rpms/kernel
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Linux v3.12.8

Browse source
This commit is contained in:
Justin M. Forbes 2014-01-15 18:52:22 -06:00
commit 947b4cbb27
6 changed files with 6 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

83
br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch
View file

@ -1,83 +0,0 @@
Bugzilla: 1025770
Upstream-status: 3.13 (commit 859828c0ea476b42f3a)
From 1a62121ead27a218d4b02b7130a6f5f6ca9c247e Mon Sep 17 00:00:00 2001
From: Jiri Pirko <jiri@resnulli.us>
Date: Thu, 5 Dec 2013 16:27:37 +0100
Subject: [PATCH] br: fix use of ->rx_handler_data in code executed on
non-rx_handler path
br_stp_rcv() is reached by non-rx_handler path. That means there is no
guarantee that dev is bridge port and therefore simple NULL check of
->rx_handler_data is not enough. There is need to check if dev is really
bridge port and since only rcu read lock is held here, do it by checking
->rx_handler pointer.
Note that synchronize_net() in netdev_rx_handler_unregister() ensures
this approach as valid.
Introduced originally by:
commit f350a0a87374418635689471606454abc7beaa3a
"bridge: use rx_handler_data pointer to store net_bridge_port pointer"
Fixed but not in the best way by:
commit b5ed54e94d324f17c97852296d61a143f01b227a
"bridge: fix RCU races with bridge port"
Reintroduced by:
commit 716ec052d2280d511e10e90ad54a86f5b5d4dcc2
"bridge: fix NULL pointer deref of br_port_get_rcu"
Please apply to stable trees as well. Thanks.
RH bugzilla reference: https://bugzilla.redhat.com/show_bug.cgi?id=1025770
Reported-by: Laine Stump <laine@redhat.com>
Debugged-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/bridge/br_private.h | 10 ++++++++++
net/bridge/br_stp_bpdu.c | 2 +-
2 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index e14c33b..9a63c42 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -442,6 +442,16 @@ extern netdev_features_t br_features_recompute(struct net_bridge *br,
extern int br_handle_frame_finish(struct sk_buff *skb);
extern rx_handler_result_t br_handle_frame(struct sk_buff **pskb);
+static inline bool br_rx_handler_check_rcu(const struct net_device *dev)
+{
+ return rcu_dereference(dev->rx_handler) == br_handle_frame;
+}
+
+static inline struct net_bridge_port *br_port_get_check_rcu(const struct net_device *dev)
+{
+ return br_rx_handler_check_rcu(dev) ? br_port_get_rcu(dev) : NULL;
+}
+
/* br_ioctl.c */
extern int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *arg);
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 8660ea3..bdb459d 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -153,7 +153,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0)
goto err;
- p = br_port_get_rcu(dev);
+ p = br_port_get_check_rcu(dev);
if (!p)
goto err;
--
1.8.3.1

36
hamradio-yam-fix-info-leak-in-ioctl.patch
View file

@ -1,36 +0,0 @@
Bugzilla: 1053647
Upstream-status: 3.13 and 3.12.8
From foo@baz Mon Jan 13 09:44:41 PST 2014
From: =?UTF-8?q?Salva=20Peir=C3=B3?= <speiro@ai2.upv.es>
Date: Tue, 17 Dec 2013 10:06:30 +0100
Subject: hamradio/yam: fix info leak in ioctl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Salva Peiró <speiro@ai2.upv.es>
[ Upstream commit 8e3fbf870481eb53b2d3a322d1fc395ad8b367ed ]
The yam_ioctl() code fails to initialise the cmd field
of the struct yamdrv_ioctl_cfg. Add an explicit memset(0)
before filling the structure to avoid the 4-byte info leak.
Signed-off-by: Salva Peiró <speiro@ai2.upv.es>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/hamradio/yam.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *
break;
case SIOCYAMGCFG:
+ memset(&yi, 0, sizeof(yi));
yi.cfg.mask = 0xffffffff;
yi.cfg.iobase = yp->iobase;
yi.cfg.irq = yp->irq;

35
ipv6-route-cache-expiration.patch
View file

@ -1,35 +0,0 @@
commit 24f5b855e17df7e355eacd6c4a12cc4d6a6c9ff0
Author: Li RongQing <roy.qing.li@gmail.com>
Date: Thu Dec 19 12:40:26 2013 +0800
ipv6: always set the new created dst's from in ip6_rt_copy
ip6_rt_copy only sets dst.from if ort has flag RTF_ADDRCONF and RTF_DEFAULT.
but the prefix routes which did get installed by hand locally can have an
expiration, and no any flag combination which can ensure a potential from
does never expire, so we should always set the new created dst's from.
This also fixes the new created dst is always expired since the ort, which
is created by RA, maybe has RTF_EXPIRES and RTF_ADDRCONF, but no RTF_DEFAULT.
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
CC: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a0a48ac..4b4944c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1905,9 +1905,7 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
else
rt->rt6i_gateway = *dest;
rt->rt6i_flags = ort->rt6i_flags;
- if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
- (RTF_DEFAULT | RTF_ADDRCONF))
- rt6_set_from(rt, ort);
+ rt6_set_from(rt, ort);
rt->rt6i_metric = 0;
#ifdef CONFIG_IPV6_SUBTREES

31
kernel.spec
View file

@ -74,7 +74,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 7
%define stable_update 8
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@ -742,9 +742,6 @@ Patch25164: dell-laptop.patch
#rhbz 1030802
Patch25171: elantech-Properly-differentiate-between-clickpads-an.patch
#rhbz 1025770
Patch25176: br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch
#rhbz 924916
Patch25179: KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch
@ -757,15 +754,6 @@ Patch25181: tg3-Add-support-for-new-577xx-device-ids.patch
#rhbz 953211
Patch25182: Input-ALPS-add-support-for-Dolphin-devices.patch
#rhbz 1040128
Patch25183: ipv6-route-cache-expiration.patch
#CVE-2014-1438 rhbz 1053599 1052914
Patch25184: x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch
#CVE-2014-1446 rhbz 1053620 1053647
Patch25185: hamradio-yam-fix-info-leak-in-ioctl.patch
# END OF PATCH DEFINITIONS
%endif
@ -1463,9 +1451,6 @@ ApplyPatch dell-laptop.patch
#rhbz 1030802
ApplyPatch elantech-Properly-differentiate-between-clickpads-an.patch
#rhbz 1025770
ApplyPatch br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch
#rhbz 924916
ApplyPatch KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch
@ -1478,16 +1463,6 @@ ApplyPatch tg3-Add-support-for-new-577xx-device-ids.patch
#rhbz 953211
ApplyPatch Input-ALPS-add-support-for-Dolphin-devices.patch
#rhbz 1040128
ApplyPatch ipv6-route-cache-expiration.patch
#CVE-2014-1438 rhbz 1053599 1052914
ApplyPatch x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch
#CVE-2014-1446 rhbz 1053620 1053647
ApplyPatch hamradio-yam-fix-info-leak-in-ioctl.patch
# END OF PATCH APPLICATIONS
%endif
@ -2289,6 +2264,10 @@ fi
# ||----w |
# || ||
%changelog
* Wed Jan 15 2014 Justin M. Forbes <jforbes@fedoraproject.org - 3.12.8-300
- Linux v3.12.8
* Wed Jan 15 2014 Josh Boyer <jwboyer@fedoraproject.org>
- CVE-2014-1446 hamradio/yam: information leak in ioctl (rhbz 1053620 1053647)
- CVE-2014-1438 x86: exceptions are not cleared in AMD FXSAVE workaround (rhbz 1053599 1052914)

2
sources
View file

@ -1,2 +1,2 @@
cc6ee608854e0da4b64f6c1ff8b6398c linux-3.12.tar.xz
a158a29ecf49e768ebd2f34967991606 patch-3.12.7.xz
03d34842e3a1197d17055610f62627b8 patch-3.12.8.xz

48
x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch
View file

@ -1,48 +0,0 @@
Bugzilla: 1053599
Upstream-status: 3.13 and 3.12.8
From 26bef1318adc1b3a530ecc807ef99346db2aa8b0 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 11 Jan 2014 19:15:52 -0800
Subject: x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 26bef1318adc1b3a530ecc807ef99346db2aa8b0 upstream.
Before we do an EMMS in the AMD FXSAVE information leak workaround we
need to clear any pending exceptions, otherwise we trap with a
floating-point exception inside this code.
Reported-by: halfdog <me@halfdog.net>
Tested-by: Borislav Petkov <bp@suse.de>
Link: http://lkml.kernel.org/r/CA%2B55aFxQnY_PCG_n4=0w-VG=YLXL-yr7oMxyy0WU2gCBAf3ydg@mail.gmail.com
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/fpu-internal.h | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/arch/x86/include/asm/fpu-internal.h
+++ b/arch/x86/include/asm/fpu-internal.h
@@ -293,12 +293,13 @@ static inline int restore_fpu_checking(s
/* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
is pending. Clear the x87 state here by setting it to fixed
values. "m" is a random variable that should be in L1 */
- alternative_input(
- ASM_NOP8 ASM_NOP2,
- "emms\n\t" /* clear stack tags */
- "fildl %P[addr]", /* set F?P to defined value */
- X86_FEATURE_FXSAVE_LEAK,
- [addr] "m" (tsk->thread.fpu.has_fpu));
+ if (unlikely(static_cpu_has(X86_FEATURE_FXSAVE_LEAK))) {
+ asm volatile(
+ "fnclex\n\t"
+ "emms\n\t"
+ "fildl %P[addr]" /* set F?P to defined value */
+ : : [addr] "m" (tsk->thread.fpu.has_fpu));
+ }
return fpu_restore_checking(&tsk->thread.fpu);
}