From 947b4cbb27614f8a062146ccc6e50ced85a45dba Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Wed, 15 Jan 2014 18:52:22 -0600 Subject: [PATCH] Linux v3.12.8 --- ..._handler_data-in-code-executed-on-no.patch | 83 ------------------- hamradio-yam-fix-info-leak-in-ioctl.patch | 36 -------- ipv6-route-cache-expiration.patch | 35 -------- kernel.spec | 31 ++----- sources | 2 +- ...-exceptions-in-amd-fxsave-workaround.patch | 48 ----------- 6 files changed, 6 insertions(+), 229 deletions(-) delete mode 100644 br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch delete mode 100644 hamradio-yam-fix-info-leak-in-ioctl.patch delete mode 100644 ipv6-route-cache-expiration.patch delete mode 100644 x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch diff --git a/br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch b/br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch deleted file mode 100644 index 21e749291..000000000 --- a/br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch +++ /dev/null @@ -1,83 +0,0 @@ -Bugzilla: 1025770 -Upstream-status: 3.13 (commit 859828c0ea476b42f3a) - -From 1a62121ead27a218d4b02b7130a6f5f6ca9c247e Mon Sep 17 00:00:00 2001 -From: Jiri Pirko -Date: Thu, 5 Dec 2013 16:27:37 +0100 -Subject: [PATCH] br: fix use of ->rx_handler_data in code executed on - non-rx_handler path - -br_stp_rcv() is reached by non-rx_handler path. That means there is no -guarantee that dev is bridge port and therefore simple NULL check of -->rx_handler_data is not enough. There is need to check if dev is really -bridge port and since only rcu read lock is held here, do it by checking -->rx_handler pointer. - -Note that synchronize_net() in netdev_rx_handler_unregister() ensures -this approach as valid. - -Introduced originally by: -commit f350a0a87374418635689471606454abc7beaa3a - "bridge: use rx_handler_data pointer to store net_bridge_port pointer" - -Fixed but not in the best way by: -commit b5ed54e94d324f17c97852296d61a143f01b227a - "bridge: fix RCU races with bridge port" - -Reintroduced by: -commit 716ec052d2280d511e10e90ad54a86f5b5d4dcc2 - "bridge: fix NULL pointer deref of br_port_get_rcu" - -Please apply to stable trees as well. Thanks. - -RH bugzilla reference: https://bugzilla.redhat.com/show_bug.cgi?id=1025770 - -Reported-by: Laine Stump -Debugged-by: Michael S. Tsirkin -Signed-off-by: Michael S. Tsirkin -Signed-off-by: Jiri Pirko -Acked-by: Michael S. Tsirkin -Acked-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/bridge/br_private.h | 10 ++++++++++ - net/bridge/br_stp_bpdu.c | 2 +- - 2 files changed, 11 insertions(+), 1 deletion(-) - -diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h -index e14c33b..9a63c42 100644 ---- a/net/bridge/br_private.h -+++ b/net/bridge/br_private.h -@@ -442,6 +442,16 @@ extern netdev_features_t br_features_recompute(struct net_bridge *br, - extern int br_handle_frame_finish(struct sk_buff *skb); - extern rx_handler_result_t br_handle_frame(struct sk_buff **pskb); - -+static inline bool br_rx_handler_check_rcu(const struct net_device *dev) -+{ -+ return rcu_dereference(dev->rx_handler) == br_handle_frame; -+} -+ -+static inline struct net_bridge_port *br_port_get_check_rcu(const struct net_device *dev) -+{ -+ return br_rx_handler_check_rcu(dev) ? br_port_get_rcu(dev) : NULL; -+} -+ - /* br_ioctl.c */ - extern int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd); - extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *arg); -diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c -index 8660ea3..bdb459d 100644 ---- a/net/bridge/br_stp_bpdu.c -+++ b/net/bridge/br_stp_bpdu.c -@@ -153,7 +153,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, - if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0) - goto err; - -- p = br_port_get_rcu(dev); -+ p = br_port_get_check_rcu(dev); - if (!p) - goto err; - --- -1.8.3.1 - diff --git a/hamradio-yam-fix-info-leak-in-ioctl.patch b/hamradio-yam-fix-info-leak-in-ioctl.patch deleted file mode 100644 index 057acc5e9..000000000 --- a/hamradio-yam-fix-info-leak-in-ioctl.patch +++ /dev/null @@ -1,36 +0,0 @@ -Bugzilla: 1053647 -Upstream-status: 3.13 and 3.12.8 - -From foo@baz Mon Jan 13 09:44:41 PST 2014 -From: =?UTF-8?q?Salva=20Peir=C3=B3?= -Date: Tue, 17 Dec 2013 10:06:30 +0100 -Subject: hamradio/yam: fix info leak in ioctl -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Salva Peiró - -[ Upstream commit 8e3fbf870481eb53b2d3a322d1fc395ad8b367ed ] - -The yam_ioctl() code fails to initialise the cmd field -of the struct yamdrv_ioctl_cfg. Add an explicit memset(0) -before filling the structure to avoid the 4-byte info leak. - -Signed-off-by: Salva Peiró -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/hamradio/yam.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/hamradio/yam.c -+++ b/drivers/net/hamradio/yam.c -@@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device * - break; - - case SIOCYAMGCFG: -+ memset(&yi, 0, sizeof(yi)); - yi.cfg.mask = 0xffffffff; - yi.cfg.iobase = yp->iobase; - yi.cfg.irq = yp->irq; diff --git a/ipv6-route-cache-expiration.patch b/ipv6-route-cache-expiration.patch deleted file mode 100644 index edae92821..000000000 --- a/ipv6-route-cache-expiration.patch +++ /dev/null @@ -1,35 +0,0 @@ -commit 24f5b855e17df7e355eacd6c4a12cc4d6a6c9ff0 -Author: Li RongQing -Date: Thu Dec 19 12:40:26 2013 +0800 - - ipv6: always set the new created dst's from in ip6_rt_copy - - ip6_rt_copy only sets dst.from if ort has flag RTF_ADDRCONF and RTF_DEFAULT. - but the prefix routes which did get installed by hand locally can have an - expiration, and no any flag combination which can ensure a potential from - does never expire, so we should always set the new created dst's from. - - This also fixes the new created dst is always expired since the ort, which - is created by RA, maybe has RTF_EXPIRES and RTF_ADDRCONF, but no RTF_DEFAULT. - - Suggested-by: Hannes Frederic Sowa - CC: Gao feng - Signed-off-by: Li RongQing - Acked-by: Hannes Frederic Sowa - Signed-off-by: David S. Miller - -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index a0a48ac..4b4944c 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -1905,9 +1905,7 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort, - else - rt->rt6i_gateway = *dest; - rt->rt6i_flags = ort->rt6i_flags; -- if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) == -- (RTF_DEFAULT | RTF_ADDRCONF)) -- rt6_set_from(rt, ort); -+ rt6_set_from(rt, ort); - rt->rt6i_metric = 0; - - #ifdef CONFIG_IPV6_SUBTREES diff --git a/kernel.spec b/kernel.spec index c03107acb..1294874b1 100644 --- a/kernel.spec +++ b/kernel.spec @@ -74,7 +74,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 7 +%define stable_update 8 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -742,9 +742,6 @@ Patch25164: dell-laptop.patch #rhbz 1030802 Patch25171: elantech-Properly-differentiate-between-clickpads-an.patch -#rhbz 1025770 -Patch25176: br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch - #rhbz 924916 Patch25179: KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch @@ -757,15 +754,6 @@ Patch25181: tg3-Add-support-for-new-577xx-device-ids.patch #rhbz 953211 Patch25182: Input-ALPS-add-support-for-Dolphin-devices.patch -#rhbz 1040128 -Patch25183: ipv6-route-cache-expiration.patch - -#CVE-2014-1438 rhbz 1053599 1052914 -Patch25184: x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch - -#CVE-2014-1446 rhbz 1053620 1053647 -Patch25185: hamradio-yam-fix-info-leak-in-ioctl.patch - # END OF PATCH DEFINITIONS %endif @@ -1463,9 +1451,6 @@ ApplyPatch dell-laptop.patch #rhbz 1030802 ApplyPatch elantech-Properly-differentiate-between-clickpads-an.patch -#rhbz 1025770 -ApplyPatch br-fix-use-of-rx_handler_data-in-code-executed-on-no.patch - #rhbz 924916 ApplyPatch KVM-MMU-handle-invalid-root_hpa-at-__direct_map.patch @@ -1478,16 +1463,6 @@ ApplyPatch tg3-Add-support-for-new-577xx-device-ids.patch #rhbz 953211 ApplyPatch Input-ALPS-add-support-for-Dolphin-devices.patch -#rhbz 1040128 -ApplyPatch ipv6-route-cache-expiration.patch - -#CVE-2014-1438 rhbz 1053599 1052914 -ApplyPatch x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch - -#CVE-2014-1446 rhbz 1053620 1053647 -ApplyPatch hamradio-yam-fix-info-leak-in-ioctl.patch - -# END OF PATCH APPLICATIONS %endif @@ -2289,6 +2264,10 @@ fi # ||----w | # || || %changelog + +* Wed Jan 15 2014 Justin M. Forbes - CVE-2014-1446 hamradio/yam: information leak in ioctl (rhbz 1053620 1053647) - CVE-2014-1438 x86: exceptions are not cleared in AMD FXSAVE workaround (rhbz 1053599 1052914) diff --git a/sources b/sources index dd1c2fbda..c6dc43df7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ cc6ee608854e0da4b64f6c1ff8b6398c linux-3.12.tar.xz -a158a29ecf49e768ebd2f34967991606 patch-3.12.7.xz +03d34842e3a1197d17055610f62627b8 patch-3.12.8.xz diff --git a/x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch b/x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch deleted file mode 100644 index 2b6ae4983..000000000 --- a/x86-fpu-amd-clear-exceptions-in-amd-fxsave-workaround.patch +++ /dev/null @@ -1,48 +0,0 @@ -Bugzilla: 1053599 -Upstream-status: 3.13 and 3.12.8 - -From 26bef1318adc1b3a530ecc807ef99346db2aa8b0 Mon Sep 17 00:00:00 2001 -From: Linus Torvalds -Date: Sat, 11 Jan 2014 19:15:52 -0800 -Subject: x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround - -From: Linus Torvalds - -commit 26bef1318adc1b3a530ecc807ef99346db2aa8b0 upstream. - -Before we do an EMMS in the AMD FXSAVE information leak workaround we -need to clear any pending exceptions, otherwise we trap with a -floating-point exception inside this code. - -Reported-by: halfdog -Tested-by: Borislav Petkov -Link: http://lkml.kernel.org/r/CA%2B55aFxQnY_PCG_n4=0w-VG=YLXL-yr7oMxyy0WU2gCBAf3ydg@mail.gmail.com -Signed-off-by: H. Peter Anvin -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/include/asm/fpu-internal.h | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - ---- a/arch/x86/include/asm/fpu-internal.h -+++ b/arch/x86/include/asm/fpu-internal.h -@@ -293,12 +293,13 @@ static inline int restore_fpu_checking(s - /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception - is pending. Clear the x87 state here by setting it to fixed - values. "m" is a random variable that should be in L1 */ -- alternative_input( -- ASM_NOP8 ASM_NOP2, -- "emms\n\t" /* clear stack tags */ -- "fildl %P[addr]", /* set F?P to defined value */ -- X86_FEATURE_FXSAVE_LEAK, -- [addr] "m" (tsk->thread.fpu.has_fpu)); -+ if (unlikely(static_cpu_has(X86_FEATURE_FXSAVE_LEAK))) { -+ asm volatile( -+ "fnclex\n\t" -+ "emms\n\t" -+ "fildl %P[addr]" /* set F?P to defined value */ -+ : : [addr] "m" (tsk->thread.fpu.has_fpu)); -+ } - - return fpu_restore_checking(&tsk->thread.fpu); - }