rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'origin/master' into f26_apr24

This commit is contained in:
Laura Abbott 2017-04-24 08:04:29 -07:00
parent ef764ba61d 3f96e76a4f
commit 45b26b00cf
27 changed files with 233 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

180
CVE-2017-7645.patch Normal file
View File

@ -0,0 +1,180 @@
From: "J. Bruce Fields" <bfields@redhat.com>
Date: 2017-04-14 15:04:40
Subject: [PATCH] nfsd: check for oversized NFSv2/v3 arguments
A client can append random data to the end of an NFSv2 or NFSv3 RPC call
without our complaining; we'll just stop parsing at the end of the
expected data and ignore the rest.
Encoded arguments and replies are stored together in an array of pages,
and if a call is too large it could leave inadequate space for the
reply. This is normally OK because NFS RPC's typically have either
short arguments and long replies (like READ) or long arguments and short
replies (like WRITE). But a client that sends an incorrectly long reply
can violate those assumptions. This was observed to cause crashes.
So, insist that the argument not be any longer than we expect.
Also, several operations increment rq_next_page in the decode routine
before checking the argument size, which can leave rq_next_page pointing
well past the end of the page array, causing trouble later in
svc_free_pages.
As followup we may also want to rewrite the encoding routines to check
more carefully that they aren't running off the end of the page array.
Reported-by: Tuomas Haanpää <thaan@synopsys.com>
Reported-by: Ari Kauppi <ari@synopsys.com>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
---
fs/nfsd/nfs3xdr.c | 23 +++++++++++++++++------
fs/nfsd/nfsxdr.c | 13 ++++++++++---
include/linux/sunrpc/svc.h | 3 +--
3 files changed, 28 insertions(+), 11 deletions(-)
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index dba2ff8eaa68..be66bcadfaea 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -334,8 +334,11 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
if (!p)
return 0;
p = xdr_decode_hyper(p, &args->offset);
-
args->count = ntohl(*p++);
+
+ if (!xdr_argsize_check(rqstp, p))
+ return 0;
+
len = min(args->count, max_blocksize);
/* set up the kvec */
@@ -349,7 +352,7 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
v++;
}
args->vlen = v;
- return xdr_argsize_check(rqstp, p);
+ return 1;
}
int
@@ -536,9 +539,11 @@ nfs3svc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p,
p = decode_fh(p, &args->fh);
if (!p)
return 0;
+ if (!xdr_argsize_check(rqstp, p))
+ return 0;
args->buffer = page_address(*(rqstp->rq_next_page++));
- return xdr_argsize_check(rqstp, p);
+ return 1;
}
int
@@ -564,10 +569,14 @@ nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
args->verf = p; p += 2;
args->dircount = ~0;
args->count = ntohl(*p++);
+
+ if (!xdr_argsize_check(rqstp, p))
+ return 0;
+
args->count = min_t(u32, args->count, PAGE_SIZE);
args->buffer = page_address(*(rqstp->rq_next_page++));
- return xdr_argsize_check(rqstp, p);
+ return 1;
}
int
@@ -585,6 +594,9 @@ nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, __be32 *p,
args->dircount = ntohl(*p++);
args->count = ntohl(*p++);
+ if (!xdr_argsize_check(rqstp, p))
+ return 0;
+
len = args->count = min(args->count, max_blocksize);
while (len > 0) {
struct page *p = *(rqstp->rq_next_page++);
@@ -592,8 +604,7 @@ nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, __be32 *p,
args->buffer = page_address(p);
len -= PAGE_SIZE;
}
-
- return xdr_argsize_check(rqstp, p);
+ return 1;
}
int
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index 41b468a6a90f..79268369f7b3 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -257,6 +257,9 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
len = args->count = ntohl(*p++);
p++; /* totalcount - unused */
+ if (!xdr_argsize_check(rqstp, p))
+ return 0;
+
len = min_t(unsigned int, len, NFSSVC_MAXBLKSIZE_V2);
/* set up somewhere to store response.
@@ -272,7 +275,7 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
v++;
}
args->vlen = v;
- return xdr_argsize_check(rqstp, p);
+ return 1;
}
int
@@ -360,9 +363,11 @@ nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd_readli
p = decode_fh(p, &args->fh);
if (!p)
return 0;
+ if (!xdr_argsize_check(rqstp, p))
+ return 0;
args->buffer = page_address(*(rqstp->rq_next_page++));
- return xdr_argsize_check(rqstp, p);
+ return 1;
}
int
@@ -400,9 +405,11 @@ nfssvc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
args->cookie = ntohl(*p++);
args->count = ntohl(*p++);
args->count = min_t(u32, args->count, PAGE_SIZE);
+ if (!xdr_argsize_check(rqstp, p))
+ return 0;
args->buffer = page_address(*(rqstp->rq_next_page++));
- return xdr_argsize_check(rqstp, p);
+ return 1;
}
/*
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index e770abeed32d..6ef19cf658b4 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -336,8 +336,7 @@ xdr_argsize_check(struct svc_rqst *rqstp, __be32 *p)
{
char *cp = (char *)p;
struct kvec *vec = &rqstp->rq_arg.head[0];
- return cp >= (char*)vec->iov_base
- && cp <= (char*)vec->iov_base + vec->iov_len;
+ return cp == (char *)vec->iov_base + vec->iov_len;
}
static inline int
--
2.9.3
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

2
baseconfig/CONFIG_DRM_I2C_ADV7533
View File

@ -1 +1 @@
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y

0
baseconfig/arm/armv7/lpae/CONFIG_SND_SOC_TEGRA_WM8753 → baseconfig/arm/armv7/CONFIG_SND_SOC_TEGRA_WM8753
View File

1
baseconfig/arm/armv7/armv7/CONFIG_SND_SOC_TEGRA_WM8753
View File

@ -1 +0,0 @@
CONFIG_SND_SOC_TEGRA_WM8753=m

2
gitrev
View File

@ -1 +1 @@
ee921c762cf90652add60ebacb5b90636ac108df
057a650bdcb05ec5947558b6baa5305a3cb15f17

2
kernel-aarch64-debug.config
View File

@ -1233,7 +1233,7 @@ CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_HISI_KIRIN=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-aarch64.config
View File

@ -1223,7 +1223,7 @@ CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_HISI_KIRIN=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

4
kernel-armv7hl-debug.config
View File

@ -1328,7 +1328,7 @@ CONFIG_DRM_HDLCD=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m
@ -5559,7 +5559,7 @@ CONFIG_SND_SOC_TEGRA_RT5640=m
CONFIG_SND_SOC_TEGRA_RT5677=m
CONFIG_SND_SOC_TEGRA_SGTL5000=m
CONFIG_SND_SOC_TEGRA_TRIMSLICE=m
CONFIG_SND_SOC_TEGRA_WM8753=m
# CONFIG_SND_SOC_TEGRA_WM8753 is not set
CONFIG_SND_SOC_TEGRA_WM8903=m
CONFIG_SND_SOC_TEGRA_WM9712=m
# CONFIG_SND_SOC_TFA9879 is not set

2
kernel-armv7hl-lpae-debug.config
View File

@ -1276,7 +1276,7 @@ CONFIG_DRM_HDLCD=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-armv7hl-lpae.config
View File

@ -1266,7 +1266,7 @@ CONFIG_DRM_HDLCD=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

4
kernel-armv7hl.config
View File

@ -1318,7 +1318,7 @@ CONFIG_DRM_HDLCD=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m
@ -5536,7 +5536,7 @@ CONFIG_SND_SOC_TEGRA_RT5640=m
CONFIG_SND_SOC_TEGRA_RT5677=m
CONFIG_SND_SOC_TEGRA_SGTL5000=m
CONFIG_SND_SOC_TEGRA_TRIMSLICE=m
CONFIG_SND_SOC_TEGRA_WM8753=m
# CONFIG_SND_SOC_TEGRA_WM8753 is not set
CONFIG_SND_SOC_TEGRA_WM8903=m
CONFIG_SND_SOC_TEGRA_WM9712=m
# CONFIG_SND_SOC_TFA9879 is not set

2
kernel-i686-PAE.config
View File

@ -1103,7 +1103,7 @@ CONFIG_DRM_GMA500=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-i686-PAEdebug.config
View File

@ -1114,7 +1114,7 @@ CONFIG_DRM_GMA500=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-i686-debug.config
View File

@ -1114,7 +1114,7 @@ CONFIG_DRM_GMA500=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-i686.config
View File

@ -1103,7 +1103,7 @@ CONFIG_DRM_GMA500=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-ppc64-debug.config
View File

@ -1078,7 +1078,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-ppc64.config
View File

@ -1067,7 +1067,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-ppc64le-debug.config
View File

@ -1034,7 +1034,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-ppc64le.config
View File

@ -1023,7 +1023,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-ppc64p7-debug.config
View File

@ -1033,7 +1033,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-ppc64p7.config
View File

@ -1022,7 +1022,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-s390x-debug.config
View File

@ -1029,7 +1029,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-s390x.config
View File

@ -1018,7 +1018,7 @@ CONFIG_DRM_FBDEV_EMULATION=y
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-x86_64-debug.config
View File

@ -1146,7 +1146,7 @@ CONFIG_DRM_GMA500=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

2
kernel-x86_64.config
View File

@ -1135,7 +1135,7 @@ CONFIG_DRM_GMA500=m
CONFIG_DRM_HISI_HIBMC=m
CONFIG_DRM_I2C_ADV7511_AUDIO=y
CONFIG_DRM_I2C_ADV7511=m
# CONFIG_DRM_I2C_ADV7533 is not set
CONFIG_DRM_I2C_ADV7533=y
CONFIG_DRM_I2C_CH7006=m
CONFIG_DRM_I2C_NXP_TDA998X=m
CONFIG_DRM_I2C_SIL164=m

29
kernel.spec
View File

@ -67,7 +67,7 @@ Summary: The Linux kernel
# The next upstream release sublevel (base_sublevel+1)
%define upstream_sublevel %(echo $((%{base_sublevel} + 1)))
# The rc snapshot level
%global rcrev 7
%global rcrev 8
# The git snapshot level
%define gitrev 0
# Set rpm version accordingly
@ -611,6 +611,9 @@ Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
#rhbz 1435154
Patch666: powerpc-prom-Increase-RMA-size-to-512MB.patch
# CVE-2017-7645 rhbz 1443615 1443617
Patch667: CVE-2017-7645.patch
# END OF PATCH DEFINITIONS
%endif
@ -2175,6 +2178,30 @@ fi
#
#
%changelog
* Mon Apr 24 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.0-0.rc8.git0.1
- Linux v4.11-rc8
* Mon Apr 24 2017 Laura Abbott <labbott@fedoraproject.org>
- Disable debugging options.
* Fri Apr 21 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.11.0-0.rc7.git3.1
- Linux v4.11-rc7-111-g057a650
* Fri Apr 21 2017 Peter Robinson <pbrobinson@fedoraproject.org>
- Enable ADV7533 sub module
* Thu Apr 20 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.11.0-0.rc7.git2.1
- Linux v4.11-rc7-42-gf61143c
* Wed Apr 19 2017 Justin M. Forbes <jforbes@fedoraproject.org>
- Fix CVE-2017-7645 (rhbz 1443615 1443617)
* Wed Apr 19 2017 Laura Abbott <labbott@redhat.com> - 4.11.0-0.rc7.git1.1
- Linux v4.11-rc7-29-g005882e53d62
* Wed Apr 19 2017 Laura Abbott <labbott@redhat.com>
- Reenable debugging options.
* Mon Apr 17 2017 Laura Abbott <labbott@fedoraproject.org> - 4.11.0-0.rc7.git0.1
- Linux v4.11-rc7

2
sources
View File

@ -1,3 +1,3 @@
SHA512 (linux-4.10.tar.xz) = c3690125a8402df638095bd98a613fcf1a257b81de7611c84711d315cd11e2634ab4636302b3742aedf1e3ba9ce0fea53fe8c7d48e37865d8ee5db3565220d90
SHA512 (perf-man-4.10.tar.gz) = 2c830e06f47211d70a8330961487af73a8bc01073019475e6b6131d3bb8c95658b77ca0ae5f1b44371accf103658bc5a3a4366b3e017a4088a8fd408dd6867e8
SHA512 (patch-4.11-rc7.xz) = 01abe7a1d4cf5779479f4289734dd74ac202012e2b8058c2451cfa8b355a58ea2397c7f5c29bd5e3ba5a83cbc22bfc4738cd2b6f8caf4baa9e7495bc88340b6d
SHA512 (patch-4.11-rc8.xz) = 07a3b08ad1ef9323df14f19995bdc261c303a150d58159791697389701f01ade2fdb55937c3c08f362772dd3e1337e466d653de81a9d49ff1015f4482d77c375