From 0aeda42811381139ed6fc2d5266218ad60e335e7 Mon Sep 17 00:00:00 2001 From: Laura Abbott Date: Mon, 4 Sep 2017 06:18:28 -0700 Subject: [PATCH] Linux v4.13 --- kernel.spec | 16 +- ...of-bounds-reads-from-address-storage.patch | 196 ------------------ sources | 6 +- 3 files changed, 10 insertions(+), 208 deletions(-) delete mode 100644 net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch diff --git a/kernel.spec b/kernel.spec index 1b7fc4e4b..9967e4180 100644 --- a/kernel.spec +++ b/kernel.spec @@ -6,7 +6,7 @@ Summary: The Linux kernel # For a stable, released kernel, released_kernel should be 1. For rawhide # and/or a kernel built from an rc or git snapshot, released_kernel should # be 0. -%global released_kernel 0 +%global released_kernel 1 # Sign modules on x86. Make sure the config files match this setting if more # architectures are added. @@ -48,7 +48,7 @@ Summary: The Linux kernel # base_sublevel is the kernel version we're starting with and patching # on top of -- for example, 3.1-rc7-git1 starts with a 3.0 base, # which yields a base_sublevel of 0. -%define base_sublevel 12 +%define base_sublevel 13 ## If this is a released kernel ## %if 0%{?released_kernel} @@ -67,9 +67,9 @@ Summary: The Linux kernel # The next upstream release sublevel (base_sublevel+1) %define upstream_sublevel %(echo $((%{base_sublevel} + 1))) # The rc snapshot level -%global rcrev 7 +%global rcrev 0 # The git snapshot level -%define gitrev 4 +%define gitrev 0 # Set rpm version accordingly %define rpmversion 4.%{upstream_sublevel}.0 %endif @@ -125,7 +125,7 @@ Summary: The Linux kernel # Set debugbuildsenabled to 1 for production (build separate debug kernels) # and 0 for rawhide (all kernels are debug kernels). # See also 'make debug' and 'make release'. -%define debugbuildsenabled 0 +%define debugbuildsenabled 1 # Want to build a vanilla kernel build without any non-upstream patches? %define with_vanilla %{?_with_vanilla: 1} %{?!_with_vanilla: 0} @@ -653,9 +653,6 @@ Patch617: Fix-for-module-sig-verification.patch # rhbz 1485086 Patch619: pci-mark-amd-stoney-gpu-ats-as-broken.patch -# CVE-2017-7558 rhbz 1480266 1484810 -Patch621: net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch - # END OF PATCH DEFINITIONS %endif @@ -2210,6 +2207,9 @@ fi # # %changelog +* Mon Sep 04 2017 Laura Abbott - 4.13.0-1 +- Linux v4.13 + * Fri Sep 01 2017 Laura Abbott - 4.13.0-0.rc7.git4.1 - Linux v4.13-rc7-74-ge89ce1f89f62 diff --git a/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch b/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch deleted file mode 100644 index 84968f03f..000000000 --- a/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch +++ /dev/null @@ -1,196 +0,0 @@ -From patchwork Wed Aug 23 11:27:13 2017 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Subject: [net] sctp: Avoid out-of-bounds reads from address storage -From: Stefano Brivio -X-Patchwork-Id: 9917151 -Message-Id: <7763d91bcf14744e49f09fc4bec0fb22c097774f.1502384055.git.sbrivio@redhat.com> -To: "David S . Miller" , netdev@vger.kernel.org, - linux-kernel@vger.kernel.org, stable@vger.kernel.org -Cc: Xin Long , Vlad Yasevich , - Neil Horman , linux-sctp@vger.kernel.org -Date: Wed, 23 Aug 2017 13:27:13 +0200 - -inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() copy -sizeof(sockaddr_storage) bytes to fill in sockaddr structs used -to export diagnostic information to userspace. - -However, the memory allocated to store sockaddr information is -smaller than that and depends on the address family, so we leak -up to 100 uninitialized bytes to userspace. Just use the size of -the source structs instead, in all the three cases this is what -userspace expects. Zero out the remaining memory. - -Unused bytes (i.e. when IPv4 addresses are used) in source -structs sctp_sockaddr_entry and sctp_transport are already -cleared by sctp_add_bind_addr() and sctp_transport_new(), -respectively. - -Noticed while testing KASAN-enabled kernel with 'ss': - -[ 2326.885243] BUG: KASAN: slab-out-of-bounds in inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag] at addr ffff881be8779800 -[ 2326.896800] Read of size 128 by task ss/9527 -[ 2326.901564] CPU: 0 PID: 9527 Comm: ss Not tainted 4.11.0-22.el7a.x86_64 #1 -[ 2326.909236] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 -[ 2326.917585] Call Trace: -[ 2326.920312] dump_stack+0x63/0x8d -[ 2326.924014] kasan_object_err+0x21/0x70 -[ 2326.928295] kasan_report+0x288/0x540 -[ 2326.932380] ? inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag] -[ 2326.938500] ? skb_put+0x8b/0xd0 -[ 2326.942098] ? memset+0x31/0x40 -[ 2326.945599] check_memory_region+0x13c/0x1a0 -[ 2326.950362] memcpy+0x23/0x50 -[ 2326.953669] inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag] -[ 2326.959596] ? inet_diag_msg_sctpasoc_fill+0x460/0x460 [sctp_diag] -[ 2326.966495] ? __lock_sock+0x102/0x150 -[ 2326.970671] ? sock_def_wakeup+0x60/0x60 -[ 2326.975048] ? remove_wait_queue+0xc0/0xc0 -[ 2326.979619] sctp_diag_dump+0x44a/0x760 [sctp_diag] -[ 2326.985063] ? sctp_ep_dump+0x280/0x280 [sctp_diag] -[ 2326.990504] ? memset+0x31/0x40 -[ 2326.994007] ? mutex_lock+0x12/0x40 -[ 2326.997900] __inet_diag_dump+0x57/0xb0 [inet_diag] -[ 2327.003340] ? __sys_sendmsg+0x150/0x150 -[ 2327.007715] inet_diag_dump+0x4d/0x80 [inet_diag] -[ 2327.012979] netlink_dump+0x1e6/0x490 -[ 2327.017064] __netlink_dump_start+0x28e/0x2c0 -[ 2327.021924] inet_diag_handler_cmd+0x189/0x1a0 [inet_diag] -[ 2327.028045] ? inet_diag_rcv_msg_compat+0x1b0/0x1b0 [inet_diag] -[ 2327.034651] ? inet_diag_dump_compat+0x190/0x190 [inet_diag] -[ 2327.040965] ? __netlink_lookup+0x1b9/0x260 -[ 2327.045631] sock_diag_rcv_msg+0x18b/0x1e0 -[ 2327.050199] netlink_rcv_skb+0x14b/0x180 -[ 2327.054574] ? sock_diag_bind+0x60/0x60 -[ 2327.058850] sock_diag_rcv+0x28/0x40 -[ 2327.062837] netlink_unicast+0x2e7/0x3b0 -[ 2327.067212] ? netlink_attachskb+0x330/0x330 -[ 2327.071975] ? kasan_check_write+0x14/0x20 -[ 2327.076544] netlink_sendmsg+0x5be/0x730 -[ 2327.080918] ? netlink_unicast+0x3b0/0x3b0 -[ 2327.085486] ? kasan_check_write+0x14/0x20 -[ 2327.090057] ? selinux_socket_sendmsg+0x24/0x30 -[ 2327.095109] ? netlink_unicast+0x3b0/0x3b0 -[ 2327.099678] sock_sendmsg+0x74/0x80 -[ 2327.103567] ___sys_sendmsg+0x520/0x530 -[ 2327.107844] ? __get_locked_pte+0x178/0x200 -[ 2327.112510] ? copy_msghdr_from_user+0x270/0x270 -[ 2327.117660] ? vm_insert_page+0x360/0x360 -[ 2327.122133] ? vm_insert_pfn_prot+0xb4/0x150 -[ 2327.126895] ? vm_insert_pfn+0x32/0x40 -[ 2327.131077] ? vvar_fault+0x71/0xd0 -[ 2327.134968] ? special_mapping_fault+0x69/0x110 -[ 2327.140022] ? __do_fault+0x42/0x120 -[ 2327.144008] ? __handle_mm_fault+0x1062/0x17a0 -[ 2327.148965] ? __fget_light+0xa7/0xc0 -[ 2327.153049] __sys_sendmsg+0xcb/0x150 -[ 2327.157133] ? __sys_sendmsg+0xcb/0x150 -[ 2327.161409] ? SyS_shutdown+0x140/0x140 -[ 2327.165688] ? exit_to_usermode_loop+0xd0/0xd0 -[ 2327.170646] ? __do_page_fault+0x55d/0x620 -[ 2327.175216] ? __sys_sendmsg+0x150/0x150 -[ 2327.179591] SyS_sendmsg+0x12/0x20 -[ 2327.183384] do_syscall_64+0xe3/0x230 -[ 2327.187471] entry_SYSCALL64_slow_path+0x25/0x25 -[ 2327.192622] RIP: 0033:0x7f41d18fa3b0 -[ 2327.196608] RSP: 002b:00007ffc3b731218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e -[ 2327.205055] RAX: ffffffffffffffda RBX: 00007ffc3b731380 RCX: 00007f41d18fa3b0 -[ 2327.213017] RDX: 0000000000000000 RSI: 00007ffc3b731340 RDI: 0000000000000003 -[ 2327.220978] RBP: 0000000000000002 R08: 0000000000000004 R09: 0000000000000040 -[ 2327.228939] R10: 00007ffc3b730f30 R11: 0000000000000246 R12: 0000000000000003 -[ 2327.236901] R13: 00007ffc3b731340 R14: 00007ffc3b7313d0 R15: 0000000000000084 -[ 2327.244865] Object at ffff881be87797e0, in cache kmalloc-64 size: 64 -[ 2327.251953] Allocated: -[ 2327.254581] PID = 9484 -[ 2327.257215] save_stack_trace+0x1b/0x20 -[ 2327.261485] save_stack+0x46/0xd0 -[ 2327.265179] kasan_kmalloc+0xad/0xe0 -[ 2327.269165] kmem_cache_alloc_trace+0xe6/0x1d0 -[ 2327.274138] sctp_add_bind_addr+0x58/0x180 [sctp] -[ 2327.279400] sctp_do_bind+0x208/0x310 [sctp] -[ 2327.284176] sctp_bind+0x61/0xa0 [sctp] -[ 2327.288455] inet_bind+0x5f/0x3a0 -[ 2327.292151] SYSC_bind+0x1a4/0x1e0 -[ 2327.295944] SyS_bind+0xe/0x10 -[ 2327.299349] do_syscall_64+0xe3/0x230 -[ 2327.303433] return_from_SYSCALL_64+0x0/0x6a -[ 2327.308194] Freed: -[ 2327.310434] PID = 4131 -[ 2327.313065] save_stack_trace+0x1b/0x20 -[ 2327.317344] save_stack+0x46/0xd0 -[ 2327.321040] kasan_slab_free+0x73/0xc0 -[ 2327.325220] kfree+0x96/0x1a0 -[ 2327.328530] dynamic_kobj_release+0x15/0x40 -[ 2327.333195] kobject_release+0x99/0x1e0 -[ 2327.337472] kobject_put+0x38/0x70 -[ 2327.341266] free_notes_attrs+0x66/0x80 -[ 2327.345545] mod_sysfs_teardown+0x1a5/0x270 -[ 2327.350211] free_module+0x20/0x2a0 -[ 2327.354099] SyS_delete_module+0x2cb/0x2f0 -[ 2327.358667] do_syscall_64+0xe3/0x230 -[ 2327.362750] return_from_SYSCALL_64+0x0/0x6a -[ 2327.367510] Memory state around the buggy address: -[ 2327.372855] ffff881be8779700: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc -[ 2327.380914] ffff881be8779780: fb fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00 -[ 2327.388972] >ffff881be8779800: 00 00 00 00 fc fc fc fc fb fb fb fb fb fb fb fb -[ 2327.397031] ^ -[ 2327.401792] ffff881be8779880: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc -[ 2327.409850] ffff881be8779900: 00 00 00 00 00 04 fc fc fc fc fc fc 00 00 00 00 -[ 2327.417907] ================================================================== - -This fixes CVE-2017-7558. - -References: https://bugzilla.redhat.com/show_bug.cgi?id=1480266 -Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") -Cc: # 4.7+ -Cc: Xin Long -Cc: Vlad Yasevich -Cc: Neil Horman -Signed-off-by: Stefano Brivio -Acked-by: Marcelo Ricardo Leitner -Reviewed-by: Xin Long ---- - net/sctp/sctp_diag.c | 7 +++++-- - net/sctp/socket.c | 3 +-- - 2 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c -index 9a647214a91e..e99518e79b52 100644 ---- a/net/sctp/sctp_diag.c -+++ b/net/sctp/sctp_diag.c -@@ -70,7 +70,8 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb, - - info = nla_data(attr); - list_for_each_entry_rcu(laddr, address_list, list) { -- memcpy(info, &laddr->a, addrlen); -+ memcpy(info, &laddr->a, sizeof(laddr->a)); -+ memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a)); - info += addrlen; - } - -@@ -93,7 +94,9 @@ static int inet_diag_msg_sctpaddrs_fill(struct sk_buff *skb, - info = nla_data(attr); - list_for_each_entry(from, &asoc->peer.transport_addr_list, - transports) { -- memcpy(info, &from->ipaddr, addrlen); -+ memcpy(info, &from->ipaddr, sizeof(from->ipaddr)); -+ memset(info + sizeof(from->ipaddr), 0, -+ addrlen - sizeof(from->ipaddr)); - info += addrlen; - } - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 1db478e34520..8d760863bc41 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4538,8 +4538,7 @@ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc, - info->sctpi_ictrlchunks = asoc->stats.ictrlchunks; - - prim = asoc->peer.primary_path; -- memcpy(&info->sctpi_p_address, &prim->ipaddr, -- sizeof(struct sockaddr_storage)); -+ memcpy(&info->sctpi_p_address, &prim->ipaddr, sizeof(prim->ipaddr)); - info->sctpi_p_state = prim->state; - info->sctpi_p_cwnd = prim->cwnd; - info->sctpi_p_srtt = prim->srtt; diff --git a/sources b/sources index f1873f767..1a6b5b028 100644 --- a/sources +++ b/sources @@ -1,4 +1,2 @@ -SHA512 (perf-man-4.12.tar.gz) = 4d3bbda1f520dba0007c351af46f45085fe4842074eb2e01aee736fd369df595f8f72ed6c1192715f1120bf3353279777f9dca1178fe93bffe5be2de700d409c -SHA512 (linux-4.12.tar.xz) = 8e81b41b253e63233e92948941f44c6482acb52aa3a3fd172f03a38a86f2c35b2ad4fd407acd1bc3964673eba344fe104d3a03e3ff4bf9cd1f22bd44263bd728 -SHA512 (patch-4.13-rc7.xz) = 6e4d86d7342d2f89c694d39ca5254f03dcdea239492753febff5a15bd7475ebfbb29461727f46c7df5f24edd5da25b9da91eb4d3a6250f83bf9876a8c1e36aa1 -SHA512 (patch-4.13-rc7-git4.xz) = 8e560b2d73b83ba1fcc0fedf373a364c60c99a342f8ce66bb8b5729612e5bc53bb25f29d7998ee5c9a686dc280e5d9b7761f155b8ebefef36b689306e982bb9e +SHA512 (linux-4.13.tar.xz) = a557c2f0303ae618910b7106ff63d9978afddf470f03cb72aa748213e099a0ecd5f3119aea6cbd7b61df30ca6ef3ec57044d524b7babbaabddf8b08b8bafa7d2 +SHA512 (perf-man-4.13.tar.gz) = 9bcc2cd8e56ec583ed2d8e0b0c88e7a94035a1915e40b3177bb02d6c0f10ddd4df9b097b1f5af59efc624226b613e240ddba8ddc2156f3682f992d5455fc5c03