bytes). However the + # clone ioctl was not prepared to deal with a file that has a size smaller + # than the size of its inline extent (something that happens only for compressed + # inline extents), resulting in copying the full inline extent from the source + # file into the destination file. + # + # Note that btrfs' clone operation for inline extents consists of removing the + # inline extent from the destination inode and copy the inline extent from the + # source inode into the destination inode, meaning that if the destination + # inode's inline extent is larger (N bytes) than the source inode's inline + # extent (M bytes), some bytes (N - M bytes) will be lost from the destination + # file. Btrfs could copy the source inline extent's data into the destination's + # inline extent so that we would not lose any data, but that's currently not + # done due to the complexity that would be needed to deal with such cases + # (specially when one or both extents are compressed), returning EOPNOTSUPP, as + # it's normally not a very common case to clone very small files (only case + # where we get inline extents) and copying inline extents does not save any + # space (unlike for normal, non-inlined extents). + $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/foo $SCRATCH_MNT/bar + + # Now because the above clone operation used to succeed, and due to foo's inline + # extent not being shinked by the truncate operation, our file bar got the whole + # inline extent copied from foo, making us lose the last 128 bytes from bar + # which got replaced by the bytes in range [128, 256[ from foo before foo was + # truncated - in other words, data loss from bar and being able to read old and + # stale data from foo that should not be possible to read anymore through normal + # filesystem operations. Contrast with the case where we truncate a file from a + # size N to a smaller size M, truncate it back to size N and then read the range + # [M, N[, we should always get the value 0x00 for all the bytes in that range. + + # We expected the clone operation to fail with errno EOPNOTSUPP and therefore + # not modify our file's bar data/metadata. So its content should be 256 bytes + # long with all bytes having the value 0xbb. + # + # Without the btrfs bug fix, the clone operation succeeded and resulted in + # leaking truncated data from foo, the bytes that belonged to its range + # [128, 256[, and losing data from bar in that same range. So reading the + # file gave us the following content: + # + # 0000000 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 + # * + # 0000200 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a + # * + # 0000400 + echo "File bar's content after the clone operation:" + od -t x1 $SCRATCH_MNT/bar + + # Also because the foo's inline extent was not shrunk by the truncate + # operation, btrfs' fsck, which is run by the fstests framework everytime a + # test completes, failed reporting the following error: + # + # root 5 inode 257 errors 400, nbytes wrong + + status=0 + exit + +Cc: stable@vger.kernel.org +Signed-off-by: Filipe Manana +--- + fs/btrfs/inode.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++---------- + 1 file changed, 68 insertions(+), 14 deletions(-) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 208db4e835f0..cbb4286490a1 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4217,6 +4217,47 @@ static int truncate_space_check(struct btrfs_trans_handle *trans, + + } + ++static int truncate_inline_extent(struct inode *inode, ++ struct btrfs_path *path, ++ struct btrfs_key *found_key, ++ const u64 item_end, ++ const u64 new_size) ++{ ++ struct extent_buffer *leaf = path->nodes[0]; ++ int slot = path->slots[0]; ++ struct btrfs_file_extent_item *fi; ++ u32 size = (u32)(new_size - found_key->offset); ++ struct btrfs_root *root = BTRFS_I(inode)->root; ++ ++ fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item); ++ ++ if (btrfs_file_extent_compression(leaf, fi) != BTRFS_COMPRESS_NONE) { ++ loff_t offset = new_size; ++ loff_t page_end = ALIGN(offset, PAGE_CACHE_SIZE); ++ ++ /* ++ * Zero out the remaining of the last page of our inline extent, ++ * instead of directly truncating our inline extent here - that ++ * would be much more complex (decompressing all the data, then ++ * compressing the truncated data, which might be bigger than ++ * the size of the inline extent, resize the extent, etc). ++ * We release the path because to get the page we might need to ++ * read the extent item from disk (data not in the page cache). ++ */ ++ btrfs_release_path(path); ++ return btrfs_truncate_page(inode, offset, page_end - offset, 0); ++ } ++ ++ btrfs_set_file_extent_ram_bytes(leaf, fi, size); ++ size = btrfs_file_extent_calc_inline_size(size); ++ btrfs_truncate_item(root, path, size, 1); ++ ++ if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) ++ inode_sub_bytes(inode, item_end + 1 - new_size); ++ ++ return 0; ++} ++ + /* + * this can truncate away extent items, csum items and directory items. + * It starts at a high offset and removes keys until it can't find +@@ -4411,27 +4452,40 @@ search_again: + * special encodings + */ + if (!del_item && +- btrfs_file_extent_compression(leaf, fi) == 0 && + btrfs_file_extent_encryption(leaf, fi) == 0 && + btrfs_file_extent_other_encoding(leaf, fi) == 0) { +- u32 size = new_size - found_key.offset; +- +- if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) +- inode_sub_bytes(inode, item_end + 1 - +- new_size); + + /* +- * update the ram bytes to properly reflect +- * the new size of our item ++ * Need to release path in order to truncate a ++ * compressed extent. So delete any accumulated ++ * extent items so far. + */ +- btrfs_set_file_extent_ram_bytes(leaf, fi, size); +- size = +- btrfs_file_extent_calc_inline_size(size); +- btrfs_truncate_item(root, path, size, 1); ++ if (btrfs_file_extent_compression(leaf, fi) != ++ BTRFS_COMPRESS_NONE && pending_del_nr) { ++ err = btrfs_del_items(trans, root, path, ++ pending_del_slot, ++ pending_del_nr); ++ if (err) { ++ btrfs_abort_transaction(trans, ++ root, ++ err); ++ goto error; ++ } ++ pending_del_nr = 0; ++ } ++ ++ err = truncate_inline_extent(inode, path, ++ &found_key, ++ item_end, ++ new_size); ++ if (err) { ++ btrfs_abort_transaction(trans, ++ root, err); ++ goto error; ++ } + } else if (test_bit(BTRFS_ROOT_REF_COWS, + &root->state)) { +- inode_sub_bytes(inode, item_end + 1 - +- found_key.offset); ++ inode_sub_bytes(inode, item_end + 1 - new_size); + } + } + delete: +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 24c977b87..f213f0a09 100644 --- a/kernel.spec +++ b/kernel.spec @@ -646,6 +646,9 @@ Patch560: 0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch Patch561: 0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch Patch562: 0003-KVM-x86-fix-previous-commit-for-32-bit.patch +#CVE-2015-8374 rhbz 1286261 1286262 +Patch565: Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch + # END OF PATCH DEFINITIONS %endif @@ -2090,6 +2093,9 @@ fi # # %changelog +* Mon Nov 30 2015 Josh Boyer +- CVE-2015-8374 btrfs: info leak when truncating compressed/inlined extents (rhbz 1286261 1286262) + * Fri Nov 20 2015 Justin M. Forbes - Fix for GRE tunnel running in IPSec (rhbz 1272571) - Fix KVM on specific hardware (rhbz 1278688) From c1385c8a2670471e54caf7ab334ac418c799334f Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 30 Nov 2015 09:46:14 -0500 Subject: [PATCH 11/27] Fix crash in add_key (rhbz 1284059) --- ...g-of-stored-error-in-a-negatively-in.patch | 125 ++++++++++++++++++ kernel.spec | 4 + 2 files changed, 129 insertions(+) create mode 100644 KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch diff --git a/KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch b/KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch new file mode 100644 index 000000000..3837037e8 --- /dev/null +++ b/KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch @@ -0,0 +1,125 @@ +From 3b34bea74e636583d34c8e472237a0bea1e3ba93 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 24 Nov 2015 21:36:31 +0000 +Subject: [PATCH] KEYS: Fix handling of stored error in a negatively + instantiated user key + +If a user key gets negatively instantiated, an error code is cached in the +payload area. A negatively instantiated key may be then be positively +instantiated by updating it with valid data. However, the ->update key +type method must be aware that the error code may be there. + +The following may be used to trigger the bug in the user key type: + + keyctl request2 user user "" @u + keyctl add user user "a" @u + +which manifests itself as: + + BUG: unable to handle kernel paging request at 00000000ffffff8a + IP: [] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046 + PGD 7cc30067 PUD 0 + Oops: 0002 [#1] SMP + Modules linked in: + CPU: 3 PID: 2644 Comm: a.out Not tainted 4.3.0+ #49 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 + task: ffff88003ddea700 ti: ffff88003dd88000 task.ti: ffff88003dd88000 + RIP: 0010:[] [] __call_rcu.constprop.76+0x1f/0x280 + [] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046 + RSP: 0018:ffff88003dd8bdb0 EFLAGS: 00010246 + RAX: 00000000ffffff82 RBX: 0000000000000000 RCX: 0000000000000001 + RDX: ffffffff81e3fe40 RSI: 0000000000000000 RDI: 00000000ffffff82 + RBP: ffff88003dd8bde0 R08: ffff88007d2d2da0 R09: 0000000000000000 + R10: 0000000000000000 R11: ffff88003e8073c0 R12: 00000000ffffff82 + R13: ffff88003dd8be68 R14: ffff88007d027600 R15: ffff88003ddea700 + FS: 0000000000b92880(0063) GS:ffff88007fd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 00000000ffffff8a CR3: 000000007cc5f000 CR4: 00000000000006e0 + Stack: + ffff88003dd8bdf0 ffffffff81160a8a 0000000000000000 00000000ffffff82 + ffff88003dd8be68 ffff88007d027600 ffff88003dd8bdf0 ffffffff810a39e5 + ffff88003dd8be20 ffffffff812a31ab ffff88007d027600 ffff88007d027620 + Call Trace: + [] kfree_call_rcu+0x15/0x20 kernel/rcu/tree.c:3136 + [] user_update+0x8b/0xb0 security/keys/user_defined.c:129 + [< inline >] __key_update security/keys/key.c:730 + [] key_create_or_update+0x291/0x440 security/keys/key.c:908 + [< inline >] SYSC_add_key security/keys/keyctl.c:125 + [] SyS_add_key+0x101/0x1e0 security/keys/keyctl.c:60 + [] entry_SYSCALL_64_fastpath+0x12/0x6a arch/x86/entry/entry_64.S:185 + +Note the error code (-ENOKEY) in EDX. + +A similar bug can be tripped by: + + keyctl request2 trusted user "" @u + keyctl add trusted user "a" @u + +This should also affect encrypted keys - but that has to be correctly +parameterised or it will fail with EINVAL before getting to the bit that +will crashes. + +Reported-by: Dmitry Vyukov +Signed-off-by: David Howells +Acked-by: Mimi Zohar +Signed-off-by: James Morris +--- + security/keys/encrypted-keys/encrypted.c | 2 ++ + security/keys/trusted.c | 5 ++++- + security/keys/user_defined.c | 5 ++++- + 3 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c +index 7bed4ad7cd76..0a374a2ce030 100644 +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -845,6 +845,8 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep) + size_t datalen = prep->datalen; + int ret = 0; + ++ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) ++ return -ENOKEY; + if (datalen <= 0 || datalen > 32767 || !prep->data) + return -EINVAL; + +diff --git a/security/keys/trusted.c b/security/keys/trusted.c +index c0594cb07ada..aeb38f1a12e7 100644 +--- a/security/keys/trusted.c ++++ b/security/keys/trusted.c +@@ -984,13 +984,16 @@ static void trusted_rcu_free(struct rcu_head *rcu) + */ + static int trusted_update(struct key *key, struct key_preparsed_payload *prep) + { +- struct trusted_key_payload *p = key->payload.data; ++ struct trusted_key_payload *p; + struct trusted_key_payload *new_p; + struct trusted_key_options *new_o; + size_t datalen = prep->datalen; + char *datablob; + int ret = 0; + ++ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) ++ return -ENOKEY; ++ p = key->payload.data; + if (!p->migratable) + return -EPERM; + if (datalen <= 0 || datalen > 32767 || !prep->data) +diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c +index 36b47bbd3d8c..7cf22260bdff 100644 +--- a/security/keys/user_defined.c ++++ b/security/keys/user_defined.c +@@ -120,7 +120,10 @@ int user_update(struct key *key, struct key_preparsed_payload *prep) + + if (ret == 0) { + /* attach the new data, displacing the old */ +- zap = key->payload.data; ++ if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags)) ++ zap = key->payload.data; ++ else ++ zap = NULL; + rcu_assign_keypointer(key, upayload); + key->expiry = 0; + } +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index f213f0a09..285baaa4d 100644 --- a/kernel.spec +++ b/kernel.spec @@ -649,6 +649,9 @@ Patch562: 0003-KVM-x86-fix-previous-commit-for-32-bit.patch #CVE-2015-8374 rhbz 1286261 1286262 Patch565: Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch +#rhbz 1284059 +Patch566: KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch + # END OF PATCH DEFINITIONS %endif @@ -2094,6 +2097,7 @@ fi # %changelog * Mon Nov 30 2015 Josh Boyer +- Fix crash in add_key (rhbz 1284059) - CVE-2015-8374 btrfs: info leak when truncating compressed/inlined extents (rhbz 1286261 1286262) * Fri Nov 20 2015 Justin M. Forbes From 3bb9b28cd9e2031a04eb4b82414d881bda2669ac Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Tue, 1 Dec 2015 09:12:15 -0600 Subject: [PATCH 12/27] Tag the 4.2.6-301 build --- kernel.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel.spec b/kernel.spec index 285baaa4d..1acb28913 100644 --- a/kernel.spec +++ b/kernel.spec @@ -2100,7 +2100,7 @@ fi - Fix crash in add_key (rhbz 1284059) - CVE-2015-8374 btrfs: info leak when truncating compressed/inlined extents (rhbz 1286261 1286262) -* Fri Nov 20 2015 Justin M. Forbes +* Fri Nov 20 2015 Justin M. Forbes - 4.2.6-301 - Fix for GRE tunnel running in IPSec (rhbz 1272571) - Fix KVM on specific hardware (rhbz 1278688) From 6ba2a2ca010070abcef6744440e5e2dbf977d101 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 1 Dec 2015 14:55:42 -0500 Subject: [PATCH 13/27] CVE-2015-7833 usbvision: crash on invalid device descriptors (rhbz 1270158 1270160) --- kernel.spec | 6 +++ ...ash-on-detecting-device-with-invalid.patch | 49 +++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 usbvision-fix-crash-on-detecting-device-with-invalid.patch diff --git a/kernel.spec b/kernel.spec index 1acb28913..25fdfc67d 100644 --- a/kernel.spec +++ b/kernel.spec @@ -652,6 +652,9 @@ Patch565: Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch #rhbz 1284059 Patch566: KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch +#CVE-2015-7833 rhbz 1270158 1270160 +Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch + # END OF PATCH DEFINITIONS %endif @@ -2096,6 +2099,9 @@ fi # # %changelog +* Tue Dec 01 2015 Josh Boyer +- CVE-2015-7833 usbvision: crash on invalid device descriptors (rhbz 1270158 1270160) + * Mon Nov 30 2015 Josh Boyer - Fix crash in add_key (rhbz 1284059) - CVE-2015-8374 btrfs: info leak when truncating compressed/inlined extents (rhbz 1286261 1286262) diff --git a/usbvision-fix-crash-on-detecting-device-with-invalid.patch b/usbvision-fix-crash-on-detecting-device-with-invalid.patch new file mode 100644 index 000000000..a03e37907 --- /dev/null +++ b/usbvision-fix-crash-on-detecting-device-with-invalid.patch @@ -0,0 +1,49 @@ +From 2ea39fc263c6a7589e15edb7d2d1c89fa569be53 Mon Sep 17 00:00:00 2001 +From: Vladis Dronov +Date: Mon, 16 Nov 2015 15:55:11 -0200 +Subject: [PATCH] usbvision: fix crash on detecting device with invalid + configuration + +The usbvision driver crashes when a specially crafted usb device with invalid +number of interfaces or endpoints is detected. This fix adds checks that the +device has proper configuration expected by the driver. + +Reported-by: Ralf Spenneberg +Signed-off-by: Vladis Dronov +Signed-off-by: Mauro Carvalho Chehab +--- + drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c +index b693206f66dd..d1dc1a198e3e 100644 +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1463,9 +1463,23 @@ static int usbvision_probe(struct usb_interface *intf, + + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; +- else ++ else if (ifnum < dev->actconfig->desc.bNumInterfaces) + interface = &dev->actconfig->interface[ifnum]->altsetting[0]; ++ else { ++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", ++ ifnum, dev->actconfig->desc.bNumInterfaces - 1); ++ ret = -ENODEV; ++ goto err_usb; ++ } ++ ++ if (interface->desc.bNumEndpoints < 2) { ++ dev_err(&intf->dev, "interface %d has %d endpoints, but must" ++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); ++ ret = -ENODEV; ++ goto err_usb; ++ } + endpoint = &interface->endpoint[1].desc; ++ + if (!usb_endpoint_xfer_isoc(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", + __func__, ifnum); +-- +2.5.0 + From ac2ee525371a61b95d5742472bf4e6be440d0fa4 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 1 Dec 2015 15:03:20 -0500 Subject: [PATCH 14/27] CVE-2015-7515 aiptek: crash on invalid device descriptors (rhbz 1285326 1285331) --- ...-crash-on-detecting-device-without-e.patch | 48 +++++++++++++++++++ kernel.spec | 4 ++ 2 files changed, 52 insertions(+) create mode 100644 Input-aiptek-fix-crash-on-detecting-device-without-e.patch diff --git a/Input-aiptek-fix-crash-on-detecting-device-without-e.patch b/Input-aiptek-fix-crash-on-detecting-device-without-e.patch new file mode 100644 index 000000000..19dbaa343 --- /dev/null +++ b/Input-aiptek-fix-crash-on-detecting-device-without-e.patch @@ -0,0 +1,48 @@ +From a0edc539fda3f0a4a271f47a0fcf79d1305c1444 Mon Sep 17 00:00:00 2001 +From: Vladis Dronov +Date: Wed, 25 Nov 2015 16:31:35 +0100 +Subject: [PATCH] Input: aiptek: fix crash on detecting device without + endpoints + +The aiptek driver crashes in aiptek_probe() when a specially crafted usb device +without endpoints is detected. This fix adds a check that the device has proper +configuration expected by the driver. Also an error return value is changed to +more matching one in one of the error paths. + +Reported-by: Ralf Spenneberg +Signed-off-by: Vladis Dronov +--- + drivers/input/tablet/aiptek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c +index e7f966da6efa..78c0732fbb57 100644 +--- a/drivers/input/tablet/aiptek.c ++++ b/drivers/input/tablet/aiptek.c +@@ -1819,6 +1819,15 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) + input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0); + input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0); + ++ /* Verify that a device really has an endpoint ++ */ ++ if (intf->altsetting[0].desc.bNumEndpoints < 1) { ++ dev_warn(&intf->dev, ++ "interface has %d endpoints, but must have minimum 1\n", ++ intf->altsetting[0].desc.bNumEndpoints); ++ err = -ENODEV; ++ goto fail3; ++ } + endpoint = &intf->altsetting[0].endpoint[0].desc; + + /* Go set up our URB, which is called when the tablet receives +@@ -1861,6 +1870,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) + if (i == ARRAY_SIZE(speeds)) { + dev_info(&intf->dev, + "Aiptek tried all speeds, no sane response\n"); ++ err = -ENODEV; + goto fail3; + } + +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 25fdfc67d..91b19d857 100644 --- a/kernel.spec +++ b/kernel.spec @@ -655,6 +655,9 @@ Patch566: KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch #CVE-2015-7833 rhbz 1270158 1270160 Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch +#CVE-2015-7515 rhbz 1285326 1285331 +Patch568: Input-aiptek-fix-crash-on-detecting-device-without-e.patch + # END OF PATCH DEFINITIONS %endif @@ -2100,6 +2103,7 @@ fi # %changelog * Tue Dec 01 2015 Josh Boyer +- CVE-2015-7515 aiptek: crash on invalid device descriptors (rhbz 1285326 1285331) - CVE-2015-7833 usbvision: crash on invalid device descriptors (rhbz 1270158 1270160) * Mon Nov 30 2015 Josh Boyer From 0897fc4b19afd0b79d56ef4d053c5f49550359c8 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Thu, 3 Dec 2015 08:37:26 -0500 Subject: [PATCH 15/27] Add new PCI ids for wireless, including Lenovo Yoga (rhbz 1275490) --- ...-Add-new-PCI-IDs-for-the-8260-series.patch | 75 +++++++++++++++++++ kernel.spec | 6 ++ 2 files changed, 81 insertions(+) create mode 100644 0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch diff --git a/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch b/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch new file mode 100644 index 000000000..4bb863192 --- /dev/null +++ b/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch @@ -0,0 +1,75 @@ +From 35069d255591dad72c2197ccc8c536fc5a9f294f Mon Sep 17 00:00:00 2001 +From: Oren Givon +Date: Wed, 28 Oct 2015 12:32:20 +0200 +Subject: [PATCH] iwlwifi: Add new PCI IDs for the 8260 series + +Add some new PCI IDs for the 8260 series which were missing. +The following sub-system IDs were added: +0x0130, 0x1130, 0x0132, 0x1132, 0x1150, 0x8110, 0x9110, 0x8130, +0x9130, 0x8132, 0x9132, 0x8150, 0x9150, 0x0044, 0x0930 + +Signed-off-by: Oren Givon +Signed-off-by: Emmanuel Grumbach +--- + drivers/net/wireless/iwlwifi/pcie/drv.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c +index 644b58b..639761f 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c +@@ -423,14 +423,21 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + /* 8000 Series */ + {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1132, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0110, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x01F0, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0012, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1012, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1110, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0250, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x1050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0150, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x1150, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)}, +- {IWL_PCI_DEVICE(0x24F4, 0x1130, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x1030, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xC010, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xC110, iwl8260_2ac_cfg)}, +@@ -438,18 +445,28 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9110, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x8030, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F4, 0x9030, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9130, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8132, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9132, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x8050, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x8150, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x9050, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x9150, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0044, iwl8260_2n_cfg)}, + {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0810, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0910, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0850, iwl8260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x24F3, 0x0950, iwl8260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x24F3, 0x0930, iwl8260_2ac_cfg)}, + #endif /* CONFIG_IWLMVM */ + + {0} +-- +2.4.3 + diff --git a/kernel.spec b/kernel.spec index 91b19d857..59101b7d4 100644 --- a/kernel.spec +++ b/kernel.spec @@ -658,6 +658,9 @@ Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch #CVE-2015-7515 rhbz 1285326 1285331 Patch568: Input-aiptek-fix-crash-on-detecting-device-without-e.patch +#rhbz 1275490 +Patch569: 0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch + # END OF PATCH DEFINITIONS %endif @@ -2102,6 +2105,9 @@ fi # # %changelog +* Thu Dec 03 2015 Josh Boyer +- Add new PCI ids for wireless, including Lenovo Yoga (rhbz 1275490) + * Tue Dec 01 2015 Josh Boyer - CVE-2015-7515 aiptek: crash on invalid device descriptors (rhbz 1285326 1285331) - CVE-2015-7833 usbvision: crash on invalid device descriptors (rhbz 1270158 1270160) From 98ef9c89a35265668e8e96647c380249e88cb079 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Thu, 3 Dec 2015 10:59:46 -0500 Subject: [PATCH 16/27] Add patch to fix palm rejection on certain touchpads (rhbz 1287819) --- ...nable-palm-rejection-if-device-imple.patch | 41 +++++++++++++++++++ kernel.spec | 4 ++ 2 files changed, 45 insertions(+) create mode 100644 HID-multitouch-enable-palm-rejection-if-device-imple.patch diff --git a/HID-multitouch-enable-palm-rejection-if-device-imple.patch b/HID-multitouch-enable-palm-rejection-if-device-imple.patch new file mode 100644 index 000000000..b9753fce7 --- /dev/null +++ b/HID-multitouch-enable-palm-rejection-if-device-imple.patch @@ -0,0 +1,41 @@ +From 37e81f1a82ba4f214c05c4cc3807378753c7a867 Mon Sep 17 00:00:00 2001 +From: Allen Hung +Date: Fri, 20 Nov 2015 18:21:06 +0800 +Subject: [PATCH] HID: multitouch: enable palm rejection if device implements + confidence usage + +The usage Confidence is mandary to Windows Precision Touchpad devices. The +appearance of this usage is checked in hidinput_connect but the quirk +MT_QUIRK_VALID_IS_CONFIDENCE is not applied to device accordingly. +Apply this quirk and also remove quirk MT_QUIRK_ALWAYS_VALID to enable palm +rejection for the WIN 8 touchpad devices which have implemented usage +Confidence in its input reports. + +Tested on Dell XPS 13 laptop. + +Signed-off-by: Allen Hung +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +--- + drivers/hid/hid-multitouch.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 7c811252c1ce..0c94348a168d 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -448,6 +448,11 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, + mt_store_field(usage, td, hi); + return 1; + case HID_DG_CONFIDENCE: ++ if (cls->name == MT_CLS_WIN_8 && ++ field->application == HID_DG_TOUCHPAD) { ++ cls->quirks &= ~MT_QUIRK_ALWAYS_VALID; ++ cls->quirks |= MT_QUIRK_VALID_IS_CONFIDENCE; ++ } + mt_store_field(usage, td, hi); + return 1; + case HID_DG_TIPSWITCH: +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 59101b7d4..2f62ddd4b 100644 --- a/kernel.spec +++ b/kernel.spec @@ -661,6 +661,9 @@ Patch568: Input-aiptek-fix-crash-on-detecting-device-without-e.patch #rhbz 1275490 Patch569: 0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch +#rhbz 1287819 +Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch + # END OF PATCH DEFINITIONS %endif @@ -2106,6 +2109,7 @@ fi # %changelog * Thu Dec 03 2015 Josh Boyer +- Add patch to fix palm rejection on certain touchpads (rhbz 1287819) - Add new PCI ids for wireless, including Lenovo Yoga (rhbz 1275490) * Tue Dec 01 2015 Josh Boyer From 827b8d0864402142f735d3e8cef8d20ae094e2d7 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Wed, 9 Dec 2015 16:00:11 -0600 Subject: [PATCH 17/27] Linux v4.2.7 --- ...-Add-new-PCI-IDs-for-the-8260-series.patch | 75 ------------------ ...nderlying-transport-exists-before-cr.patch | 79 ------------------- kernel.spec | 15 ++-- sources | 2 +- 4 files changed, 6 insertions(+), 165 deletions(-) delete mode 100644 0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch delete mode 100644 RDS-verify-the-underlying-transport-exists-before-cr.patch diff --git a/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch b/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch deleted file mode 100644 index 4bb863192..000000000 --- a/0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 35069d255591dad72c2197ccc8c536fc5a9f294f Mon Sep 17 00:00:00 2001 -From: Oren Givon -Date: Wed, 28 Oct 2015 12:32:20 +0200 -Subject: [PATCH] iwlwifi: Add new PCI IDs for the 8260 series - -Add some new PCI IDs for the 8260 series which were missing. -The following sub-system IDs were added: -0x0130, 0x1130, 0x0132, 0x1132, 0x1150, 0x8110, 0x9110, 0x8130, -0x9130, 0x8132, 0x9132, 0x8150, 0x9150, 0x0044, 0x0930 - -Signed-off-by: Oren Givon -Signed-off-by: Emmanuel Grumbach ---- - drivers/net/wireless/iwlwifi/pcie/drv.c | 19 ++++++++++++++++++- - 1 file changed, 18 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c -index 644b58b..639761f 100644 ---- a/drivers/net/wireless/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c -@@ -423,14 +423,21 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - /* 8000 Series */ - {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1132, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0110, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x01F0, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0012, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1012, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1110, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0250, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x1050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0150, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x1150, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)}, -- {IWL_PCI_DEVICE(0x24F4, 0x1130, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x1030, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xC010, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xC110, iwl8260_2ac_cfg)}, -@@ -438,18 +445,28 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9110, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x8030, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F4, 0x9030, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9130, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8132, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9132, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x8050, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x8150, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x9050, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x9150, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0044, iwl8260_2n_cfg)}, - {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0810, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0910, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0850, iwl8260_2ac_cfg)}, - {IWL_PCI_DEVICE(0x24F3, 0x0950, iwl8260_2ac_cfg)}, -+ {IWL_PCI_DEVICE(0x24F3, 0x0930, iwl8260_2ac_cfg)}, - #endif /* CONFIG_IWLMVM */ - - {0} --- -2.4.3 - diff --git a/RDS-verify-the-underlying-transport-exists-before-cr.patch b/RDS-verify-the-underlying-transport-exists-before-cr.patch deleted file mode 100644 index eb39c1f1d..000000000 --- a/RDS-verify-the-underlying-transport-exists-before-cr.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 74e98eb085889b0d2d4908f59f6e00026063014f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 8 Sep 2015 10:53:40 -0400 -Subject: [PATCH] RDS: verify the underlying transport exists before creating a - connection - -There was no verification that an underlying transport exists when creating -a connection, this would cause dereferencing a NULL ptr. - -It might happen on sockets that weren't properly bound before attempting to -send a message, which will cause a NULL ptr deref: - -[135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN -[135546.051270] Modules linked in: -[135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527 -[135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000 -[135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194) -[135546.055666] RSP: 0018:ffff8800bc70fab0 EFLAGS: 00010202 -[135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000 -[135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038 -[135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000 -[135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000 -[135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000 -[135546.061668] FS: 00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000 -[135546.062836] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b -[135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0 -[135546.064723] Stack: -[135546.065048] ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008 -[135546.066247] 0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342 -[135546.067438] 1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00 -[135546.068629] Call Trace: -[135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134) -[135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298) -[135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278) -[135546.071981] rds_sendmsg (net/rds/send.c:1058) -[135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38) -[135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298) -[135546.074577] ? rds_send_drop_to (net/rds/send.c:976) -[135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795) -[135546.076349] ? __might_fault (mm/memory.c:3795) -[135546.077179] ? rds_send_drop_to (net/rds/send.c:976) -[135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620) -[135546.078856] SYSC_sendto (net/socket.c:1657) -[135546.079596] ? SYSC_connect (net/socket.c:1628) -[135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926) -[135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674) -[135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) -[135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16) -[135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16) -[135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749) -[135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1 - -Acked-by: Santosh Shilimkar -Signed-off-by: Sasha Levin -Signed-off-by: David S. Miller ---- - net/rds/connection.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/net/rds/connection.c b/net/rds/connection.c -index 9b2de5e67d79..49adeef8090c 100644 ---- a/net/rds/connection.c -+++ b/net/rds/connection.c -@@ -190,6 +190,12 @@ new_conn: - } - } - -+ if (trans == NULL) { -+ kmem_cache_free(rds_conn_slab, conn); -+ conn = ERR_PTR(-ENODEV); -+ goto out; -+ } -+ - conn->c_trans = trans; - - ret = trans->conn_alloc(conn, gfp); --- -2.4.3 - diff --git a/kernel.spec b/kernel.spec index 2f62ddd4b..9f45d3b83 100644 --- a/kernel.spec +++ b/kernel.spec @@ -40,7 +40,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 301 +%global baserelease 300 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -52,7 +52,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 6 +%define stable_update 7 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -608,8 +608,6 @@ Patch513: nv46-Change-mc-subdev-oclass-from-nv44-to-nv4c.patch Patch517: vmwgfx-Rework-device-initialization.patch Patch518: drm-vmwgfx-Allow-dropped-masters-render-node-like-ac.patch -#CVE-2015-6937 rhbz 1263139 1263140 -Patch523: RDS-verify-the-underlying-transport-exists-before-cr.patch #CVE-2015-7990 rhbz 1276437 1276438 Patch524: RDS-fix-race-condition-when-sending-a-message-on-unb.patch @@ -621,9 +619,6 @@ Patch541: 0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch Patch543: isdn_ppp-Add-checks-for-allocation-failure-in-isdn_p.patch Patch544: ppp-slip-Validate-VJ-compression-slot-parameters-com.patch -#CVE-2015-5307 rhbz 1277172 1279688 -Patch550: KVM-x86-work-around-infinite-loop-in-microcode-when-.patch - #CVE-2015-8104 rhbz 1278496 1279691 Patch551: KVM-svm-unconditionally-intercept-DB.patch @@ -658,9 +653,6 @@ Patch567: usbvision-fix-crash-on-detecting-device-with-invalid.patch #CVE-2015-7515 rhbz 1285326 1285331 Patch568: Input-aiptek-fix-crash-on-detecting-device-without-e.patch -#rhbz 1275490 -Patch569: 0001-iwlwifi-Add-new-PCI-IDs-for-the-8260-series.patch - #rhbz 1287819 Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch @@ -2108,6 +2100,9 @@ fi # # %changelog +* Wed Dec 09 2015 - 4.2.7-300 +- Linux v4.2.7 + * Thu Dec 03 2015 Josh Boyer - Add patch to fix palm rejection on certain touchpads (rhbz 1287819) - Add new PCI ids for wireless, including Lenovo Yoga (rhbz 1275490) diff --git a/sources b/sources index 95e48c5fa..73bddd8f3 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 3d5ea06d767e2f35c999eeadafc76523 linux-4.2.tar.xz 4c964bfba54d65b5b54cc898baddecad perf-man-4.2.tar.gz -408f9975969da326b5804a04dbf0d4de patch-4.2.6.xz +5962072782033501e13df5f1f9507aa4 patch-4.2.7.xz From 8b27eba25e016f2925ab3748b2be9de3212d689d Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Thu, 10 Dec 2015 08:23:16 -0500 Subject: [PATCH 18/27] Fix rfkill issues on ideapad Y700-17ISK (rhbz 1286293) --- ...dd-Lenovo-ideapad-Y700-17ISK-to-no_h.patch | 40 +++++++++++++++++++ kernel.spec | 6 +++ 2 files changed, 46 insertions(+) create mode 100644 ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch diff --git a/ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch b/ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch new file mode 100644 index 000000000..16788f756 --- /dev/null +++ b/ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch @@ -0,0 +1,40 @@ +From 14b627c610f93c2700f9a3825ac10c35d51acfe4 Mon Sep 17 00:00:00 2001 +From: Josh Boyer +Date: Mon, 7 Dec 2015 13:50:38 -0500 +Subject: [PATCH] ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill + dmi list + +One of the newest ideapad models also lacks a physical hw rfkill switch, +and trying to read the hw rfkill switch through the ideapad module +causes it to always reported blocking breaking wifi. + +Fix it by adding this model to the DMI list. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1286293 +Cc: stable@vger.kernel.org +Signed-off-by: Josh Boyer +--- + drivers/platform/x86/ideapad-laptop.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index a313dfc0245f..d28db0e793df 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -865,6 +865,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = { + }, + }, + { ++ .ident = "Lenovo ideapad Y700-17ISK", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad Y700-17ISK"), ++ }, ++ }, ++ { + .ident = "Lenovo Yoga 2 11 / 13 / Pro", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 9f45d3b83..430a6e03f 100644 --- a/kernel.spec +++ b/kernel.spec @@ -656,6 +656,9 @@ Patch568: Input-aiptek-fix-crash-on-detecting-device-without-e.patch #rhbz 1287819 Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch +#rhbz 1286293 +Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch + # END OF PATCH DEFINITIONS %endif @@ -2100,6 +2103,9 @@ fi # # %changelog +* Thu Dec 10 2015 Josh Boyer +- Fix rfkill issues on ideapad Y700-17ISK (rhbz 1286293) + * Wed Dec 09 2015 - 4.2.7-300 - Linux v4.2.7 From 96b069e0a99adf198ea5c8abb48819673503f913 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 11 Dec 2015 08:35:36 -0500 Subject: [PATCH 19/27] CVE-2013-7446 unix sockects use after free (rhbz 1282688 1282712) --- kernel.spec | 6 + ...e-after-free-in-ep_remove_wait_queue.patch | 332 ++++++++++++++++++ 2 files changed, 338 insertions(+) create mode 100644 unix-avoid-use-after-free-in-ep_remove_wait_queue.patch diff --git a/kernel.spec b/kernel.spec index 430a6e03f..398ffb697 100644 --- a/kernel.spec +++ b/kernel.spec @@ -659,6 +659,9 @@ Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch #rhbz 1286293 Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch +#CVE-2013-7446 rhbz 1282688 1282712 +Patch573: unix-avoid-use-after-free-in-ep_remove_wait_queue.patch + # END OF PATCH DEFINITIONS %endif @@ -2103,6 +2106,9 @@ fi # # %changelog +* Fri Dec 11 2015 Josh Boyer +- CVE-2013-7446 unix sockects use after free (rhbz 1282688 1282712) + * Thu Dec 10 2015 Josh Boyer - Fix rfkill issues on ideapad Y700-17ISK (rhbz 1286293) diff --git a/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch b/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch new file mode 100644 index 000000000..a20366db3 --- /dev/null +++ b/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch @@ -0,0 +1,332 @@ +From: Rainer Weikusat +Date: Fri, 20 Nov 2015 22:07:23 +0000 +Subject: [PATCH 04/37] unix: avoid use-after-free in ep_remove_wait_queue + +[ Upstream commit 7d267278a9ece963d77eefec61630223fce08c6c ] + +Rainer Weikusat writes: +An AF_UNIX datagram socket being the client in an n:1 association with +some server socket is only allowed to send messages to the server if the +receive queue of this socket contains at most sk_max_ack_backlog +datagrams. This implies that prospective writers might be forced to go +to sleep despite none of the message presently enqueued on the server +receive queue were sent by them. In order to ensure that these will be +woken up once space becomes again available, the present unix_dgram_poll +routine does a second sock_poll_wait call with the peer_wait wait queue +of the server socket as queue argument (unix_dgram_recvmsg does a wake +up on this queue after a datagram was received). This is inherently +problematic because the server socket is only guaranteed to remain alive +for as long as the client still holds a reference to it. In case the +connection is dissolved via connect or by the dead peer detection logic +in unix_dgram_sendmsg, the server socket may be freed despite "the +polling mechanism" (in particular, epoll) still has a pointer to the +corresponding peer_wait queue. There's no way to forcibly deregister a +wait queue with epoll. + +Based on an idea by Jason Baron, the patch below changes the code such +that a wait_queue_t belonging to the client socket is enqueued on the +peer_wait queue of the server whenever the peer receive queue full +condition is detected by either a sendmsg or a poll. A wake up on the +peer queue is then relayed to the ordinary wait queue of the client +socket via wake function. The connection to the peer wait queue is again +dissolved if either a wake up is about to be relayed or the client +socket reconnects or a dead peer is detected or the client socket is +itself closed. This enables removing the second sock_poll_wait from +unix_dgram_poll, thus avoiding the use-after-free, while still ensuring +that no blocked writer sleeps forever. + +Signed-off-by: Rainer Weikusat +Fixes: ec0d215f9420 ("af_unix: fix 'poll for write'/connected DGRAM sockets") +Reviewed-by: Jason Baron +Signed-off-by: David S. Miller +--- + include/net/af_unix.h | 1 + + net/unix/af_unix.c | 183 ++++++++++++++++++++++++++++++++++++++++++++------ + 2 files changed, 165 insertions(+), 19 deletions(-) + +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index cb1b9bb..49c7683 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -62,6 +62,7 @@ struct unix_sock { + #define UNIX_GC_CANDIDATE 0 + #define UNIX_GC_MAYBE_CYCLE 1 + struct socket_wq peer_wq; ++ wait_queue_t peer_wake; + }; + + static inline struct unix_sock *unix_sk(struct sock *sk) +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 42ab2cc..153b2f2 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -326,6 +326,118 @@ found: + return s; + } + ++/* Support code for asymmetrically connected dgram sockets ++ * ++ * If a datagram socket is connected to a socket not itself connected ++ * to the first socket (eg, /dev/log), clients may only enqueue more ++ * messages if the present receive queue of the server socket is not ++ * "too large". This means there's a second writeability condition ++ * poll and sendmsg need to test. The dgram recv code will do a wake ++ * up on the peer_wait wait queue of a socket upon reception of a ++ * datagram which needs to be propagated to sleeping would-be writers ++ * since these might not have sent anything so far. This can't be ++ * accomplished via poll_wait because the lifetime of the server ++ * socket might be less than that of its clients if these break their ++ * association with it or if the server socket is closed while clients ++ * are still connected to it and there's no way to inform "a polling ++ * implementation" that it should let go of a certain wait queue ++ * ++ * In order to propagate a wake up, a wait_queue_t of the client ++ * socket is enqueued on the peer_wait queue of the server socket ++ * whose wake function does a wake_up on the ordinary client socket ++ * wait queue. This connection is established whenever a write (or ++ * poll for write) hit the flow control condition and broken when the ++ * association to the server socket is dissolved or after a wake up ++ * was relayed. ++ */ ++ ++static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags, ++ void *key) ++{ ++ struct unix_sock *u; ++ wait_queue_head_t *u_sleep; ++ ++ u = container_of(q, struct unix_sock, peer_wake); ++ ++ __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait, ++ q); ++ u->peer_wake.private = NULL; ++ ++ /* relaying can only happen while the wq still exists */ ++ u_sleep = sk_sleep(&u->sk); ++ if (u_sleep) ++ wake_up_interruptible_poll(u_sleep, key); ++ ++ return 0; ++} ++ ++static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other) ++{ ++ struct unix_sock *u, *u_other; ++ int rc; ++ ++ u = unix_sk(sk); ++ u_other = unix_sk(other); ++ rc = 0; ++ spin_lock(&u_other->peer_wait.lock); ++ ++ if (!u->peer_wake.private) { ++ u->peer_wake.private = other; ++ __add_wait_queue(&u_other->peer_wait, &u->peer_wake); ++ ++ rc = 1; ++ } ++ ++ spin_unlock(&u_other->peer_wait.lock); ++ return rc; ++} ++ ++static void unix_dgram_peer_wake_disconnect(struct sock *sk, ++ struct sock *other) ++{ ++ struct unix_sock *u, *u_other; ++ ++ u = unix_sk(sk); ++ u_other = unix_sk(other); ++ spin_lock(&u_other->peer_wait.lock); ++ ++ if (u->peer_wake.private == other) { ++ __remove_wait_queue(&u_other->peer_wait, &u->peer_wake); ++ u->peer_wake.private = NULL; ++ } ++ ++ spin_unlock(&u_other->peer_wait.lock); ++} ++ ++static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk, ++ struct sock *other) ++{ ++ unix_dgram_peer_wake_disconnect(sk, other); ++ wake_up_interruptible_poll(sk_sleep(sk), ++ POLLOUT | ++ POLLWRNORM | ++ POLLWRBAND); ++} ++ ++/* preconditions: ++ * - unix_peer(sk) == other ++ * - association is stable ++ */ ++static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other) ++{ ++ int connected; ++ ++ connected = unix_dgram_peer_wake_connect(sk, other); ++ ++ if (unix_recvq_full(other)) ++ return 1; ++ ++ if (connected) ++ unix_dgram_peer_wake_disconnect(sk, other); ++ ++ return 0; ++} ++ + static inline int unix_writable(struct sock *sk) + { + return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf; +@@ -430,6 +542,8 @@ static void unix_release_sock(struct sock *sk, int embrion) + skpair->sk_state_change(skpair); + sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP); + } ++ ++ unix_dgram_peer_wake_disconnect(sk, skpair); + sock_put(skpair); /* It may now die */ + unix_peer(sk) = NULL; + } +@@ -665,6 +779,7 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern) + INIT_LIST_HEAD(&u->link); + mutex_init(&u->readlock); /* single task reading lock */ + init_waitqueue_head(&u->peer_wait); ++ init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay); + unix_insert_socket(unix_sockets_unbound(sk), sk); + out: + if (sk == NULL) +@@ -1032,6 +1147,8 @@ restart: + if (unix_peer(sk)) { + struct sock *old_peer = unix_peer(sk); + unix_peer(sk) = other; ++ unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer); ++ + unix_state_double_unlock(sk, other); + + if (other != old_peer) +@@ -1471,6 +1588,7 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, + struct scm_cookie scm; + int max_level; + int data_len = 0; ++ int sk_locked; + + wait_for_unix_gc(); + err = scm_send(sock, msg, &scm, false); +@@ -1549,12 +1667,14 @@ restart: + goto out_free; + } + ++ sk_locked = 0; + unix_state_lock(other); ++restart_locked: + err = -EPERM; + if (!unix_may_send(sk, other)) + goto out_unlock; + +- if (sock_flag(other, SOCK_DEAD)) { ++ if (unlikely(sock_flag(other, SOCK_DEAD))) { + /* + * Check with 1003.1g - what should + * datagram error +@@ -1562,10 +1682,14 @@ restart: + unix_state_unlock(other); + sock_put(other); + ++ if (!sk_locked) ++ unix_state_lock(sk); ++ + err = 0; +- unix_state_lock(sk); + if (unix_peer(sk) == other) { + unix_peer(sk) = NULL; ++ unix_dgram_peer_wake_disconnect_wakeup(sk, other); ++ + unix_state_unlock(sk); + + unix_dgram_disconnected(sk, other); +@@ -1591,21 +1715,38 @@ restart: + goto out_unlock; + } + +- if (unix_peer(other) != sk && unix_recvq_full(other)) { +- if (!timeo) { +- err = -EAGAIN; +- goto out_unlock; ++ if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { ++ if (timeo) { ++ timeo = unix_wait_for_peer(other, timeo); ++ ++ err = sock_intr_errno(timeo); ++ if (signal_pending(current)) ++ goto out_free; ++ ++ goto restart; + } + +- timeo = unix_wait_for_peer(other, timeo); ++ if (!sk_locked) { ++ unix_state_unlock(other); ++ unix_state_double_lock(sk, other); ++ } + +- err = sock_intr_errno(timeo); +- if (signal_pending(current)) +- goto out_free; ++ if (unix_peer(sk) != other || ++ unix_dgram_peer_wake_me(sk, other)) { ++ err = -EAGAIN; ++ sk_locked = 1; ++ goto out_unlock; ++ } + +- goto restart; ++ if (!sk_locked) { ++ sk_locked = 1; ++ goto restart_locked; ++ } + } + ++ if (unlikely(sk_locked)) ++ unix_state_unlock(sk); ++ + if (sock_flag(other, SOCK_RCVTSTAMP)) + __net_timestamp(skb); + maybe_add_creds(skb, sock, other); +@@ -1619,6 +1760,8 @@ restart: + return len; + + out_unlock: ++ if (sk_locked) ++ unix_state_unlock(sk); + unix_state_unlock(other); + out_free: + kfree_skb(skb); +@@ -2475,14 +2618,16 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock, + return mask; + + writable = unix_writable(sk); +- other = unix_peer_get(sk); +- if (other) { +- if (unix_peer(other) != sk) { +- sock_poll_wait(file, &unix_sk(other)->peer_wait, wait); +- if (unix_recvq_full(other)) +- writable = 0; +- } +- sock_put(other); ++ if (writable) { ++ unix_state_lock(sk); ++ ++ other = unix_peer(sk); ++ if (other && unix_peer(other) != sk && ++ unix_recvq_full(other) && ++ unix_dgram_peer_wake_me(sk, other)) ++ writable = 0; ++ ++ unix_state_unlock(sk); + } + + if (writable) +-- +2.1.0 + From 9652a1eb8365706c047f1f33e32bdcac4c809a88 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 14 Dec 2015 10:32:55 -0500 Subject: [PATCH 20/27] CVE-XXXX-XXXX permission bypass on overlayfs (rhbz 1291329 1291332) --- kernel.spec | 6 +++ ovl-fix-permission-checking-for-setattr.patch | 46 +++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 ovl-fix-permission-checking-for-setattr.patch diff --git a/kernel.spec b/kernel.spec index 398ffb697..124e0e2b7 100644 --- a/kernel.spec +++ b/kernel.spec @@ -662,6 +662,9 @@ Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch #CVE-2013-7446 rhbz 1282688 1282712 Patch573: unix-avoid-use-after-free-in-ep_remove_wait_queue.patch +#CVE-XXXX-XXXX rhbz 1291329 1291332 +Patch574: ovl-fix-permission-checking-for-setattr.patch + # END OF PATCH DEFINITIONS %endif @@ -2106,6 +2109,9 @@ fi # # %changelog +* Mon Dec 14 2015 Josh Boyer +- CVE-XXXX-XXXX permission bypass on overlayfs (rhbz 1291329 1291332) + * Fri Dec 11 2015 Josh Boyer - CVE-2013-7446 unix sockects use after free (rhbz 1282688 1282712) diff --git a/ovl-fix-permission-checking-for-setattr.patch b/ovl-fix-permission-checking-for-setattr.patch new file mode 100644 index 000000000..167ecda99 --- /dev/null +++ b/ovl-fix-permission-checking-for-setattr.patch @@ -0,0 +1,46 @@ +From acff81ec2c79492b180fade3c2894425cd35a545 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Fri, 4 Dec 2015 19:18:48 +0100 +Subject: [PATCH] ovl: fix permission checking for setattr + +[Al Viro] The bug is in being too enthusiastic about optimizing ->setattr() +away - instead of "copy verbatim with metadata" + "chmod/chown/utimes" +(with the former being always safe and the latter failing in case of +insufficient permissions) it tries to combine these two. Note that copyup +itself will have to do ->setattr() anyway; _that_ is where the elevated +capabilities are right. Having these two ->setattr() (one to set verbatim +copy of metadata, another to do what overlayfs ->setattr() had been asked +to do in the first place) combined is where it breaks. + +Signed-off-by: Miklos Szeredi +Cc: +Signed-off-by: Al Viro +--- + fs/overlayfs/inode.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index ec0c2a050043..961284936917 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -49,13 +49,13 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr) + if (err) + goto out; + +- upperdentry = ovl_dentry_upper(dentry); +- if (upperdentry) { ++ err = ovl_copy_up(dentry); ++ if (!err) { ++ upperdentry = ovl_dentry_upper(dentry); ++ + mutex_lock(&upperdentry->d_inode->i_mutex); + err = notify_change(upperdentry, attr, NULL); + mutex_unlock(&upperdentry->d_inode->i_mutex); +- } else { +- err = ovl_copy_up_last(dentry, attr, false); + } + ovl_drop_write(dentry); + out: +-- +2.5.0 + From 6831904de487d139290248a706727695da0eb421 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 14 Dec 2015 10:40:27 -0500 Subject: [PATCH 21/27] CVE-2015-7550 Race between read and revoke keys (rhbz 1291197 1291198) --- KEYS-Fix-race-between-read-and-revoke.patch | 108 ++++++++++++++++++++ kernel.spec | 4 + 2 files changed, 112 insertions(+) create mode 100644 KEYS-Fix-race-between-read-and-revoke.patch diff --git a/KEYS-Fix-race-between-read-and-revoke.patch b/KEYS-Fix-race-between-read-and-revoke.patch new file mode 100644 index 000000000..df0d9376b --- /dev/null +++ b/KEYS-Fix-race-between-read-and-revoke.patch @@ -0,0 +1,108 @@ +From f144220f72062ed5359e0211f130670c915a12dd Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Mon, 14 Dec 2015 10:36:31 -0500 +Subject: [PATCH] KEYS: Fix race between read and revoke + +There's a race between keyctl_read() and keyctl_revoke(). If the revoke +happens between keyctl_read() checking the validity of a key and the key's +semaphore being taken, then the key type read method will see a revoked key. + +This causes a problem for the user-defined key type because it assumes in +its read method that there will always be a payload in a non-revoked key +and doesn't check for a NULL pointer. + +Fix this by making keyctl_read() check the validity of a key after taking +semaphore instead of before. + +This was discovered by a multithreaded test program generated by syzkaller +(http://github.com/google/syzkaller). Here's a cleaned up version: + + #include + #include + #include + void *thr0(void *arg) + { + key_serial_t key = (unsigned long)arg; + keyctl_revoke(key); + return 0; + } + void *thr1(void *arg) + { + key_serial_t key = (unsigned long)arg; + char buffer[16]; + keyctl_read(key, buffer, 16); + return 0; + } + int main() + { + key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING); + pthread_t th[5]; + pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key); + pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key); + pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key); + pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key); + pthread_join(th[0], 0); + pthread_join(th[1], 0); + pthread_join(th[2], 0); + pthread_join(th[3], 0); + return 0; + } + +Build as: + + cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread + +Run as: + + while keyctl-race; do :; done + +as it may need several iterations to crash the kernel. The crash can be +summarised as: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 + IP: [] user_read+0x56/0xa3 + ... + Call Trace: + [] keyctl_read_key+0xb6/0xd7 + [] SyS_keyctl+0x83/0xe0 + [] entry_SYSCALL_64_fastpath+0x12/0x6f + +Reported-by: Dmitry Vyukov +Signed-off-by: David Howells +--- + security/keys/keyctl.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index fb111eafcb89..1c3872aeed14 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -751,16 +751,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) + + /* the key is probably readable - now try to read it */ + can_read_key: +- ret = key_validate(key); +- if (ret == 0) { +- ret = -EOPNOTSUPP; +- if (key->type->read) { +- /* read the data with the semaphore held (since we +- * might sleep) */ +- down_read(&key->sem); ++ ret = -EOPNOTSUPP; ++ if (key->type->read) { ++ /* Read the data with the semaphore held (since we might sleep) ++ * to protect against the key being updated or revoked. ++ */ ++ down_read(&key->sem); ++ ret = key_validate(key); ++ if (ret == 0) + ret = key->type->read(key, buffer, buflen); +- up_read(&key->sem); +- } ++ up_read(&key->sem); + } + + error2: +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 124e0e2b7..df7af6435 100644 --- a/kernel.spec +++ b/kernel.spec @@ -665,6 +665,9 @@ Patch573: unix-avoid-use-after-free-in-ep_remove_wait_queue.patch #CVE-XXXX-XXXX rhbz 1291329 1291332 Patch574: ovl-fix-permission-checking-for-setattr.patch +#CVE-2015-7550 rhbz 1291197 1291198 +Patch575: KEYS-Fix-race-between-read-and-revoke.patch + # END OF PATCH DEFINITIONS %endif @@ -2110,6 +2113,7 @@ fi # %changelog * Mon Dec 14 2015 Josh Boyer +- CVE-2015-7550 Race between read and revoke keys (rhbz 1291197 1291198) - CVE-XXXX-XXXX permission bypass on overlayfs (rhbz 1291329 1291332) * Fri Dec 11 2015 Josh Boyer From ef41a556b6e3e2b3f7a459a5abf164e165b5aa59 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 15 Dec 2015 10:49:33 -0500 Subject: [PATCH 22/27] CVE-2015-8543 ipv6: DoS via NULL pointer dereference (rhbz 1290475 1290477) --- kernel.spec | 6 + ...on-for-the-socket-syscall-protocol-a.patch | 139 ++++++++++++++++++ 2 files changed, 145 insertions(+) create mode 100644 net-add-validation-for-the-socket-syscall-protocol-a.patch diff --git a/kernel.spec b/kernel.spec index df7af6435..bd878ac32 100644 --- a/kernel.spec +++ b/kernel.spec @@ -668,6 +668,9 @@ Patch574: ovl-fix-permission-checking-for-setattr.patch #CVE-2015-7550 rhbz 1291197 1291198 Patch575: KEYS-Fix-race-between-read-and-revoke.patch +#CVE-2015-8543 rhbz 1290475 1290477 +Patch576: net-add-validation-for-the-socket-syscall-protocol-a.patch + # END OF PATCH DEFINITIONS %endif @@ -2112,6 +2115,9 @@ fi # # %changelog +* Tue Dec 15 2015 Josh Boyer +- CVE-2015-8543 ipv6: DoS via NULL pointer dereference (rhbz 1290475 1290477) + * Mon Dec 14 2015 Josh Boyer - CVE-2015-7550 Race between read and revoke keys (rhbz 1291197 1291198) - CVE-XXXX-XXXX permission bypass on overlayfs (rhbz 1291329 1291332) diff --git a/net-add-validation-for-the-socket-syscall-protocol-a.patch b/net-add-validation-for-the-socket-syscall-protocol-a.patch new file mode 100644 index 000000000..ce387ea42 --- /dev/null +++ b/net-add-validation-for-the-socket-syscall-protocol-a.patch @@ -0,0 +1,139 @@ +From 4da7dc22c91ad2c3144cb1d0d96e9611bc86da47 Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Mon, 14 Dec 2015 22:03:39 +0100 +Subject: [PATCH] net: add validation for the socket syscall protocol argument +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +郭永刚 reported that one could simply crash the kernel as root by +using a simple program: + + int socket_fd; + struct sockaddr_in addr; + addr.sin_port = 0; + addr.sin_addr.s_addr = INADDR_ANY; + addr.sin_family = 10; + + socket_fd = socket(10,3,0x40000000); + connect(socket_fd , &addr,16); + +AF_INET, AF_INET6 sockets actually only support 8-bit protocol +identifiers. inet_sock's skc_protocol field thus is sized accordingly, +thus larger protocol identifiers simply cut off the higher bits and +store a zero in the protocol fields. + +This could lead to e.g. NULL function pointer because as a result of +the cut off inet_num is zero and we call down to inet_autobind, which +is NULL for raw sockets. + +kernel: Call Trace: +kernel: [] ? inet_autobind+0x2e/0x70 +kernel: [] inet_dgram_connect+0x54/0x80 +kernel: [] SYSC_connect+0xd9/0x110 +kernel: [] ? ptrace_notify+0x5b/0x80 +kernel: [] ? syscall_trace_enter_phase2+0x108/0x200 +kernel: [] SyS_connect+0xe/0x10 +kernel: [] tracesys_phase2+0x84/0x89 + +I found no particular commit which introduced this problem. + +CVE: CVE-2015-8543 +Cc: Cong Wang +Reported-by: 郭永刚 +Signed-off-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +--- + include/net/sock.h | 1 + + net/ax25/af_ax25.c | 3 +++ + net/decnet/af_decnet.c | 3 +++ + net/ipv4/af_inet.c | 3 +++ + net/ipv6/af_inet6.c | 3 +++ + net/irda/af_irda.c | 3 +++ + 6 files changed, 16 insertions(+) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 52d27ee924f4..2fa1fc00e8cb 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -403,6 +403,7 @@ struct sock { + sk_no_check_rx : 1, + sk_userlocks : 4, + sk_protocol : 8, ++#define SK_PROTOCOL_MAX U8_MAX + sk_type : 16; + kmemcheck_bitfield_end(flags); + int sk_wmem_queued; +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index ae3a47f9d1d5..fbd0acf80b13 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -805,6 +805,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol, + struct sock *sk; + ax25_cb *ax25; + ++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) ++ return -EINVAL; ++ + if (!net_eq(net, &init_net)) + return -EAFNOSUPPORT; + +diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c +index eebf5ac8ce18..13d6b1a6e0fc 100644 +--- a/net/decnet/af_decnet.c ++++ b/net/decnet/af_decnet.c +@@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol, + { + struct sock *sk; + ++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) ++ return -EINVAL; ++ + if (!net_eq(net, &init_net)) + return -EAFNOSUPPORT; + +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 11c4ca13ec3b..5c5db6636704 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -257,6 +257,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, + int try_loading_module = 0; + int err; + ++ if (protocol < 0 || protocol >= IPPROTO_MAX) ++ return -EINVAL; ++ + sock->state = SS_UNCONNECTED; + + /* Look for the requested type/protocol pair. */ +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index 8ec0df75f1c4..9f5137cd604e 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, + int try_loading_module = 0; + int err; + ++ if (protocol < 0 || protocol >= IPPROTO_MAX) ++ return -EINVAL; ++ + /* Look for the requested type/protocol pair. */ + lookup_protocol: + err = -ESOCKTNOSUPPORT; +diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c +index e6aa48b5395c..923abd6b3064 100644 +--- a/net/irda/af_irda.c ++++ b/net/irda/af_irda.c +@@ -1086,6 +1086,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol, + struct sock *sk; + struct irda_sock *self; + ++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX) ++ return -EINVAL; ++ + if (net != &init_net) + return -EAFNOSUPPORT; + +-- +2.5.0 + From 82ccff23e0c3f0ed009e635d25f32174eac5af0d Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Tue, 15 Dec 2015 10:21:12 -0600 Subject: [PATCH 23/27] Linux v4.2.8 --- ...ing-RTF_CACHE-from-a-rt-that-is-not-.patch | 91 ----- ...tion-of-compressed-and-inlined-exten.patch | 288 --------------- ...dition-when-sending-a-message-on-unb.patch | 77 ---- kernel.spec | 19 +- sources | 2 +- ...e-after-free-in-ep_remove_wait_queue.patch | 332 ------------------ 6 files changed, 6 insertions(+), 803 deletions(-) delete mode 100644 0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch delete mode 100644 Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch delete mode 100644 RDS-fix-race-condition-when-sending-a-message-on-unb.patch delete mode 100644 unix-avoid-use-after-free-in-ep_remove_wait_queue.patch diff --git a/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch b/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch deleted file mode 100644 index 3390024d2..000000000 --- a/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 0d3f6d297bfb7af24d0508460fdb3d1ec4903fa3 Mon Sep 17 00:00:00 2001 -From: Martin KaFai Lau -Date: Wed, 11 Nov 2015 11:51:06 -0800 -Subject: [PATCH] ipv6: Avoid creating RTF_CACHE from a rt that is not managed - by fib6 tree - -The original bug report: -https://bugzilla.redhat.com/show_bug.cgi?id=1272571 - -The setup has a IPv4 GRE tunnel running in a IPSec. The bug -happens when ndisc starts sending router solicitation at the gre -interface. The simplified oops stack is like: - -__lock_acquire+0x1b2/0x1c30 -lock_acquire+0xb9/0x140 -_raw_write_lock_bh+0x3f/0x50 -__ip6_ins_rt+0x2e/0x60 -ip6_ins_rt+0x49/0x50 -~~~~~~~~ -__ip6_rt_update_pmtu.part.54+0x145/0x250 -ip6_rt_update_pmtu+0x2e/0x40 -~~~~~~~~ -ip_tunnel_xmit+0x1f1/0xf40 -__gre_xmit+0x7a/0x90 -ipgre_xmit+0x15a/0x220 -dev_hard_start_xmit+0x2bd/0x480 -__dev_queue_xmit+0x696/0x730 -dev_queue_xmit+0x10/0x20 -neigh_direct_output+0x11/0x20 -ip6_finish_output2+0x21f/0x770 -ip6_finish_output+0xa7/0x1d0 -ip6_output+0x56/0x190 -~~~~~~~~ -ndisc_send_skb+0x1d9/0x400 -ndisc_send_rs+0x88/0xc0 -~~~~~~~~ - -The rt passed to ip6_rt_update_pmtu() is created by -icmp6_dst_alloc() and it is not managed by the fib6 tree, -so its rt6i_table == NULL. When __ip6_rt_update_pmtu() creates -a RTF_CACHE clone, the newly created clone also has rt6i_table == NULL -and it causes the ip6_ins_rt() oops. - -During pmtu update, we only want to create a RTF_CACHE clone -from a rt which is currently managed (or owned) by the -fib6 tree. It means either rt->rt6i_node != NULL or -rt is a RTF_PCPU clone. - -It is worth to note that rt6i_table may not be NULL even it is -not (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()). -Hence, rt6i_node is a better check instead of rt6i_table. - -Fixes: 45e4fd26683c ("ipv6: Only create RTF_CACHE routes after encountering pmtu") -Signed-off-by: Martin KaFai Lau -Reported-by: Chris Siebenmann -Cc: Chris Siebenmann -Cc: Hannes Frederic Sowa -Signed-off-by: David S. Miller ---- - net/ipv6/route.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index c8bc9b4..74907c5 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -1322,6 +1322,12 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu) - rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires); - } - -+static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) -+{ -+ return !(rt->rt6i_flags & RTF_CACHE) && -+ (rt->rt6i_flags & RTF_PCPU || rt->rt6i_node); -+} -+ - static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, - const struct ipv6hdr *iph, u32 mtu) - { -@@ -1335,7 +1341,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, - if (mtu >= dst_mtu(dst)) - return; - -- if (rt6->rt6i_flags & RTF_CACHE) { -+ if (!rt6_cache_allowed_for_pmtu(rt6)) { - rt6_do_update_pmtu(rt6, mtu); - } else { - const struct in6_addr *daddr, *saddr; --- -2.5.0 - diff --git a/Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch b/Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch deleted file mode 100644 index 1212966ef..000000000 --- a/Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch +++ /dev/null @@ -1,288 +0,0 @@ -From 0305cd5f7fca85dae392b9ba85b116896eb7c1c7 Mon Sep 17 00:00:00 2001 -From: Filipe Manana -Date: Fri, 16 Oct 2015 12:34:25 +0100 -Subject: [PATCH] Btrfs: fix truncation of compressed and inlined extents - -When truncating a file to a smaller size which consists of an inline -extent that is compressed, we did not discard (or made unusable) the -data between the new file size and the old file size, wasting metadata -space and allowing for the truncated data to be leaked and the data -corruption/loss mentioned below. -We were also not correctly decrementing the number of bytes used by the -inode, we were setting it to zero, giving a wrong report for callers of -the stat(2) syscall. The fsck tool also reported an error about a mismatch -between the nbytes of the file versus the real space used by the file. - -Now because we weren't discarding the truncated region of the file, it -was possible for a caller of the clone ioctl to actually read the data -that was truncated, allowing for a security breach without requiring root -access to the system, using only standard filesystem operations. The -scenario is the following: - - 1) User A creates a file which consists of an inline and compressed - extent with a size of 2000 bytes - the file is not accessible to - any other users (no read, write or execution permission for anyone - else); - - 2) The user truncates the file to a size of 1000 bytes; - - 3) User A makes the file world readable; - - 4) User B creates a file consisting of an inline extent of 2000 bytes; - - 5) User B issues a clone operation from user A's file into its own - file (using a length argument of 0, clone the whole range); - - 6) User B now gets to see the 1000 bytes that user A truncated from - its file before it made its file world readbale. User B also lost - the bytes in the range [1000, 2000[ bytes from its own file, but - that might be ok if his/her intention was reading stale data from - user A that was never supposed to be public. - -Note that this contrasts with the case where we truncate a file from 2000 -bytes to 1000 bytes and then truncate it back from 1000 to 2000 bytes. In -this case reading any byte from the range [1000, 2000[ will return a value -of 0x00, instead of the original data. - -This problem exists since the clone ioctl was added and happens both with -and without my recent data loss and file corruption fixes for the clone -ioctl (patch "Btrfs: fix file corruption and data loss after cloning -inline extents"). - -So fix this by truncating the compressed inline extents as we do for the -non-compressed case, which involves decompressing, if the data isn't already -in the page cache, compressing the truncated version of the extent, writing -the compressed content into the inline extent and then truncate it. - -The following test case for fstests reproduces the problem. In order for -the test to pass both this fix and my previous fix for the clone ioctl -that forbids cloning a smaller inline extent into a larger one, -which is titled "Btrfs: fix file corruption and data loss after cloning -inline extents", are needed. Without that other fix the test fails in a -different way that does not leak the truncated data, instead part of -destination file gets replaced with zeroes (because the destination file -has a larger inline extent than the source). - - seq=`basename $0` - seqres=$RESULT_DIR/$seq - echo "QA output created by $seq" - tmp=/tmp/$$ - status=1 # failure is the default! - trap "_cleanup; exit \$status" 0 1 2 3 15 - - _cleanup() - { - rm -f $tmp.* - } - - # get standard environment, filters and checks - . ./common/rc - . ./common/filter - - # real QA test starts here - _need_to_be_root - _supported_fs btrfs - _supported_os Linux - _require_scratch - _require_cloner - - rm -f $seqres.full - - _scratch_mkfs >>$seqres.full 2>&1 - _scratch_mount "-o compress" - - # Create our test files. File foo is going to be the source of a clone operation - # and consists of a single inline extent with an uncompressed size of 512 bytes, - # while file bar consists of a single inline extent with an uncompressed size of - # 256 bytes. For our test's purpose, it's important that file bar has an inline - # extent with a size smaller than foo's inline extent. - $XFS_IO_PROG -f -c "pwrite -S 0xa1 0 128" \ - -c "pwrite -S 0x2a 128 384" \ - $SCRATCH_MNT/foo | _filter_xfs_io - $XFS_IO_PROG -f -c "pwrite -S 0xbb 0 256" $SCRATCH_MNT/bar | _filter_xfs_io - - # Now durably persist all metadata and data. We do this to make sure that we get - # on disk an inline extent with a size of 512 bytes for file foo. - sync - - # Now truncate our file foo to a smaller size. Because it consists of a - # compressed and inline extent, btrfs did not shrink the inline extent to the - # new size (if the extent was not compressed, btrfs would shrink it to 128 - # bytes), it only updates the inode's i_size to 128 bytes. - $XFS_IO_PROG -c "truncate 128" $SCRATCH_MNT/foo - - # Now clone foo's inline extent into bar. - # This clone operation should fail with errno EOPNOTSUPP because the source - # file consists only of an inline extent and the file's size is smaller than - # the inline extent of the destination (128 bytes < 256 bytes). However the - # clone ioctl was not prepared to deal with a file that has a size smaller - # than the size of its inline extent (something that happens only for compressed - # inline extents), resulting in copying the full inline extent from the source - # file into the destination file. - # - # Note that btrfs' clone operation for inline extents consists of removing the - # inline extent from the destination inode and copy the inline extent from the - # source inode into the destination inode, meaning that if the destination - # inode's inline extent is larger (N bytes) than the source inode's inline - # extent (M bytes), some bytes (N - M bytes) will be lost from the destination - # file. Btrfs could copy the source inline extent's data into the destination's - # inline extent so that we would not lose any data, but that's currently not - # done due to the complexity that would be needed to deal with such cases - # (specially when one or both extents are compressed), returning EOPNOTSUPP, as - # it's normally not a very common case to clone very small files (only case - # where we get inline extents) and copying inline extents does not save any - # space (unlike for normal, non-inlined extents). - $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/foo $SCRATCH_MNT/bar - - # Now because the above clone operation used to succeed, and due to foo's inline - # extent not being shinked by the truncate operation, our file bar got the whole - # inline extent copied from foo, making us lose the last 128 bytes from bar - # which got replaced by the bytes in range [128, 256[ from foo before foo was - # truncated - in other words, data loss from bar and being able to read old and - # stale data from foo that should not be possible to read anymore through normal - # filesystem operations. Contrast with the case where we truncate a file from a - # size N to a smaller size M, truncate it back to size N and then read the range - # [M, N[, we should always get the value 0x00 for all the bytes in that range. - - # We expected the clone operation to fail with errno EOPNOTSUPP and therefore - # not modify our file's bar data/metadata. So its content should be 256 bytes - # long with all bytes having the value 0xbb. - # - # Without the btrfs bug fix, the clone operation succeeded and resulted in - # leaking truncated data from foo, the bytes that belonged to its range - # [128, 256[, and losing data from bar in that same range. So reading the - # file gave us the following content: - # - # 0000000 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 - # * - # 0000200 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a - # * - # 0000400 - echo "File bar's content after the clone operation:" - od -t x1 $SCRATCH_MNT/bar - - # Also because the foo's inline extent was not shrunk by the truncate - # operation, btrfs' fsck, which is run by the fstests framework everytime a - # test completes, failed reporting the following error: - # - # root 5 inode 257 errors 400, nbytes wrong - - status=0 - exit - -Cc: stable@vger.kernel.org -Signed-off-by: Filipe Manana ---- - fs/btrfs/inode.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++---------- - 1 file changed, 68 insertions(+), 14 deletions(-) - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 208db4e835f0..cbb4286490a1 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -4217,6 +4217,47 @@ static int truncate_space_check(struct btrfs_trans_handle *trans, - - } - -+static int truncate_inline_extent(struct inode *inode, -+ struct btrfs_path *path, -+ struct btrfs_key *found_key, -+ const u64 item_end, -+ const u64 new_size) -+{ -+ struct extent_buffer *leaf = path->nodes[0]; -+ int slot = path->slots[0]; -+ struct btrfs_file_extent_item *fi; -+ u32 size = (u32)(new_size - found_key->offset); -+ struct btrfs_root *root = BTRFS_I(inode)->root; -+ -+ fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item); -+ -+ if (btrfs_file_extent_compression(leaf, fi) != BTRFS_COMPRESS_NONE) { -+ loff_t offset = new_size; -+ loff_t page_end = ALIGN(offset, PAGE_CACHE_SIZE); -+ -+ /* -+ * Zero out the remaining of the last page of our inline extent, -+ * instead of directly truncating our inline extent here - that -+ * would be much more complex (decompressing all the data, then -+ * compressing the truncated data, which might be bigger than -+ * the size of the inline extent, resize the extent, etc). -+ * We release the path because to get the page we might need to -+ * read the extent item from disk (data not in the page cache). -+ */ -+ btrfs_release_path(path); -+ return btrfs_truncate_page(inode, offset, page_end - offset, 0); -+ } -+ -+ btrfs_set_file_extent_ram_bytes(leaf, fi, size); -+ size = btrfs_file_extent_calc_inline_size(size); -+ btrfs_truncate_item(root, path, size, 1); -+ -+ if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) -+ inode_sub_bytes(inode, item_end + 1 - new_size); -+ -+ return 0; -+} -+ - /* - * this can truncate away extent items, csum items and directory items. - * It starts at a high offset and removes keys until it can't find -@@ -4411,27 +4452,40 @@ search_again: - * special encodings - */ - if (!del_item && -- btrfs_file_extent_compression(leaf, fi) == 0 && - btrfs_file_extent_encryption(leaf, fi) == 0 && - btrfs_file_extent_other_encoding(leaf, fi) == 0) { -- u32 size = new_size - found_key.offset; -- -- if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) -- inode_sub_bytes(inode, item_end + 1 - -- new_size); - - /* -- * update the ram bytes to properly reflect -- * the new size of our item -+ * Need to release path in order to truncate a -+ * compressed extent. So delete any accumulated -+ * extent items so far. - */ -- btrfs_set_file_extent_ram_bytes(leaf, fi, size); -- size = -- btrfs_file_extent_calc_inline_size(size); -- btrfs_truncate_item(root, path, size, 1); -+ if (btrfs_file_extent_compression(leaf, fi) != -+ BTRFS_COMPRESS_NONE && pending_del_nr) { -+ err = btrfs_del_items(trans, root, path, -+ pending_del_slot, -+ pending_del_nr); -+ if (err) { -+ btrfs_abort_transaction(trans, -+ root, -+ err); -+ goto error; -+ } -+ pending_del_nr = 0; -+ } -+ -+ err = truncate_inline_extent(inode, path, -+ &found_key, -+ item_end, -+ new_size); -+ if (err) { -+ btrfs_abort_transaction(trans, -+ root, err); -+ goto error; -+ } - } else if (test_bit(BTRFS_ROOT_REF_COWS, - &root->state)) { -- inode_sub_bytes(inode, item_end + 1 - -- found_key.offset); -+ inode_sub_bytes(inode, item_end + 1 - new_size); - } - } - delete: --- -2.5.0 - diff --git a/RDS-fix-race-condition-when-sending-a-message-on-unb.patch b/RDS-fix-race-condition-when-sending-a-message-on-unb.patch deleted file mode 100644 index 8a44c84d3..000000000 --- a/RDS-fix-race-condition-when-sending-a-message-on-unb.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 09dca584f0b6b3bb4fc5f13a388274cd76b69f18 Mon Sep 17 00:00:00 2001 -From: Quentin Casasnovas -Date: Fri, 16 Oct 2015 17:11:42 +0200 -Subject: [PATCH] RDS: fix race condition when sending a message on unbound - socket. - -Sasha's found a NULL pointer dereference in the RDS connection code when -sending a message to an apparently unbound socket. The problem is caused -by the code checking if the socket is bound in rds_sendmsg(), which checks -the rs_bound_addr field without taking a lock on the socket. This opens a -race where rs_bound_addr is temporarily set but where the transport is not -in rds_bind(), leading to a NULL pointer dereference when trying to -dereference 'trans' in __rds_conn_create(). - -Vegard wrote a reproducer for this issue, so kindly ask him to share if -you're interested. - -I cannot reproduce the NULL pointer dereference using Vegard's reproducer -with this patch, whereas I could without. - -Complete earlier incomplete fix to CVE-2015-6937: - - 74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection") - -Signed-off-by: Quentin Casasnovas -Reviewed-by: Vegard Nossum -Reviewed-by: Sasha Levin -Cc: Vegard Nossum -Cc: Sasha Levin -Cc: Chien Yen -Cc: Santosh Shilimkar -Cc: David S. Miller -Cc: stable@vger.kernel.org ---- - net/rds/connection.c | 6 ------ - net/rds/send.c | 4 +++- - 2 files changed, 3 insertions(+), 7 deletions(-) - -diff --git a/net/rds/connection.c b/net/rds/connection.c -index 9d66705f9d41..da6da57e5f36 100644 ---- a/net/rds/connection.c -+++ b/net/rds/connection.c -@@ -187,12 +187,6 @@ new_conn: - } - } - -- if (trans == NULL) { -- kmem_cache_free(rds_conn_slab, conn); -- conn = ERR_PTR(-ENODEV); -- goto out; -- } -- - conn->c_trans = trans; - - ret = trans->conn_alloc(conn, gfp); -diff --git a/net/rds/send.c b/net/rds/send.c -index e9430f537f9c..7b30c0f3180d 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -986,11 +986,13 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) - release_sock(sk); - } - -- /* racing with another thread binding seems ok here */ -+ lock_sock(sk); - if (daddr == 0 || rs->rs_bound_addr == 0) { -+ release_sock(sk); - ret = -ENOTCONN; /* XXX not a great errno */ - goto out; - } -+ release_sock(sk); - - /* size of rm including all sgs */ - ret = rds_rm_size(msg, payload_len); --- -2.4.3 - diff --git a/kernel.spec b/kernel.spec index bd878ac32..420794f35 100644 --- a/kernel.spec +++ b/kernel.spec @@ -52,7 +52,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 7 +%define stable_update 8 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -608,9 +608,6 @@ Patch513: nv46-Change-mc-subdev-oclass-from-nv44-to-nv4c.patch Patch517: vmwgfx-Rework-device-initialization.patch Patch518: drm-vmwgfx-Allow-dropped-masters-render-node-like-ac.patch -#CVE-2015-7990 rhbz 1276437 1276438 -Patch524: RDS-fix-race-condition-when-sending-a-message-on-unb.patch - #rhbz 1272172 Patch540: 0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch Patch541: 0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch @@ -633,17 +630,11 @@ Patch556: netfilter-ipset-Fix-extension-alignment.patch Patch557: netfilter-ipset-Fix-hash-type-expiration.patch Patch558: netfilter-ipset-Fix-hash-type-expire-release-empty-h.patch -#rhbz 1272571 -Patch559: 0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch - #rhbz 1278688 Patch560: 0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch Patch561: 0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch Patch562: 0003-KVM-x86-fix-previous-commit-for-32-bit.patch -#CVE-2015-8374 rhbz 1286261 1286262 -Patch565: Btrfs-fix-truncation-of-compressed-and-inlined-exten.patch - #rhbz 1284059 Patch566: KEYS-Fix-handling-of-stored-error-in-a-negatively-in.patch @@ -659,9 +650,6 @@ Patch570: HID-multitouch-enable-palm-rejection-if-device-imple.patch #rhbz 1286293 Patch571: ideapad-laptop-Add-Lenovo-ideapad-Y700-17ISK-to-no_h.patch -#CVE-2013-7446 rhbz 1282688 1282712 -Patch573: unix-avoid-use-after-free-in-ep_remove_wait_queue.patch - #CVE-XXXX-XXXX rhbz 1291329 1291332 Patch574: ovl-fix-permission-checking-for-setattr.patch @@ -2115,6 +2103,9 @@ fi # # %changelog +* Tue Dec 15 2015 Justin Forbes - 4.2.8-300 +- Linux v4.2.8 + * Tue Dec 15 2015 Josh Boyer - CVE-2015-8543 ipv6: DoS via NULL pointer dereference (rhbz 1290475 1290477) @@ -2128,7 +2119,7 @@ fi * Thu Dec 10 2015 Josh Boyer - Fix rfkill issues on ideapad Y700-17ISK (rhbz 1286293) -* Wed Dec 09 2015 - 4.2.7-300 +* Wed Dec 09 2015 Justin Forbes - 4.2.7-300 - Linux v4.2.7 * Thu Dec 03 2015 Josh Boyer diff --git a/sources b/sources index 73bddd8f3..7aef376a0 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 3d5ea06d767e2f35c999eeadafc76523 linux-4.2.tar.xz 4c964bfba54d65b5b54cc898baddecad perf-man-4.2.tar.gz -5962072782033501e13df5f1f9507aa4 patch-4.2.7.xz +c000fd7de765fc8cd60942aa52a996ed patch-4.2.8.xz diff --git a/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch b/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch deleted file mode 100644 index a20366db3..000000000 --- a/unix-avoid-use-after-free-in-ep_remove_wait_queue.patch +++ /dev/null @@ -1,332 +0,0 @@ -From: Rainer Weikusat -Date: Fri, 20 Nov 2015 22:07:23 +0000 -Subject: [PATCH 04/37] unix: avoid use-after-free in ep_remove_wait_queue - -[ Upstream commit 7d267278a9ece963d77eefec61630223fce08c6c ] - -Rainer Weikusat writes: -An AF_UNIX datagram socket being the client in an n:1 association with -some server socket is only allowed to send messages to the server if the -receive queue of this socket contains at most sk_max_ack_backlog -datagrams. This implies that prospective writers might be forced to go -to sleep despite none of the message presently enqueued on the server -receive queue were sent by them. In order to ensure that these will be -woken up once space becomes again available, the present unix_dgram_poll -routine does a second sock_poll_wait call with the peer_wait wait queue -of the server socket as queue argument (unix_dgram_recvmsg does a wake -up on this queue after a datagram was received). This is inherently -problematic because the server socket is only guaranteed to remain alive -for as long as the client still holds a reference to it. In case the -connection is dissolved via connect or by the dead peer detection logic -in unix_dgram_sendmsg, the server socket may be freed despite "the -polling mechanism" (in particular, epoll) still has a pointer to the -corresponding peer_wait queue. There's no way to forcibly deregister a -wait queue with epoll. - -Based on an idea by Jason Baron, the patch below changes the code such -that a wait_queue_t belonging to the client socket is enqueued on the -peer_wait queue of the server whenever the peer receive queue full -condition is detected by either a sendmsg or a poll. A wake up on the -peer queue is then relayed to the ordinary wait queue of the client -socket via wake function. The connection to the peer wait queue is again -dissolved if either a wake up is about to be relayed or the client -socket reconnects or a dead peer is detected or the client socket is -itself closed. This enables removing the second sock_poll_wait from -unix_dgram_poll, thus avoiding the use-after-free, while still ensuring -that no blocked writer sleeps forever. - -Signed-off-by: Rainer Weikusat -Fixes: ec0d215f9420 ("af_unix: fix 'poll for write'/connected DGRAM sockets") -Reviewed-by: Jason Baron -Signed-off-by: David S. Miller ---- - include/net/af_unix.h | 1 + - net/unix/af_unix.c | 183 ++++++++++++++++++++++++++++++++++++++++++++------ - 2 files changed, 165 insertions(+), 19 deletions(-) - -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index cb1b9bb..49c7683 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -62,6 +62,7 @@ struct unix_sock { - #define UNIX_GC_CANDIDATE 0 - #define UNIX_GC_MAYBE_CYCLE 1 - struct socket_wq peer_wq; -+ wait_queue_t peer_wake; - }; - - static inline struct unix_sock *unix_sk(struct sock *sk) -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 42ab2cc..153b2f2 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -326,6 +326,118 @@ found: - return s; - } - -+/* Support code for asymmetrically connected dgram sockets -+ * -+ * If a datagram socket is connected to a socket not itself connected -+ * to the first socket (eg, /dev/log), clients may only enqueue more -+ * messages if the present receive queue of the server socket is not -+ * "too large". This means there's a second writeability condition -+ * poll and sendmsg need to test. The dgram recv code will do a wake -+ * up on the peer_wait wait queue of a socket upon reception of a -+ * datagram which needs to be propagated to sleeping would-be writers -+ * since these might not have sent anything so far. This can't be -+ * accomplished via poll_wait because the lifetime of the server -+ * socket might be less than that of its clients if these break their -+ * association with it or if the server socket is closed while clients -+ * are still connected to it and there's no way to inform "a polling -+ * implementation" that it should let go of a certain wait queue -+ * -+ * In order to propagate a wake up, a wait_queue_t of the client -+ * socket is enqueued on the peer_wait queue of the server socket -+ * whose wake function does a wake_up on the ordinary client socket -+ * wait queue. This connection is established whenever a write (or -+ * poll for write) hit the flow control condition and broken when the -+ * association to the server socket is dissolved or after a wake up -+ * was relayed. -+ */ -+ -+static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags, -+ void *key) -+{ -+ struct unix_sock *u; -+ wait_queue_head_t *u_sleep; -+ -+ u = container_of(q, struct unix_sock, peer_wake); -+ -+ __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait, -+ q); -+ u->peer_wake.private = NULL; -+ -+ /* relaying can only happen while the wq still exists */ -+ u_sleep = sk_sleep(&u->sk); -+ if (u_sleep) -+ wake_up_interruptible_poll(u_sleep, key); -+ -+ return 0; -+} -+ -+static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other) -+{ -+ struct unix_sock *u, *u_other; -+ int rc; -+ -+ u = unix_sk(sk); -+ u_other = unix_sk(other); -+ rc = 0; -+ spin_lock(&u_other->peer_wait.lock); -+ -+ if (!u->peer_wake.private) { -+ u->peer_wake.private = other; -+ __add_wait_queue(&u_other->peer_wait, &u->peer_wake); -+ -+ rc = 1; -+ } -+ -+ spin_unlock(&u_other->peer_wait.lock); -+ return rc; -+} -+ -+static void unix_dgram_peer_wake_disconnect(struct sock *sk, -+ struct sock *other) -+{ -+ struct unix_sock *u, *u_other; -+ -+ u = unix_sk(sk); -+ u_other = unix_sk(other); -+ spin_lock(&u_other->peer_wait.lock); -+ -+ if (u->peer_wake.private == other) { -+ __remove_wait_queue(&u_other->peer_wait, &u->peer_wake); -+ u->peer_wake.private = NULL; -+ } -+ -+ spin_unlock(&u_other->peer_wait.lock); -+} -+ -+static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk, -+ struct sock *other) -+{ -+ unix_dgram_peer_wake_disconnect(sk, other); -+ wake_up_interruptible_poll(sk_sleep(sk), -+ POLLOUT | -+ POLLWRNORM | -+ POLLWRBAND); -+} -+ -+/* preconditions: -+ * - unix_peer(sk) == other -+ * - association is stable -+ */ -+static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other) -+{ -+ int connected; -+ -+ connected = unix_dgram_peer_wake_connect(sk, other); -+ -+ if (unix_recvq_full(other)) -+ return 1; -+ -+ if (connected) -+ unix_dgram_peer_wake_disconnect(sk, other); -+ -+ return 0; -+} -+ - static inline int unix_writable(struct sock *sk) - { - return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf; -@@ -430,6 +542,8 @@ static void unix_release_sock(struct sock *sk, int embrion) - skpair->sk_state_change(skpair); - sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP); - } -+ -+ unix_dgram_peer_wake_disconnect(sk, skpair); - sock_put(skpair); /* It may now die */ - unix_peer(sk) = NULL; - } -@@ -665,6 +779,7 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern) - INIT_LIST_HEAD(&u->link); - mutex_init(&u->readlock); /* single task reading lock */ - init_waitqueue_head(&u->peer_wait); -+ init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay); - unix_insert_socket(unix_sockets_unbound(sk), sk); - out: - if (sk == NULL) -@@ -1032,6 +1147,8 @@ restart: - if (unix_peer(sk)) { - struct sock *old_peer = unix_peer(sk); - unix_peer(sk) = other; -+ unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer); -+ - unix_state_double_unlock(sk, other); - - if (other != old_peer) -@@ -1471,6 +1588,7 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, - struct scm_cookie scm; - int max_level; - int data_len = 0; -+ int sk_locked; - - wait_for_unix_gc(); - err = scm_send(sock, msg, &scm, false); -@@ -1549,12 +1667,14 @@ restart: - goto out_free; - } - -+ sk_locked = 0; - unix_state_lock(other); -+restart_locked: - err = -EPERM; - if (!unix_may_send(sk, other)) - goto out_unlock; - -- if (sock_flag(other, SOCK_DEAD)) { -+ if (unlikely(sock_flag(other, SOCK_DEAD))) { - /* - * Check with 1003.1g - what should - * datagram error -@@ -1562,10 +1682,14 @@ restart: - unix_state_unlock(other); - sock_put(other); - -+ if (!sk_locked) -+ unix_state_lock(sk); -+ - err = 0; -- unix_state_lock(sk); - if (unix_peer(sk) == other) { - unix_peer(sk) = NULL; -+ unix_dgram_peer_wake_disconnect_wakeup(sk, other); -+ - unix_state_unlock(sk); - - unix_dgram_disconnected(sk, other); -@@ -1591,21 +1715,38 @@ restart: - goto out_unlock; - } - -- if (unix_peer(other) != sk && unix_recvq_full(other)) { -- if (!timeo) { -- err = -EAGAIN; -- goto out_unlock; -+ if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { -+ if (timeo) { -+ timeo = unix_wait_for_peer(other, timeo); -+ -+ err = sock_intr_errno(timeo); -+ if (signal_pending(current)) -+ goto out_free; -+ -+ goto restart; - } - -- timeo = unix_wait_for_peer(other, timeo); -+ if (!sk_locked) { -+ unix_state_unlock(other); -+ unix_state_double_lock(sk, other); -+ } - -- err = sock_intr_errno(timeo); -- if (signal_pending(current)) -- goto out_free; -+ if (unix_peer(sk) != other || -+ unix_dgram_peer_wake_me(sk, other)) { -+ err = -EAGAIN; -+ sk_locked = 1; -+ goto out_unlock; -+ } - -- goto restart; -+ if (!sk_locked) { -+ sk_locked = 1; -+ goto restart_locked; -+ } - } - -+ if (unlikely(sk_locked)) -+ unix_state_unlock(sk); -+ - if (sock_flag(other, SOCK_RCVTSTAMP)) - __net_timestamp(skb); - maybe_add_creds(skb, sock, other); -@@ -1619,6 +1760,8 @@ restart: - return len; - - out_unlock: -+ if (sk_locked) -+ unix_state_unlock(sk); - unix_state_unlock(other); - out_free: - kfree_skb(skb); -@@ -2475,14 +2618,16 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock, - return mask; - - writable = unix_writable(sk); -- other = unix_peer_get(sk); -- if (other) { -- if (unix_peer(other) != sk) { -- sock_poll_wait(file, &unix_sk(other)->peer_wait, wait); -- if (unix_recvq_full(other)) -- writable = 0; -- } -- sock_put(other); -+ if (writable) { -+ unix_state_lock(sk); -+ -+ other = unix_peer(sk); -+ if (other && unix_peer(other) != sk && -+ unix_recvq_full(other) && -+ unix_dgram_peer_wake_me(sk, other)) -+ writable = 0; -+ -+ unix_state_unlock(sk); - } - - if (writable) --- -2.1.0 - From 6cd517bb35109faa556be63f86a41c230d21c270 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Thu, 17 Dec 2015 08:16:06 -0500 Subject: [PATCH 24/27] CVE-2015-8569 info leak from getsockname (rhbz 1292045 1292047) --- kernel.spec | 6 +++ ...addr_len-in-pptp_bind-and-pptp_conne.patch | 39 +++++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch diff --git a/kernel.spec b/kernel.spec index 420794f35..403de6976 100644 --- a/kernel.spec +++ b/kernel.spec @@ -659,6 +659,9 @@ Patch575: KEYS-Fix-race-between-read-and-revoke.patch #CVE-2015-8543 rhbz 1290475 1290477 Patch576: net-add-validation-for-the-socket-syscall-protocol-a.patch +#CVE-2015-8569 rhbz 1292045 1292047 +Patch600: pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch + # END OF PATCH DEFINITIONS %endif @@ -2103,6 +2106,9 @@ fi # # %changelog +* Thu Dec 17 2015 Josh Boyer +- CVE-2015-8569 info leak from getsockname (rhbz 1292045 1292047) + * Tue Dec 15 2015 Justin Forbes - 4.2.8-300 - Linux v4.2.8 diff --git a/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch b/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch new file mode 100644 index 000000000..b891c5211 --- /dev/null +++ b/pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch @@ -0,0 +1,39 @@ +From 16c5a158e97d5b1f6c8bf86b006c1349f025d4e0 Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Mon, 14 Dec 2015 13:48:36 -0800 +Subject: [PATCH] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() + +Reported-by: Dmitry Vyukov +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +--- + drivers/net/ppp/pptp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index fc69e41d0950..597c53e0a2ec 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -419,6 +419,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr, + struct pptp_opt *opt = &po->proto.pptp; + int error = 0; + ++ if (sockaddr_len < sizeof(struct sockaddr_pppox)) ++ return -EINVAL; ++ + lock_sock(sk); + + opt->src_addr = sp->sa_addr.pptp; +@@ -440,6 +443,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + struct flowi4 fl4; + int error = 0; + ++ if (sockaddr_len < sizeof(struct sockaddr_pppox)) ++ return -EINVAL; ++ + if (sp->sa_protocol != PX_PROTO_PPTP) + return -EINVAL; + +-- +2.5.0 + From 44ce1614d8ca3f93aab59bd742a0bce163a91eb3 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 18 Dec 2015 08:54:38 -0500 Subject: [PATCH 25/27] CVE-2015-8575 information leak in sco_sock_bind (rhbz 1292840 1292841) --- ...te-socket-address-length-in-sco_sock.patch | 27 +++++++++++++++++++ kernel.spec | 6 +++++ 2 files changed, 33 insertions(+) create mode 100644 bluetooth-Validate-socket-address-length-in-sco_sock.patch diff --git a/bluetooth-Validate-socket-address-length-in-sco_sock.patch b/bluetooth-Validate-socket-address-length-in-sco_sock.patch new file mode 100644 index 000000000..1ee23fcf4 --- /dev/null +++ b/bluetooth-Validate-socket-address-length-in-sco_sock.patch @@ -0,0 +1,27 @@ +From 5233252fce714053f0151680933571a2da9cbfb4 Mon Sep 17 00:00:00 2001 +From: "David S. Miller" +Date: Tue, 15 Dec 2015 15:39:08 -0500 +Subject: [PATCH] bluetooth: Validate socket address length in sco_sock_bind(). + +Signed-off-by: David S. Miller +--- + net/bluetooth/sco.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index fe129663bd3f..f52bcbf2e58c 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, + if (!addr || addr->sa_family != AF_BLUETOOTH) + return -EINVAL; + ++ if (addr_len < sizeof(struct sockaddr_sco)) ++ return -EINVAL; ++ + lock_sock(sk); + + if (sk->sk_state != BT_OPEN) { +-- +2.5.0 + diff --git a/kernel.spec b/kernel.spec index 403de6976..bcfe4b00c 100644 --- a/kernel.spec +++ b/kernel.spec @@ -662,6 +662,9 @@ Patch576: net-add-validation-for-the-socket-syscall-protocol-a.patch #CVE-2015-8569 rhbz 1292045 1292047 Patch600: pptp-verify-sockaddr_len-in-pptp_bind-and-pptp_conne.patch +#CVE-2015-8575 rhbz 1292840 1292841 +Patch601: bluetooth-Validate-socket-address-length-in-sco_sock.patch + # END OF PATCH DEFINITIONS %endif @@ -2106,6 +2109,9 @@ fi # # %changelog +* Fri Dec 18 2015 Josh Boyer +- CVE-2015-8575 information leak in sco_sock_bind (rhbz 1292840 1292841) + * Thu Dec 17 2015 Josh Boyer - CVE-2015-8569 info leak from getsockname (rhbz 1292045 1292047) From 48f65f65ce3da16aafd1a9e03fbce36410163daf Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 5 Jan 2016 14:56:17 -0500 Subject: [PATCH 26/27] Merge 4.3.3 from stabilization branch --- ...hen-attempt-to-garbage-collect-an-un.patch | 76 -------- ...m_userspace_memory_region-in-x86_set.patch | 169 ------------------ ...ing-RTF_CACHE-from-a-rt-that-is-not-.patch | 91 ++++++++++ ...map_wdt-fix-null-pointer-dereference.patch | 63 +++++++ ...-x86-cpu-cacheinfo-Fix-teardown-path.patch | 86 +++++++++ ...t-request_key-to-construct-a-new-key.patch | 34 ---- ...p-private-slots-in-__x86_set_memory_.patch | 134 -------------- ...M-x86-fix-previous-commit-for-32-bit.patch | 30 ---- ACPI-Limit-access-to-custom_method.patch | 6 +- Add-EFI-signature-data-types.patch | 6 +- ...signature-blob-parser-and-key-loader.patch | 8 +- ...tomatically-enforce-module-signature.patch | 32 ++-- Add-secure_modules-call.patch | 16 +- ...q-option-to-disable-secure-boot-mode.patch | 32 ++-- ...x-accessing-freed-memory-during-devi.patch | 53 ++++++ ...hm-IPC-objects-before-doing-ipc_addi.patch | 117 ++++++++++++ KEYS-Add-a-system-blacklist-keyring.patch | 127 +++++++------ ...und-infinite-loop-in-microcode-when-.patch | 92 ---------- ...t-certificates-from-UEFI-Secure-Boot.patch | 34 ++-- ...-Support-not-importing-certs-from-db.patch | 6 +- ...R-access-when-module-security-is-ena.patch | 7 +- ...nderlying-transport-exists-before-cr.patch | 79 ++++++++ ...-and-dev-kmem-when-module-loading-is.patch | 6 +- ...at-fix-potential-null-deref-at-probe.patch | 81 +++++++++ ..._rsdp-kernel-parameter-when-module-l.patch | 14 +- ...orce-native-backlight-quirk-for-Leno.patch | 81 +++++++++ ...-forcing-native-backlight-on-non-win.patch | 73 ++++++++ alua_fix.patch | 41 +++++ ...t-debugfs-interface-when-module-load.patch | 8 +- ...oy_all-should-clear-q-root_blkg-and-.patch | 64 +++++++ config-arm-generic | 29 ++- config-arm64 | 26 ++- config-armv7 | 16 +- config-armv7-generic | 19 +- config-armv7-lpae | 1 + config-debug | 2 +- config-generic | 82 ++++++++- config-powerpc64-generic | 5 + config-powerpc64le | 3 + config-s390x | 2 + config-x86-generic | 22 ++- config-x86_64-generic | 5 + ...Handle-escaped-paths-in-prepend_path.patch | 65 +++++++ disable-i8042-check-on-apple-mac.patch | 12 +- drm-i915-hush-check-crtc-state.patch | 18 +- efi-Add-EFI_SECURE_BOOT-bit.patch | 10 +- ...ure-boot-if-shim-is-in-insecure-mode.patch | 8 +- ...ECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch | 10 +- filter-aarch64.sh | 0 filter-armv7hl.sh | 0 filter-i686.sh | 0 filter-ppc64.sh | 0 filter-ppc64le.sh | 0 filter-ppc64p7.sh | 0 filter-s390x.sh | 0 filter-x86_64.sh | 0 ...able-in-a-signed-modules-environment.patch | 6 +- ...dd-Lenovo-Yoga-3-14-to-no_hw_rfkill-.patch | 40 ----- input-silence-i8042-noise.patch | 8 +- kbuild-AFTER_LINK.patch | 12 +- kernel.spec | 93 +++++----- ...-runtime-if-the-kernel-enforces-modu.patch | 22 ++- ...e-that-the-whole-MFD-is-built-into-a.patch | 28 +++ net-inet-fix-race-in-reqsk_queue_unlink.patch | 76 ++++++++ ...trl-single-must-be-initialized-early.patch | 34 ++++ regulator-anatop-module-alias.patch | 24 --- ...-correct-reserved-memory-calculation.patch | 61 ------- si2157-Bounds-check-firmware.patch | 39 ++++ si2168-Bounds-check-firmware.patch | 50 ++++++ sources | 6 +- ...-handle-paths-that-are-unreachable-f.patch | 110 ++++++++++++ vrf-fix-memory-leak-on-registration.patch | 42 +++++ ...-port-access-when-module-security-is.patch | 7 +- ...-access-when-module-loading-is-restr.patch | 7 +- 74 files changed, 1755 insertions(+), 911 deletions(-) delete mode 100644 0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch delete mode 100644 0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch create mode 100644 0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch create mode 100644 0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch create mode 100644 0001-x86-cpu-cacheinfo-Fix-teardown-path.patch delete mode 100644 0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch delete mode 100644 0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch delete mode 100644 0003-KVM-x86-fix-previous-commit-for-32-bit.patch create mode 100644 HID-hid-input-Fix-accessing-freed-memory-during-devi.patch create mode 100644 Initialize-msg-shm-IPC-objects-before-doing-ipc_addi.patch delete mode 100644 KVM-x86-work-around-infinite-loop-in-microcode-when-.patch create mode 100644 RDS-verify-the-underlying-transport-exists-before-cr.patch create mode 100644 USB-whiteheat-fix-potential-null-deref-at-probe.patch create mode 100644 acpi-video-Add-force-native-backlight-quirk-for-Leno.patch create mode 100644 acpi-video-Allow-forcing-native-backlight-on-non-win.patch create mode 100644 alua_fix.patch create mode 100644 block-blkg_destroy_all-should-clear-q-root_blkg-and-.patch create mode 100644 dcache-Handle-escaped-paths-in-prepend_path.patch mode change 100644 => 100755 filter-aarch64.sh mode change 100644 => 100755 filter-armv7hl.sh mode change 100644 => 100755 filter-i686.sh mode change 100644 => 100755 filter-ppc64.sh mode change 100644 => 100755 filter-ppc64le.sh mode change 100644 => 100755 filter-ppc64p7.sh mode change 100644 => 100755 filter-s390x.sh mode change 100644 => 100755 filter-x86_64.sh delete mode 100644 ideapad-laptop-Add-Lenovo-Yoga-3-14-to-no_hw_rfkill-.patch create mode 100644 mfd-wm8994-Ensure-that-the-whole-MFD-is-built-into-a.patch create mode 100644 net-inet-fix-race-in-reqsk_queue_unlink.patch create mode 100644 pinctrl-pinctrl-single-must-be-initialized-early.patch delete mode 100644 regulator-anatop-module-alias.patch delete mode 100644 showmem-cma-correct-reserved-memory-calculation.patch create mode 100644 si2157-Bounds-check-firmware.patch create mode 100644 si2168-Bounds-check-firmware.patch create mode 100644 vfs-Test-for-and-handle-paths-that-are-unreachable-f.patch create mode 100644 vrf-fix-memory-leak-on-registration.patch diff --git a/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch b/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch deleted file mode 100644 index 15640604b..000000000 --- a/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch +++ /dev/null @@ -1,76 +0,0 @@ -From d856e14fb043b742f94170db36b812770a2591d0 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Thu, 15 Oct 2015 17:21:37 +0100 -Subject: [PATCH 1/2] KEYS: Fix crash when attempt to garbage collect an - uninstantiated keyring - - The following sequence of commands: - - i=`keyctl add user a a @s` - keyctl request2 keyring foo bar @t - keyctl unlink $i @s - - tries to invoke an upcall to instantiate a keyring if one doesn't already - exist by that name within the user's keyring set. However, if the upcall - fails, the code sets keyring->type_data.reject_error to -ENOKEY or some - other error code. When the key is garbage collected, the key destroy - function is called unconditionally and keyring_destroy() uses list_empty() - on keyring->type_data.link - which is in a union with reject_error. - Subsequently, the kernel tries to unlink the keyring from the keyring names - list - which oopses like this: - - BUG: unable to handle kernel paging request at 00000000ffffff8a - IP: [] keyring_destroy+0x3d/0x88 - ... - Workqueue: events key_garbage_collector - ... - RIP: 0010:[] keyring_destroy+0x3d/0x88 - RSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203 - RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000 - RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40 - RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000 - R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900 - R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000 - ... - CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0 - ... - Call Trace: - [] key_gc_unused_keys.constprop.1+0x5d/0x10f - [] key_garbage_collector+0x1fa/0x351 - [] process_one_work+0x28e/0x547 - [] worker_thread+0x26e/0x361 - [] ? rescuer_thread+0x2a8/0x2a8 - [] kthread+0xf3/0xfb - [] ? kthread_create_on_node+0x1c2/0x1c2 - [] ret_from_fork+0x3f/0x70 - [] ? kthread_create_on_node+0x1c2/0x1c2 - - Note the value in RAX. This is a 32-bit representation of -ENOKEY. - - The solution is to only call ->destroy() if the key was successfully - instantiated. - - Reported-by: Dmitry Vyukov - Signed-off-by: David Howells ---- - security/keys/gc.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/security/keys/gc.c b/security/keys/gc.c -index c7952375ac53..11c36627adbf 100644 ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -149,7 +149,9 @@ static noinline void key_gc_unused_keys(struct list_head *keys) - atomic_dec(&key->user->nikeys); - - /* now throw away the key memory */ -- if (key->type->destroy) -+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && -+ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) && -+ key->type->destroy) - key->type->destroy(key); - - key_user_put(key->user); --- -2.4.3 - diff --git a/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch b/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch deleted file mode 100644 index 6395b1746..000000000 --- a/0001-KVM-x86-build-kvm_userspace_memory_region-in-x86_set.patch +++ /dev/null @@ -1,169 +0,0 @@ -From 1d8007bdee074fdffcf3539492d8a151a1fb3436 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Mon, 12 Oct 2015 13:38:32 +0200 -Subject: [PATCH] KVM: x86: build kvm_userspace_memory_region in - x86_set_memory_region -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The next patch will make x86_set_memory_region fill the -userspace_addr. Since the struct is not used untouched -anymore, it makes sense to build it in x86_set_memory_region -directly; it also simplifies the callers. - -Reported-by: Alexandre DERUMIER -Cc: stable@vger.kernel.org -Fixes: 9da0e4d5ac969909f6b435ce28ea28135a9cbd69 -Reviewed-by: Radim Krčmář -Signed-off-by: Paolo Bonzini ---- - arch/x86/include/asm/kvm_host.h | 6 ++---- - arch/x86/kvm/vmx.c | 26 ++++++-------------------- - arch/x86/kvm/x86.c | 31 +++++++++++++------------------ - 3 files changed, 21 insertions(+), 42 deletions(-) - -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 49ec903..4e7ad7e 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -1199,9 +1199,7 @@ void kvm_complete_insn_gp(struct kvm_vcpu *vcpu, int err); - - int kvm_is_in_guest(void); - --int __x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem); --int x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem); -+int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size); -+int x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size); - - #endif /* _ASM_X86_KVM_HOST_H */ -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 18c30b4..8461e0c 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -4105,17 +4105,13 @@ static void seg_setup(int seg) - static int alloc_apic_access_page(struct kvm *kvm) - { - struct page *page; -- struct kvm_userspace_memory_region kvm_userspace_mem; - int r = 0; - - mutex_lock(&kvm->slots_lock); - if (kvm->arch.apic_access_page_done) - goto out; -- kvm_userspace_mem.slot = APIC_ACCESS_PAGE_PRIVATE_MEMSLOT; -- kvm_userspace_mem.flags = 0; -- kvm_userspace_mem.guest_phys_addr = APIC_DEFAULT_PHYS_BASE; -- kvm_userspace_mem.memory_size = PAGE_SIZE; -- r = __x86_set_memory_region(kvm, &kvm_userspace_mem); -+ r = __x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT, -+ APIC_DEFAULT_PHYS_BASE, PAGE_SIZE); - if (r) - goto out; - -@@ -4140,17 +4136,12 @@ static int alloc_identity_pagetable(struct kvm *kvm) - { - /* Called with kvm->slots_lock held. */ - -- struct kvm_userspace_memory_region kvm_userspace_mem; - int r = 0; - - BUG_ON(kvm->arch.ept_identity_pagetable_done); - -- kvm_userspace_mem.slot = IDENTITY_PAGETABLE_PRIVATE_MEMSLOT; -- kvm_userspace_mem.flags = 0; -- kvm_userspace_mem.guest_phys_addr = -- kvm->arch.ept_identity_map_addr; -- kvm_userspace_mem.memory_size = PAGE_SIZE; -- r = __x86_set_memory_region(kvm, &kvm_userspace_mem); -+ r = __x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT, -+ kvm->arch.ept_identity_map_addr, PAGE_SIZE); - - return r; - } -@@ -4949,14 +4940,9 @@ static int vmx_interrupt_allowed(struct kvm_vcpu *vcpu) - static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr) - { - int ret; -- struct kvm_userspace_memory_region tss_mem = { -- .slot = TSS_PRIVATE_MEMSLOT, -- .guest_phys_addr = addr, -- .memory_size = PAGE_SIZE * 3, -- .flags = 0, -- }; - -- ret = x86_set_memory_region(kvm, &tss_mem); -+ ret = x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, addr, -+ PAGE_SIZE * 3); - if (ret) - return ret; - kvm->arch.tss_addr = addr; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 373328b..b12665b 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7721,18 +7721,21 @@ void kvm_arch_sync_events(struct kvm *kvm) - kvm_free_pit(kvm); - } - --int __x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem) -+int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int i, r; - - /* Called with kvm->slots_lock held. */ -- BUG_ON(mem->slot >= KVM_MEM_SLOTS_NUM); -+ if (WARN_ON(id >= KVM_MEM_SLOTS_NUM)) -+ return -EINVAL; - - for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { -- struct kvm_userspace_memory_region m = *mem; -+ struct kvm_userspace_memory_region m; - -- m.slot |= i << 16; -+ m.slot = id | (i << 16); -+ m.flags = 0; -+ m.guest_phys_addr = gpa; -+ m.memory_size = size; - r = __kvm_set_memory_region(kvm, &m); - if (r < 0) - return r; -@@ -7742,13 +7745,12 @@ int __x86_set_memory_region(struct kvm *kvm, - } - EXPORT_SYMBOL_GPL(__x86_set_memory_region); - --int x86_set_memory_region(struct kvm *kvm, -- const struct kvm_userspace_memory_region *mem) -+int x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int r; - - mutex_lock(&kvm->slots_lock); -- r = __x86_set_memory_region(kvm, mem); -+ r = __x86_set_memory_region(kvm, id, gpa, size); - mutex_unlock(&kvm->slots_lock); - - return r; -@@ -7763,16 +7765,9 @@ void kvm_arch_destroy_vm(struct kvm *kvm) - * unless the the memory map has changed due to process exit - * or fd copying. - */ -- struct kvm_userspace_memory_region mem; -- memset(&mem, 0, sizeof(mem)); -- mem.slot = APIC_ACCESS_PAGE_PRIVATE_MEMSLOT; -- x86_set_memory_region(kvm, &mem); -- -- mem.slot = IDENTITY_PAGETABLE_PRIVATE_MEMSLOT; -- x86_set_memory_region(kvm, &mem); -- -- mem.slot = TSS_PRIVATE_MEMSLOT; -- x86_set_memory_region(kvm, &mem); -+ x86_set_memory_region(kvm, APIC_ACCESS_PAGE_PRIVATE_MEMSLOT, 0, 0); -+ x86_set_memory_region(kvm, IDENTITY_PAGETABLE_PRIVATE_MEMSLOT, 0, 0); -+ x86_set_memory_region(kvm, TSS_PRIVATE_MEMSLOT, 0, 0); - } - kvm_iommu_unmap_guest(kvm); - kfree(kvm->arch.vpic); diff --git a/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch b/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch new file mode 100644 index 000000000..3390024d2 --- /dev/null +++ b/0001-ipv6-Avoid-creating-RTF_CACHE-from-a-rt-that-is-not-.patch @@ -0,0 +1,91 @@ +From 0d3f6d297bfb7af24d0508460fdb3d1ec4903fa3 Mon Sep 17 00:00:00 2001 +From: Martin KaFai Lau +Date: Wed, 11 Nov 2015 11:51:06 -0800 +Subject: [PATCH] ipv6: Avoid creating RTF_CACHE from a rt that is not managed + by fib6 tree + +The original bug report: +https://bugzilla.redhat.com/show_bug.cgi?id=1272571 + +The setup has a IPv4 GRE tunnel running in a IPSec. The bug +happens when ndisc starts sending router solicitation at the gre +interface. The simplified oops stack is like: + +__lock_acquire+0x1b2/0x1c30 +lock_acquire+0xb9/0x140 +_raw_write_lock_bh+0x3f/0x50 +__ip6_ins_rt+0x2e/0x60 +ip6_ins_rt+0x49/0x50 +~~~~~~~~ +__ip6_rt_update_pmtu.part.54+0x145/0x250 +ip6_rt_update_pmtu+0x2e/0x40 +~~~~~~~~ +ip_tunnel_xmit+0x1f1/0xf40 +__gre_xmit+0x7a/0x90 +ipgre_xmit+0x15a/0x220 +dev_hard_start_xmit+0x2bd/0x480 +__dev_queue_xmit+0x696/0x730 +dev_queue_xmit+0x10/0x20 +neigh_direct_output+0x11/0x20 +ip6_finish_output2+0x21f/0x770 +ip6_finish_output+0xa7/0x1d0 +ip6_output+0x56/0x190 +~~~~~~~~ +ndisc_send_skb+0x1d9/0x400 +ndisc_send_rs+0x88/0xc0 +~~~~~~~~ + +The rt passed to ip6_rt_update_pmtu() is created by +icmp6_dst_alloc() and it is not managed by the fib6 tree, +so its rt6i_table == NULL. When __ip6_rt_update_pmtu() creates +a RTF_CACHE clone, the newly created clone also has rt6i_table == NULL +and it causes the ip6_ins_rt() oops. + +During pmtu update, we only want to create a RTF_CACHE clone +from a rt which is currently managed (or owned) by the +fib6 tree. It means either rt->rt6i_node != NULL or +rt is a RTF_PCPU clone. + +It is worth to note that rt6i_table may not be NULL even it is +not (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()). +Hence, rt6i_node is a better check instead of rt6i_table. + +Fixes: 45e4fd26683c ("ipv6: Only create RTF_CACHE routes after encountering pmtu") +Signed-off-by: Martin KaFai Lau +Reported-by: Chris Siebenmann +Cc: Chris Siebenmann +Cc: Hannes Frederic Sowa +Signed-off-by: David S. Miller +--- + net/ipv6/route.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index c8bc9b4..74907c5 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1322,6 +1322,12 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu) + rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires); + } + ++static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) ++{ ++ return !(rt->rt6i_flags & RTF_CACHE) && ++ (rt->rt6i_flags & RTF_PCPU || rt->rt6i_node); ++} ++ + static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + const struct ipv6hdr *iph, u32 mtu) + { +@@ -1335,7 +1341,7 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + if (mtu >= dst_mtu(dst)) + return; + +- if (rt6->rt6i_flags & RTF_CACHE) { ++ if (!rt6_cache_allowed_for_pmtu(rt6)) { + rt6_do_update_pmtu(rt6, mtu); + } else { + const struct in6_addr *daddr, *saddr; +-- +2.5.0 + diff --git a/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch b/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch new file mode 100644 index 000000000..7dab1ff5c --- /dev/null +++ b/0001-watchdog-omap_wdt-fix-null-pointer-dereference.patch @@ -0,0 +1,63 @@ +From 721ebb3cf4788107424f92ac2da6cfce20c67297 Mon Sep 17 00:00:00 2001 +From: Peter Robinson +Date: Sun, 1 Nov 2015 23:54:08 +0000 +Subject: [PATCH] watchdog: omap_wdt: fix null pointer dereference + +Fix issue from two patches overlapping causing a kernel oops + +[ 3569.297449] Unable to handle kernel NULL pointer dereference at virtual address 00000088 +[ 3569.306272] pgd = dc894000 +[ 3569.309287] [00000088] *pgd=00000000 +[ 3569.313104] Internal error: Oops: 5 [#1] SMP ARM +[ 3569.317986] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_filter ebtable_nat ebtable_broute bridge stp llc ebtables ip6table_security ip6table_raw ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_filter ip6_tables iptable_security iptable_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle musb_dsps cppi41 musb_hdrc phy_am335x udc_core phy_generic phy_am335x_control omap_sham omap_aes omap_rng omap_hwspinlock omap_mailbox hwspinlock_core musb_am335x omap_wdt at24 8250_omap leds_gpio cpufreq_dt smsc davinci_mdio mmc_block ti_cpsw cpsw_common ptp pps_core cpsw_ale davinci_cpdma omap_hsmmc omap_dma mmc_core i2c_dev +[ 3569.386293] CPU: 0 PID: 1429 Comm: wdctl Not tainted 4.3.0-0.rc7.git0.1.fc24.armv7hl #1 +[ 3569.394740] Hardware name: Generic AM33XX (Flattened Device Tree) +[ 3569.401179] task: dbd11a00 ti: dbaac000 task.ti: dbaac000 +[ 3569.406917] PC is at omap_wdt_get_timeleft+0xc/0x20 [omap_wdt] +[ 3569.413106] LR is at watchdog_ioctl+0x3cc/0x42c +[ 3569.417902] pc : [] lr : [] psr: 600f0013 +[ 3569.417902] sp : dbaadf18 ip : 00000003 fp : 7f5d3bbe +[ 3569.430014] r10: 00000000 r9 : 00000003 r8 : bef21ab8 +[ 3569.435535] r7 : dbbc0f7c r6 : dbbc0f18 r5 : bef21ab8 r4 : 00000000 +[ 3569.442427] r3 : 00000000 r2 : 00000000 r1 : 8004570a r0 : dbbc0f18 +[ 3569.449323] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 3569.456858] Control: 10c5387d Table: 9c894019 DAC: 00000051 +[ 3569.462927] Process wdctl (pid: 1429, stack limit = 0xdbaac220) +[ 3569.469179] Stack: (0xdbaadf18 to 0xdbaae000) +[ 3569.473790] df00: bef21ab8 dbf60e38 +[ 3569.482441] df20: dc91b840 8004570a bef21ab8 c03988a4 dbaadf48 dc854000 00000000 dd313850 +[ 3569.491092] df40: ddf033b8 0000570a dc91b80b dbaadf3c dbf60e38 00000020 c0df9250 c0df6c48 +[ 3569.499741] df60: dc91b840 8004570a 00000000 dc91b840 dc91b840 8004570a bef21ab8 00000003 +[ 3569.508389] df80: 00000000 c03989d4 bef21b74 7f5d3bad 00000003 00000036 c020fcc4 dbaac000 +[ 3569.517037] dfa0: 00000000 c020fb00 bef21b74 7f5d3bad 00000003 8004570a bef21ab8 00000001 +[ 3569.525685] dfc0: bef21b74 7f5d3bad 00000003 00000036 00000001 00000000 7f5e4eb0 7f5d3bbe +[ 3569.534334] dfe0: 7f5e4f10 bef21a3c 7f5d0a54 b6e97e0c a00f0010 00000003 00000000 00000000 +[ 3569.543038] [] (omap_wdt_get_timeleft [omap_wdt]) from [] (watchdog_ioctl+0x3cc/0x42c) +[ 3569.553266] [] (watchdog_ioctl) from [] (do_vfs_ioctl+0x5bc/0x698) +[ 3569.561648] [] (do_vfs_ioctl) from [] (SyS_ioctl+0x54/0x7c) +[ 3569.569400] [] (SyS_ioctl) from [] (ret_fast_syscall+0x0/0x3c) +[ 3569.577413] Code: e12fff1e e52de004 e8bd4000 e5903060 (e5933088) +[ 3569.584089] ---[ end trace cec3039bd3ae610a ]--- + +Cc: # v4.2+ +Signed-off-by: Peter Robinson +--- + drivers/watchdog/omap_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index d96bee0..6f17c93 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -205,7 +205,7 @@ static int omap_wdt_set_timeout(struct watchdog_device *wdog, + + static unsigned int omap_wdt_get_timeleft(struct watchdog_device *wdog) + { +- struct omap_wdt_dev *wdev = watchdog_get_drvdata(wdog); ++ struct omap_wdt_dev *wdev = to_omap_wdt_dev(wdog); + void __iomem *base = wdev->base; + u32 value; + +-- +2.5.0 + diff --git a/0001-x86-cpu-cacheinfo-Fix-teardown-path.patch b/0001-x86-cpu-cacheinfo-Fix-teardown-path.patch new file mode 100644 index 000000000..52e82feed --- /dev/null +++ b/0001-x86-cpu-cacheinfo-Fix-teardown-path.patch @@ -0,0 +1,86 @@ +From 680ac028240f8747f31c03986fbcf18b2b521e93 Mon Sep 17 00:00:00 2001 +From: Borislav Petkov +Date: Mon, 27 Jul 2015 09:58:05 +0200 +Subject: [PATCH] x86/cpu/cacheinfo: Fix teardown path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Philip Müller reported a hang when booting 32-bit 4.1 kernel on +an AMD box. A fragment of the splat was enough to pinpoint the +issue: + + task: f58e0000 ti: f58e8000 task.ti: f58e800 + EIP: 0060:[] EFLAGS: 00010206 CPU: 0 + EIP is at free_cache_attributes+0x83/0xd0 + EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000 + ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0 + DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 + CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0 + +cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo +descriptor while the respective teardown path +cache_shared_cpu_map_remove() didn't. Fix that. + +From tglx's version: to be on the safe side, move the cacheinfo +descriptor check to free_cache_attributes(), thus cleaning up +the hotplug path a little and making this even more robust. + +Reported-by: Philip Müller +Signed-off-by: Borislav Petkov +Cc: # v4.1+ +Cc: Andre Przywara +Cc: Guenter Roeck +Cc: H. Peter Anvin +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Sudeep Holla +Cc: Thomas Gleixner +Cc: linux-kernel@vger.kernel.org +Cc: manjaro-dev@manjaro.org +Link: http://lkml.kernel.org/r/20150727075805.GA20416@nazgul.tnic +Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org +Signed-off-by: Ingo Molnar +--- + drivers/base/cacheinfo.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c +index 764280a91776..e9fd32e91668 100644 +--- a/drivers/base/cacheinfo.c ++++ b/drivers/base/cacheinfo.c +@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) + + if (sibling == cpu) /* skip itself */ + continue; ++ + sib_cpu_ci = get_cpu_cacheinfo(sibling); ++ if (!sib_cpu_ci->info_list) ++ continue; ++ + sib_leaf = sib_cpu_ci->info_list + index; + cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map); + cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map); +@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) + + static void free_cache_attributes(unsigned int cpu) + { ++ if (!per_cpu_cacheinfo(cpu)) ++ return; ++ + cache_shared_cpu_map_remove(cpu); + + kfree(per_cpu_cacheinfo(cpu)); +@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct notifier_block *nfb, + break; + case CPU_DEAD: + cache_remove_dev(cpu); +- if (per_cpu_cacheinfo(cpu)) +- free_cache_attributes(cpu); ++ free_cache_attributes(cpu); + break; + } + return notifier_from_errno(rc); +-- +2.4.3 + diff --git a/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch b/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch deleted file mode 100644 index 727ee6aca..000000000 --- a/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 93f27344ac019135dd5ff31a518f1ef2d9e4e4a1 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Mon, 19 Oct 2015 11:33:38 +0100 -Subject: [PATCH 2/2] KEYS: Don't permit request_key() to construct a new - keyring - - If request_key() is used to find a keyring, only do the search part - don't - do the construction part if the keyring was not found by the search. We - don't really want keyrings in the negative instantiated state since the - rejected/negative instantiation error value in the payload is unioned with - keyring metadata. - - Signed-off-by: David Howells ---- - security/keys/request_key.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/security/keys/request_key.c b/security/keys/request_key.c -index 486ef6fa393b..0d6253124278 100644 ---- a/security/keys/request_key.c -+++ b/security/keys/request_key.c -@@ -440,6 +440,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, - - kenter(""); - -+ if (ctx->index_key.type == &key_type_keyring) -+ return ERR_PTR(-EPERM); -+ - user = key_user_lookup(current_fsuid()); - if (!user) - return ERR_PTR(-ENOMEM); --- -2.4.3 - diff --git a/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch b/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch deleted file mode 100644 index 261c6e10f..000000000 --- a/0002-KVM-x86-map-unmap-private-slots-in-__x86_set_memory_.patch +++ /dev/null @@ -1,134 +0,0 @@ -From f0d648bdf0a5bbc91da6099d5282f77996558ea4 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Mon, 12 Oct 2015 13:56:27 +0200 -Subject: [PATCH] KVM: x86: map/unmap private slots in __x86_set_memory_region -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Otherwise, two copies (one of them never populated and thus bogus) -are allocated for the regular and SMM address spaces. This breaks -SMM with EPT but without unrestricted guest support, because the -SMM copy of the identity page map is all zeros. - -By moving the allocation to the caller we also remove the last -vestiges of kernel-allocated memory regions (not accessible anymore -in userspace since commit b74a07beed0e, "KVM: Remove kernel-allocated -memory regions", 2010-06-21); that is a nice bonus. - -Reported-by: Alexandre DERUMIER -Cc: stable@vger.kernel.org -Fixes: 9da0e4d5ac969909f6b435ce28ea28135a9cbd69 -Reviewed-by: Radim Krčmář -Signed-off-by: Paolo Bonzini ---- - arch/x86/kvm/x86.c | 62 ++++++++++++++++++++++++++---------------------------- - 1 file changed, 30 insertions(+), 32 deletions(-) - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 7bf8096..3ac33f8 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7477,23 +7477,53 @@ void kvm_arch_sync_events(struct kvm *kvm) - int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int i, r; -+ u64 hva; -+ struct kvm_memslots *slots = kvm_memslots(kvm); -+ struct kvm_memory_slot *slot, old; - - /* Called with kvm->slots_lock held. */ - if (WARN_ON(id >= KVM_MEM_SLOTS_NUM)) - return -EINVAL; - -+ slot = id_to_memslot(slots, id); -+ if (size) { -+ if (WARN_ON(slot->npages)) -+ return -EEXIST; -+ -+ /* -+ * MAP_SHARED to prevent internal slot pages from being moved -+ * by fork()/COW. -+ */ -+ hva = vm_mmap(NULL, 0, size, PROT_READ | PROT_WRITE, -+ MAP_SHARED | MAP_ANONYMOUS, 0); -+ if (IS_ERR((void *)hva)) -+ return PTR_ERR((void *)hva); -+ } else { -+ if (!slot->npages) -+ return 0; -+ -+ hva = 0; -+ } -+ -+ old = *slot; - for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { - struct kvm_userspace_memory_region m; - - m.slot = id | (i << 16); - m.flags = 0; - m.guest_phys_addr = gpa; -+ m.userspace_addr = hva; - m.memory_size = size; - r = __kvm_set_memory_region(kvm, &m); - if (r < 0) - return r; - } - -+ if (!size) { -+ r = vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE); -+ WARN_ON(r < 0); -+ } -+ - return 0; - } - EXPORT_SYMBOL_GPL(__x86_set_memory_region); -@@ -7623,27 +7653,6 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, - const struct kvm_userspace_memory_region *mem, - enum kvm_mr_change change) - { -- /* -- * Only private memory slots need to be mapped here since -- * KVM_SET_MEMORY_REGION ioctl is no longer supported. -- */ -- if ((memslot->id >= KVM_USER_MEM_SLOTS) && (change == KVM_MR_CREATE)) { -- unsigned long userspace_addr; -- -- /* -- * MAP_SHARED to prevent internal slot pages from being moved -- * by fork()/COW. -- */ -- userspace_addr = vm_mmap(NULL, 0, memslot->npages * PAGE_SIZE, -- PROT_READ | PROT_WRITE, -- MAP_SHARED | MAP_ANONYMOUS, 0); -- -- if (IS_ERR((void *)userspace_addr)) -- return PTR_ERR((void *)userspace_addr); -- -- memslot->userspace_addr = userspace_addr; -- } -- - return 0; - } - -@@ -7705,17 +7714,6 @@ void kvm_arch_commit_memory_region(struct kvm *kvm, - { - int nr_mmu_pages = 0; - -- if (change == KVM_MR_DELETE && old->id >= KVM_USER_MEM_SLOTS) { -- int ret; -- -- ret = vm_munmap(old->userspace_addr, -- old->npages * PAGE_SIZE); -- if (ret < 0) -- printk(KERN_WARNING -- "kvm_vm_ioctl_set_memory_region: " -- "failed to munmap memory\n"); -- } -- - if (!kvm->arch.n_requested_mmu_pages) - nr_mmu_pages = kvm_mmu_calculate_mmu_pages(kvm); - --- -2.5.0 - diff --git a/0003-KVM-x86-fix-previous-commit-for-32-bit.patch b/0003-KVM-x86-fix-previous-commit-for-32-bit.patch deleted file mode 100644 index df99e60f0..000000000 --- a/0003-KVM-x86-fix-previous-commit-for-32-bit.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 25188b9986cf6b0cadcf1bc1d1693a2e9c50ed47 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Wed, 14 Oct 2015 15:51:08 +0200 -Subject: [PATCH] KVM: x86: fix previous commit for 32-bit - -Unfortunately I only noticed this after pushing. - -Fixes: f0d648bdf0a5bbc91da6099d5282f77996558ea4 -Cc: stable@vger.kernel.org -Signed-off-by: Paolo Bonzini ---- - arch/x86/kvm/x86.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 6e03546..9a9a198 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -7482,7 +7482,7 @@ void kvm_arch_sync_events(struct kvm *kvm) - int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) - { - int i, r; -- u64 hva; -+ unsigned long hva; - struct kvm_memslots *slots = kvm_memslots(kvm); - struct kvm_memory_slot *slot, old; - --- -2.5.0 - diff --git a/ACPI-Limit-access-to-custom_method.patch b/ACPI-Limit-access-to-custom_method.patch index 88709a324..38236753e 100644 --- a/ACPI-Limit-access-to-custom_method.patch +++ b/ACPI-Limit-access-to-custom_method.patch @@ -1,6 +1,7 @@ +From 4b85149b764cd024e3dd2aff9eb22a9e1aadd1fa Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Fri, 9 Mar 2012 08:39:37 -0500 -Subject: [PATCH] ACPI: Limit access to custom_method +Subject: [PATCH 04/20] ACPI: Limit access to custom_method custom_method effectively allows arbitrary access to system memory, making it possible for an attacker to circumvent restrictions on module loading. @@ -25,3 +26,6 @@ index c68e72414a67..4277938af700 100644 if (!(*ppos)) { /* parse the table header to get the table length */ if (count <= sizeof(struct acpi_table_header)) +-- +2.4.3 + diff --git a/Add-EFI-signature-data-types.patch b/Add-EFI-signature-data-types.patch index f24473d44..57847dc56 100644 --- a/Add-EFI-signature-data-types.patch +++ b/Add-EFI-signature-data-types.patch @@ -1,6 +1,7 @@ +From 34e3e23e08fdccbf4637deab0cf03070d4f2226d Mon Sep 17 00:00:00 2001 From: Dave Howells Date: Tue, 23 Oct 2012 09:30:54 -0400 -Subject: [PATCH] Add EFI signature data types +Subject: [PATCH 15/20] Add EFI signature data types Add the data types that are used for containing hashes, keys and certificates for cryptographic verification. @@ -51,3 +52,6 @@ index de3e45088d4a..fac43c611614 100644 /* * All runtime access to EFI goes through this structure: */ +-- +2.4.3 + diff --git a/Add-an-EFI-signature-blob-parser-and-key-loader.patch b/Add-an-EFI-signature-blob-parser-and-key-loader.patch index c4feebea5..06ddd1596 100644 --- a/Add-an-EFI-signature-blob-parser-and-key-loader.patch +++ b/Add-an-EFI-signature-blob-parser-and-key-loader.patch @@ -1,6 +1,7 @@ +From c279ba86f93cf6a75d078e2d0e3f59d4ba8a2dd0 Mon Sep 17 00:00:00 2001 From: Dave Howells Date: Tue, 23 Oct 2012 09:36:28 -0400 -Subject: [PATCH] Add an EFI signature blob parser and key loader. +Subject: [PATCH 16/20] Add an EFI signature blob parser and key loader. X.509 certificates are loaded into the specified keyring as asymmetric type keys. @@ -32,7 +33,7 @@ index 4870f28403f5..4a1b50d73b80 100644 + endif # ASYMMETRIC_KEY_TYPE diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile -index e47fcd9ac5e8..6512f6596785 100644 +index cd1406f9b14a..d9db380bbe53 100644 --- a/crypto/asymmetric_keys/Makefile +++ b/crypto/asymmetric_keys/Makefile @@ -8,6 +8,7 @@ asymmetric_keys-y := asymmetric_type.o signature.o @@ -173,3 +174,6 @@ index fac43c611614..414c3c3d988d 100644 /** * efi_range_is_wc - check the WC bit on an address range * @start: starting kvirt address +-- +2.4.3 + diff --git a/Add-option-to-automatically-enforce-module-signature.patch b/Add-option-to-automatically-enforce-module-signature.patch index ff4fc0512..015371b8b 100644 --- a/Add-option-to-automatically-enforce-module-signature.patch +++ b/Add-option-to-automatically-enforce-module-signature.patch @@ -1,7 +1,8 @@ +From 37431394b3eeb1ef6d38d0e6b2693210606c2c2c Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Fri, 9 Aug 2013 18:36:30 -0400 -Subject: [PATCH] Add option to automatically enforce module signatures when in - Secure Boot mode +Subject: [PATCH 10/20] Add option to automatically enforce module signatures + when in Secure Boot mode UEFI Secure Boot provides a mechanism for ensuring that the firmware will only load signed bootloaders and kernels. Certain use cases may also @@ -20,10 +21,10 @@ Signed-off-by: Matthew Garrett 7 files changed, 69 insertions(+), 1 deletion(-) diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt -index 82fbdbc1e0b0..a811210ad486 100644 +index 95a4d34af3fd..b8527c6b7646 100644 --- a/Documentation/x86/zero-page.txt +++ b/Documentation/x86/zero-page.txt -@@ -30,6 +30,8 @@ Offset Proto Name Meaning +@@ -31,6 +31,8 @@ Offset Proto Name Meaning 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below) 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer (below) @@ -33,10 +34,10 @@ index 82fbdbc1e0b0..a811210ad486 100644 290/040 ALL edd_mbr_sig_buffer EDD MBR signatures 2D0/A00 ALL e820_map E820 memory map table diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 3dbb7e7909ca..4da6644b1fd0 100644 +index cc0d73eac047..14db458f4774 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig -@@ -1703,6 +1703,16 @@ config EFI_MIXED +@@ -1734,6 +1734,16 @@ config EFI_MIXED If unsure, say N. @@ -54,7 +55,7 @@ index 3dbb7e7909ca..4da6644b1fd0 100644 def_bool y prompt "Enable seccomp to safely compute untrusted bytecode" diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c -index 2c82bd150d43..1ef8ea7f8ed9 100644 +index ee1b6d346b98..b4de3faa3f29 100644 --- a/arch/x86/boot/compressed/eboot.c +++ b/arch/x86/boot/compressed/eboot.c @@ -12,6 +12,7 @@ @@ -115,7 +116,7 @@ index 2c82bd150d43..1ef8ea7f8ed9 100644 setup_efi_pci(boot_params); diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h -index ab456dc233b5..74ba4083e7ce 100644 +index 329254373479..b61f8533c0fd 100644 --- a/arch/x86/include/uapi/asm/bootparam.h +++ b/arch/x86/include/uapi/asm/bootparam.h @@ -134,7 +134,8 @@ struct boot_params { @@ -129,10 +130,10 @@ index ab456dc233b5..74ba4083e7ce 100644 * The sentinel is set to a nonzero value (0xff) in header.S. * diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 80f874bf999e..c2e4f52cad30 100644 +index baadbf90a7c5..1ac118146e90 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1160,6 +1160,12 @@ void __init setup_arch(char **cmdline_p) +@@ -1135,6 +1135,12 @@ void __init setup_arch(char **cmdline_p) io_delay_init(); @@ -146,10 +147,10 @@ index 80f874bf999e..c2e4f52cad30 100644 * Parse the ACPI tables for possible boot-time SMP configuration. */ diff --git a/include/linux/module.h b/include/linux/module.h -index 57474384b66b..b69d657c3700 100644 +index db386349cd01..4b8df91f03cd 100644 --- a/include/linux/module.h +++ b/include/linux/module.h -@@ -189,6 +189,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add); +@@ -273,6 +273,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add); struct notifier_block; @@ -163,10 +164,10 @@ index 57474384b66b..b69d657c3700 100644 extern int modules_disabled; /* for sysctl */ diff --git a/kernel/module.c b/kernel/module.c -index e9869c497175..87fa14fedc88 100644 +index 7f045246e123..2b403ab0ef29 100644 --- a/kernel/module.c +++ b/kernel/module.c -@@ -4084,6 +4084,13 @@ void module_layout(struct module *mod, +@@ -4088,6 +4088,13 @@ void module_layout(struct module *mod, EXPORT_SYMBOL(module_layout); #endif @@ -180,3 +181,6 @@ index e9869c497175..87fa14fedc88 100644 bool secure_modules(void) { #ifdef CONFIG_MODULE_SIG +-- +2.4.3 + diff --git a/Add-secure_modules-call.patch b/Add-secure_modules-call.patch index 158e7f1d2..b6e039ff0 100644 --- a/Add-secure_modules-call.patch +++ b/Add-secure_modules-call.patch @@ -1,6 +1,7 @@ +From a1aaf20cffb1a949c5d6b1198690c7c30cfda4d5 Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Fri, 9 Aug 2013 17:58:15 -0400 -Subject: [PATCH] Add secure_modules() call +Subject: [PATCH 01/20] Add secure_modules() call Provide a single call to allow kernel code to determine whether the system has been configured to either disable module loading entirely or to load @@ -16,10 +17,10 @@ Signed-off-by: Matthew Garrett 2 files changed, 16 insertions(+) diff --git a/include/linux/module.h b/include/linux/module.h -index d67b1932cc59..57474384b66b 100644 +index 3a19c79918e0..db386349cd01 100644 --- a/include/linux/module.h +++ b/include/linux/module.h -@@ -551,6 +551,8 @@ static inline bool module_requested_async_probing(struct module *module) +@@ -635,6 +635,8 @@ static inline bool module_requested_async_probing(struct module *module) return module && module->async_probe_requested; } @@ -28,7 +29,7 @@ index d67b1932cc59..57474384b66b 100644 #else /* !CONFIG_MODULES... */ /* Given an address, look for it in the exception tables. */ -@@ -667,6 +669,10 @@ static inline bool module_requested_async_probing(struct module *module) +@@ -751,6 +753,10 @@ static inline bool module_requested_async_probing(struct module *module) return false; } @@ -40,10 +41,10 @@ index d67b1932cc59..57474384b66b 100644 #ifdef CONFIG_SYSFS diff --git a/kernel/module.c b/kernel/module.c -index 4d2b82e610e2..e9869c497175 100644 +index b86b7bf1be38..7f045246e123 100644 --- a/kernel/module.c +++ b/kernel/module.c -@@ -4083,3 +4083,13 @@ void module_layout(struct module *mod, +@@ -4087,3 +4087,13 @@ void module_layout(struct module *mod, } EXPORT_SYMBOL(module_layout); #endif @@ -57,3 +58,6 @@ index 4d2b82e610e2..e9869c497175 100644 +#endif +} +EXPORT_SYMBOL(secure_modules); +-- +2.4.3 + diff --git a/Add-sysrq-option-to-disable-secure-boot-mode.patch b/Add-sysrq-option-to-disable-secure-boot-mode.patch index ffc460849..4600848cf 100644 --- a/Add-sysrq-option-to-disable-secure-boot-mode.patch +++ b/Add-sysrq-option-to-disable-secure-boot-mode.patch @@ -1,6 +1,7 @@ +From 16d2ba5d5bc46e67e6aa7a3d113fbcc18c217388 Mon Sep 17 00:00:00 2001 From: Kyle McMartin Date: Fri, 30 Aug 2013 09:28:51 -0400 -Subject: [PATCH] Add sysrq option to disable secure boot mode +Subject: [PATCH 20/20] Add sysrq option to disable secure boot mode Bugzilla: N/A Upstream-status: Fedora mustard @@ -15,7 +16,7 @@ Upstream-status: Fedora mustard 7 files changed, 64 insertions(+), 9 deletions(-) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 5def6b4143fa..1eac9d22cb0b 100644 +index f93826b8522c..41679b1aca83 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -70,6 +70,11 @@ @@ -30,7 +31,7 @@ index 5def6b4143fa..1eac9d22cb0b 100644 #include