From 3b197efcc270d66e85a1588b79f49a54e465ed9d Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 20 Nov 2013 15:57:11 -0500 Subject: [PATCH] Linux v3.12.1 --- kernel.spec | 11 +-- net-flow_dissector-fail-on-evil-iph-ihl.patch | 82 ------------------- sources | 1 + 3 files changed, 5 insertions(+), 89 deletions(-) delete mode 100644 net-flow_dissector-fail-on-evil-iph-ihl.patch diff --git a/kernel.spec b/kernel.spec index 3adb447c2..815434e21 100644 --- a/kernel.spec +++ b/kernel.spec @@ -74,7 +74,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 0 +%define stable_update 1 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -735,9 +735,6 @@ Patch25131: btrfs-relocate-csums-properly-with-prealloc-ext.patch #rhbz 984696 Patch25132: rt2800usb-slow-down-TX-status-polling.patch -#CVE-2013-4348 rhbz 1007939 1025647 -Patch25139: net-flow_dissector-fail-on-evil-iph-ihl.patch - Patch25140: drm-qxl-backport-fixes-for-Fedora.patch Patch25141: Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch @@ -1461,9 +1458,6 @@ ApplyPatch btrfs-relocate-csums-properly-with-prealloc-ext.patch #rhbz 984696 ApplyPatch rt2800usb-slow-down-TX-status-polling.patch -#CVE-2013-4348 rhbz 1007939 1025647 -ApplyPatch net-flow_dissector-fail-on-evil-iph-ihl.patch - ApplyPatch drm-qxl-backport-fixes-for-Fedora.patch ApplyPatch Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch @@ -2287,6 +2281,9 @@ fi # ||----w | # || || %changelog +* Wed Nov 20 2013 Josh Boyer +- Linux v3.12.1 + * Tue Nov 19 2013 Josh Boyer - Enable CGROUP_HUGETLB on ppc64/ppc64p7 and x86_64 (rhbz 1031984) diff --git a/net-flow_dissector-fail-on-evil-iph-ihl.patch b/net-flow_dissector-fail-on-evil-iph-ihl.patch deleted file mode 100644 index aba3ea88b..000000000 --- a/net-flow_dissector-fail-on-evil-iph-ihl.patch +++ /dev/null @@ -1,82 +0,0 @@ -Path: news.gmane.org!not-for-mail -From: Jason Wang -Newsgroups: gmane.linux.kernel,gmane.linux.network -Subject: [PATCH net] net: flow_dissector: fail on evil iph->ihl -Date: Fri, 1 Nov 2013 15:01:10 +0800 -Lines: 34 -Approved: news@gmane.org -Message-ID: <1383289270-18952-1-git-send-email-jasowang@redhat.com> -NNTP-Posting-Host: plane.gmane.org -X-Trace: ger.gmane.org 1383289296 18578 80.91.229.3 (1 Nov 2013 07:01:36 GMT) -X-Complaints-To: usenet@ger.gmane.org -NNTP-Posting-Date: Fri, 1 Nov 2013 07:01:36 +0000 (UTC) -Cc: Jason Wang , - Petr Matousek , - "Michael S. Tsirkin" , - Daniel Borkmann -To: davem@davemloft.net, edumazet@google.com, netdev@vger.kernel.org, - linux-kernel@vger.kernel.org -Original-X-From: linux-kernel-owner@vger.kernel.org Fri Nov 01 08:01:39 2013 -Return-path: -Envelope-to: glk-linux-kernel-3@plane.gmane.org -Original-Received: from vger.kernel.org ([209.132.180.67]) - by plane.gmane.org with esmtp (Exim 4.69) - (envelope-from ) - id 1Vc8jh-00034h-9Y - for glk-linux-kernel-3@plane.gmane.org; Fri, 01 Nov 2013 08:01:37 +0100 -Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand - id S1753899Ab3KAHB3 (ORCPT ); - Fri, 1 Nov 2013 03:01:29 -0400 -Original-Received: from mx1.redhat.com ([209.132.183.28]:8081 "EHLO mx1.redhat.com" - rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP - id S1752399Ab3KAHB1 (ORCPT ); - Fri, 1 Nov 2013 03:01:27 -0400 -Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) - by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA171QgE005079 - (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); - Fri, 1 Nov 2013 03:01:26 -0400 -Original-Received: from jason-ThinkPad-T430s.nay.redhat.com (dhcp-66-71-71.eng.nay.redhat.com [10.66.71.71] (may be forged)) - by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id rA171Jpr015790; - Fri, 1 Nov 2013 03:01:20 -0400 -X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 -Original-Sender: linux-kernel-owner@vger.kernel.org -Precedence: bulk -List-ID: -X-Mailing-List: linux-kernel@vger.kernel.org -Xref: news.gmane.org gmane.linux.kernel:1588387 gmane.linux.network:289242 -Archived-At: - -We don't validate iph->ihl which may lead a dead loop if we meet a IPIP -skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl -is evil (less than 5). - -This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae -(rps: support IPIP encapsulation). - -Cc: Eric Dumazet -Cc: Petr Matousek -Cc: Michael S. Tsirkin -Cc: Daniel Borkmann -Signed-off-by: Jason Wang ---- -This patch is needed for stable. ---- - net/core/flow_dissector.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 8d7d0dd..143b6fd 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -40,7 +40,7 @@ again: - struct iphdr _iph; - ip: - iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); -- if (!iph) -+ if (!iph || iph->ihl < 5) - return false; - - if (ip_is_fragment(iph)) --- -1.8.1.2 - diff --git a/sources b/sources index 579d1e5f3..effa65788 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ cc6ee608854e0da4b64f6c1ff8b6398c linux-3.12.tar.xz +5a8cb5a659baeeb6df3fe22de8d32df6 patch-3.12.1.xz