Linux v4.2-rc4-53-g956325bd55bb

KEYS-ensure-we-free-the-assoc-array-edit-if-edit-is-.patch

@@ -1,45 +0,0 @@
-From 3881b164810a564714dfdc16520b0fe538ae4bf7 Mon Sep 17 00:00:00 2001
-From: David Howells <dhowells@redhat.com>
-Date: Mon, 27 Jul 2015 15:23:43 +0100
-Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid
-
-__key_link_end is not freeing the associated array edit structure
-and this leads to a 512 byte memory leak each time an identical
-existing key is added with add_key().
-
-The reason the add_key() system call returns okay is that
-key_create_or_update() calls __key_link_begin() before checking to see
-whether it can update a key directly rather than adding/replacing - which
-it turns out it can.  Thus __key_link() is not called through
-__key_instantiate_and_link() and __key_link_end() must cancel the edit.
-
-CVE-2015-1333
-
-Signed-off-by: Colin Ian King <colin.king@canonical.com>
-Signed-off-by: David Howells <dhowells@redhat.com>
----
- security/keys/keyring.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index e72548b5897e..d33437007ad2 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
- 	if (index_key->type == &key_type_keyring)
- 		up_write(&keyring_serialise_link_sem);
- 
--	if (edit && !edit->dead_leaf) {
--		key_payload_reserve(keyring,
--				    keyring->datalen - KEYQUOTA_LINK_BYTES);
-+	if (edit) {
-+		if (!edit->dead_leaf) {
-+			key_payload_reserve(keyring,
-+				keyring->datalen - KEYQUOTA_LINK_BYTES);
-+		}
- 		assoc_array_cancel_edit(edit);
- 	}
- 	up_write(&keyring->sem);
--- 
-2.4.3
-

kernel.spec

@@ -67,7 +67,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %define rcrev 4
 # The git snapshot level
-%define gitrev 1
+%define gitrev 2
 # Set rpm version accordingly
 %define rpmversion 4.%{upstream_sublevel}.0
 %endif
@@ -582,8 +582,6 @@ Patch502: firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
 
 Patch503: drm-i915-turn-off-wc-mmaps.patch
 
-Patch504: KEYS-ensure-we-free-the-assoc-array-edit-if-edit-is-.patch
-
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2019,6 +2017,9 @@ fi
 #
 # 
 %changelog
+* Wed Jul 29 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc4.git2.1
+- Linux v4.2-rc4-53-g956325bd55bb
+
 * Wed Jul 29 2015 Josh Boyer <jwboyer@fedoraproject.org>
 - Drop acpi_brightness_enable revert patch
 

sources

@@ -1,4 +1,4 @@
 fe9dc0f6729f36400ea81aa41d614c37  linux-4.1.tar.xz
 84e34c2f58901edcc5c840fe9893c02e  perf-man-4.1.tar.gz
 8c9a9889e1994c220e9794ffc54301f2  patch-4.2-rc4.xz
-e73e50e7875fca09808d655dd0acb7a7  patch-4.2-rc4-git1.xz
+568a8c0cb98100d3ef6f45ea1123b310  patch-4.2-rc4-git2.xz