diff --git a/.gitignore b/.gitignore index 6652babd2..03eb9bf77 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ clog kernel-2.6.*/ kernel-3.*/ /patch-3.0.2-rc1.gz +/patch-3.0.3-rc1.gz diff --git a/CVE-2011-2905.patch b/CVE-2011-2905.patch deleted file mode 100644 index 0c7c28892..000000000 --- a/CVE-2011-2905.patch +++ /dev/null @@ -1,116 +0,0 @@ -commit aba8d056078e47350d85b06a9cabd5afcc4b72ea -Author: Jonathan Nieder -Date: Fri Aug 5 18:58:38 2011 +0200 - - perf tools: do not look at ./config for configuration - - In addition to /etc/perfconfig and $HOME/.perfconfig, perf looks for - configuration in the file ./config, imitating git which looks at - $GIT_DIR/config. If ./config is not a perf configuration file, it - fails, or worse, treats it as a configuration file and changes behavior - in some unexpected way. - - "config" is not an unusual name for a file to be lying around and perf - does not have a private directory dedicated for its own use, so let's - just stop looking for configuration in the cwd. Callers needing - context-sensitive configuration can use the PERF_CONFIG environment - variable. - - Requested-by: Christian Ohm - Cc: 632923@bugs.debian.org - Cc: Ben Hutchings - Cc: Christian Ohm - Cc: Ingo Molnar - Cc: Paul Mackerras - Cc: Peter Zijlstra - Link: http://lkml.kernel.org/r/20110805165838.GA7237@elie.gateway.2wire.net - Signed-off-by: Jonathan Nieder - Signed-off-by: Arnaldo Carvalho de Melo - -diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c -index e02d78c..6c86eca 100644 ---- a/tools/perf/util/config.c -+++ b/tools/perf/util/config.c -@@ -399,7 +399,6 @@ static int perf_config_global(void) - int perf_config(config_fn_t fn, void *data) - { - int ret = 0, found = 0; -- char *repo_config = NULL; - const char *home = NULL; - - /* Setting $PERF_CONFIG makes perf read _only_ the given config file. */ -@@ -421,12 +420,6 @@ int perf_config(config_fn_t fn, void *data) - free(user_config); - } - -- repo_config = perf_pathdup("config"); -- if (!access(repo_config, R_OK)) { -- ret += perf_config_from_file(fn, repo_config, data); -- found += 1; -- } -- free(repo_config); - if (found == 0) - return -1; - return ret; -commit 069e3725dd9be3b759a98e8c80ac5fc38b392b23 -Author: Arnaldo Carvalho de Melo -Date: Tue Aug 9 12:42:13 2011 -0300 - - perf tools: Check $HOME/.perfconfig ownership - - Just like we do already for perf.data files. - - Requested-by: Ingo Molnar - Cc: Ben Hutchings - Cc: Christian Ohm - Cc: David Ahern - Cc: Frederic Weisbecker - Cc: Jonathan Nieder - Cc: Mike Galbraith - Cc: Paul Mackerras - Cc: Peter Zijlstra - Cc: Stephane Eranian - Link: http://lkml.kernel.org/n/tip-qgokmxsmvppwpc5404qhyk7e@git.kernel.org - Signed-off-by: Arnaldo Carvalho de Melo - -diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c -index 6c86eca..fe02903 100644 ---- a/tools/perf/util/config.c -+++ b/tools/perf/util/config.c -@@ -413,13 +413,32 @@ int perf_config(config_fn_t fn, void *data) - home = getenv("HOME"); - if (perf_config_global() && home) { - char *user_config = strdup(mkpath("%s/.perfconfig", home)); -- if (!access(user_config, R_OK)) { -- ret += perf_config_from_file(fn, user_config, data); -- found += 1; -+ struct stat st; -+ -+ if (user_config == NULL) { -+ warning("Not enough memory to process %s/.perfconfig, " -+ "ignoring it.", home); -+ goto out; -+ } -+ -+ if (stat(user_config, &st) < 0) -+ goto out_free; -+ -+ if (st.st_uid && (st.st_uid != geteuid())) { -+ warning("File %s not owned by current user or root, " -+ "ignoring it.", user_config); -+ goto out_free; - } -+ -+ if (!st.st_size) -+ goto out_free; -+ -+ ret += perf_config_from_file(fn, user_config, data); -+ found += 1; -+out_free: - free(user_config); - } -- -+out: - if (found == 0) - return -1; - return ret; diff --git a/kernel.spec b/kernel.spec index 78e624d54..859eeb971 100644 --- a/kernel.spec +++ b/kernel.spec @@ -51,7 +51,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be prepended with "0.", so # for example a 3 here will become 0.3 # -%global baserelease 1 +%global baserelease 0 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -64,7 +64,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 2 +%define stable_update 3 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -582,6 +582,7 @@ Source1000: config-local Patch00: patch-3.0.bz2 Patch01: patch-3.0.2.bz2 +Patch02: patch-3.0.3-rc1.gz # we also need compile fixes for -vanilla Patch04: linux-2.6-compile-fixes.patch @@ -594,10 +595,10 @@ Patch05: linux-2.6-makefile-after_link.patch # revert upstream patches we get via other methods Patch09: linux-2.6-upstream-reverts.patch -Patch10: CVE-2011-2905.patch - # Standalone patches +Patch100: perf-check-ownership.patch + Patch150: linux-2.6.29-sparc-IOC_TYPECHECK.patch Patch160: linux-2.6-32bit-mmap-exec-randomization.patch @@ -1099,6 +1100,7 @@ done # Update vanilla to the latest upstream. (2.6.39 -> 3.0) ApplyPatch patch-3.0.bz2 ApplyPatch patch-3.0.2.bz2 +ApplyPatch patch-3.0.3-rc1.gz ApplyPatch linux-2.6-makefile-after_link.patch @@ -1112,20 +1114,8 @@ ApplyOptionalPatch linux-2.6-compile-fixes.patch # revert patches from upstream that conflict or that we get via other means ApplyOptionalPatch linux-2.6-upstream-reverts.patch -R -# CVE fixes -ApplyPatch CVE-2011-2905.patch - -# Architecture patches -# x86(-64) - -# -# Intel IOMMU -# - -# -# PowerPC -# +ApplyPatch perf-check-ownership.patch # # SPARC64 @@ -1892,8 +1882,11 @@ fi # and build. %changelog -* Mon Aug 15 2011 Dave Jones 2.6.40.2-1 -- 3.0.2 +* Mon Aug 15 2011 Dave Jones 2.6.40.3-0 +- Apply patches from 3.0.3-rc1 + +* Mon Aug 15 2011 Dave Jones +- Apply patches from 3.0.2 * Mon Aug 15 2011 Dave Jones - CVE-2011-2905 perf tools may parse user-controlled config file. (rhbz 729809) diff --git a/perf-check-ownership.patch b/perf-check-ownership.patch new file mode 100644 index 000000000..93ed66085 --- /dev/null +++ b/perf-check-ownership.patch @@ -0,0 +1,62 @@ +commit 069e3725dd9be3b759a98e8c80ac5fc38b392b23 +Author: Arnaldo Carvalho de Melo +Date: Tue Aug 9 12:42:13 2011 -0300 + + perf tools: Check $HOME/.perfconfig ownership + + Just like we do already for perf.data files. + + Requested-by: Ingo Molnar + Cc: Ben Hutchings + Cc: Christian Ohm + Cc: David Ahern + Cc: Frederic Weisbecker + Cc: Jonathan Nieder + Cc: Mike Galbraith + Cc: Paul Mackerras + Cc: Peter Zijlstra + Cc: Stephane Eranian + Link: http://lkml.kernel.org/n/tip-qgokmxsmvppwpc5404qhyk7e@git.kernel.org + Signed-off-by: Arnaldo Carvalho de Melo + +diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c +index 6c86eca..fe02903 100644 +--- a/tools/perf/util/config.c ++++ b/tools/perf/util/config.c +@@ -413,13 +413,32 @@ int perf_config(config_fn_t fn, void *data) + home = getenv("HOME"); + if (perf_config_global() && home) { + char *user_config = strdup(mkpath("%s/.perfconfig", home)); +- if (!access(user_config, R_OK)) { +- ret += perf_config_from_file(fn, user_config, data); +- found += 1; ++ struct stat st; ++ ++ if (user_config == NULL) { ++ warning("Not enough memory to process %s/.perfconfig, " ++ "ignoring it.", home); ++ goto out; ++ } ++ ++ if (stat(user_config, &st) < 0) ++ goto out_free; ++ ++ if (st.st_uid && (st.st_uid != geteuid())) { ++ warning("File %s not owned by current user or root, " ++ "ignoring it.", user_config); ++ goto out_free; + } ++ ++ if (!st.st_size) ++ goto out_free; ++ ++ ret += perf_config_from_file(fn, user_config, data); ++ found += 1; ++out_free: + free(user_config); + } +- ++out: + if (found == 0) + return -1; + return ret; diff --git a/sources b/sources index 95e1e2493..4ed2072c0 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ 1aab7a741abe08d42e8eccf20de61e05 linux-2.6.39.tar.bz2 df5790b51f218fc5e5463162b26afbfc patch-3.0.bz2 f5743283e6075282cebfbde62e65240b patch-3.0.2.bz2 +23b4aad2d34ea209f62b199e67a88240 patch-3.0.3-rc1.gz