rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Linux v4.10.12

This commit is contained in:
Justin M. Forbes 2017-04-21 08:49:16 -05:00
parent 2696c3d59c
commit 603bf508d3
25 changed files with 27 additions and 325 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
View File

@ -1,63 +0,0 @@
From patchwork Sun Feb 5 14:57:59 2017
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: [1/2,media] cxusb: Use a dma capable buffer also for reading
From: =?utf-8?q?Stefan_Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
X-Patchwork-Id: 39207
Message-Id: <b638428812af41e080ccfc7cf7ad6963@rwthex-w2-b.rwth-ad.de>
To: <linux-media@vger.kernel.org>
Cc: <linux-kernel@vger.kernel.org>, Mauro Carvalho Chehab <mchehab@kernel.org>,
Michael Krufky <mkrufky@linuxtv.org>,
=?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
Date: Sun, 5 Feb 2017 15:57:59 +0100
Commit 17ce039b4e54 ("[media] cxusb: don't do DMA on stack")
added a kmalloc'ed bounce buffer for writes, but missed to do the same
for reads. As the read only happens after the write is finished, we can
reuse the same buffer.
As dvb_usb_generic_rw handles a read length of 0 by itself, avoid calling
it using the dvb_usb_generic_read wrapper function.
Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
---
drivers/media/usb/dvb-usb/cxusb.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index 9b8c82d94b3f..8f28a63597bd 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -59,23 +59,24 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
{
struct cxusb_state *st = d->priv;
- int ret, wo;
+ int ret;
if (1 + wlen > MAX_XFER_SIZE) {
warn("i2c wr: len=%d is too big!\n", wlen);
return -EOPNOTSUPP;
}
- wo = (rbuf == NULL || rlen == 0); /* write-only */
+ if (rlen > MAX_XFER_SIZE) {
+ warn("i2c rd: len=%d is too big!\n", rlen);
+ return -EOPNOTSUPP;
+ }
mutex_lock(&d->data_mutex);
st->data[0] = cmd;
memcpy(&st->data[1], wbuf, wlen);
- if (wo)
- ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
- else
- ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
- rbuf, rlen, 0);
+ ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0);
+ if (!ret && rbuf && rlen)
+ memcpy(rbuf, st->data, rlen);
mutex_unlock(&d->data_mutex);
return ret;

254
CVE-2017-7618.patch
View File

@ -1,254 +0,0 @@
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2017-04-10 9:27:57
Subject: [PATCH v2] crypto: ahash - Fix EINPROGRESS notification callback
On Mon, Apr 10, 2017 at 11:21:27AM +0200, Sabrina Dubroca wrote:
>
> > Cc: <vger@stable.kernel.org>
>
> Should that be stable@vger.kernel.org?
Oops :)
> > Reported-by: Sabrina Dubroca <sdubroca@redhat.com>
> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
>
> The definition of ahash_request_flags() was missing, so I added:
>
> static inline u32 ahash_request_flags(struct ahash_request *req)
> {
> return req->base.flags;
> }
>
> And with this, my tests seem fine.
>
> Tested-by: Sabrina Dubroca <sd@queasysnail.net>
> Could also you change the 'Reported-by:' to that email address?
OK, here is v2.
---8<---
The ahash API modifies the request's callback function in order
to clean up after itself in some corner cases (unaligned final
and missing finup).
When the request is complete ahash will restore the original
callback and everything is fine. However, when the request gets
an EBUSY on a full queue, an EINPROGRESS callback is made while
the request is still ongoing.
In this case the ahash API will incorrectly call its own callback.
This patch fixes the problem by creating a temporary request
object on the stack which is used to relay EINPROGRESS back to
the original completion function.
This patch also adds code to preserve the original flags value.
Fixes: ab6bf4e5e5e4 ("crypto: hash - Fix the pointer voodoo in...")
Cc: <stable@vger.kernel.org>
Reported-by: Sabrina Dubroca <sd@queasysnail.net>
Tested-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/crypto/ahash.c b/crypto/ahash.c
index e58c497..1810feb 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -32,6 +32,7 @@ struct ahash_request_priv {
crypto_completion_t complete;
void *data;
u8 *result;
+ u32 flags;
void *ubuf[] CRYPTO_MINALIGN_ATTR;
};
@@ -253,6 +254,8 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
priv->result = req->result;
priv->complete = req->base.complete;
priv->data = req->base.data;
+ priv->flags = req->base.flags;
+
/*
* WARNING: We do not backup req->priv here! The req->priv
* is for internal use of the Crypto API and the
@@ -267,38 +270,44 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
return 0;
}
-static void ahash_restore_req(struct ahash_request *req)
+static void ahash_restore_req(struct ahash_request *req, int err)
{
struct ahash_request_priv *priv = req->priv;
+ if (!err)
+ memcpy(priv->result, req->result,
+ crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
+
/* Restore the original crypto request. */
req->result = priv->result;
- req->base.complete = priv->complete;
- req->base.data = priv->data;
+
+ ahash_request_set_callback(req, priv->flags,
+ priv->complete, priv->data);
req->priv = NULL;
/* Free the req->priv.priv from the ADJUSTED request. */
kzfree(priv);
}
-static void ahash_op_unaligned_finish(struct ahash_request *req, int err)
+static void ahash_notify_einprogress(struct ahash_request *req)
{
struct ahash_request_priv *priv = req->priv;
+ struct crypto_async_request oreq;
- if (err == -EINPROGRESS)
- return;
+ oreq.data = priv->data;
- if (!err)
- memcpy(priv->result, req->result,
- crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
-
- ahash_restore_req(req);
+ priv->complete(&oreq, -EINPROGRESS);
}
static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
{
struct ahash_request *areq = req->data;
+ if (err == -EINPROGRESS) {
+ ahash_notify_einprogress(areq);
+ return;
+ }
+
/*
* Restore the original request, see ahash_op_unaligned() for what
* goes where.
@@ -309,7 +318,7 @@ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
*/
/* First copy req->result into req->priv.result */
- ahash_op_unaligned_finish(areq, err);
+ ahash_restore_req(areq, err);
/* Complete the ORIGINAL request. */
areq->base.complete(&areq->base, err);
@@ -325,7 +334,12 @@ static int ahash_op_unaligned(struct ahash_request *req,
return err;
err = op(req);
- ahash_op_unaligned_finish(req, err);
+ if (err == -EINPROGRESS ||
+ (err == -EBUSY && (ahash_request_flags(req) &
+ CRYPTO_TFM_REQ_MAY_BACKLOG)))
+ return err;
+
+ ahash_restore_req(req, err);
return err;
}
@@ -360,25 +374,14 @@ int crypto_ahash_digest(struct ahash_request *req)
}
EXPORT_SYMBOL_GPL(crypto_ahash_digest);
-static void ahash_def_finup_finish2(struct ahash_request *req, int err)
+static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
{
- struct ahash_request_priv *priv = req->priv;
+ struct ahash_request *areq = req->data;
if (err == -EINPROGRESS)
return;
- if (!err)
- memcpy(priv->result, req->result,
- crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
-
- ahash_restore_req(req);
-}
-
-static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
-{
- struct ahash_request *areq = req->data;
-
- ahash_def_finup_finish2(areq, err);
+ ahash_restore_req(areq, err);
areq->base.complete(&areq->base, err);
}
@@ -389,11 +392,15 @@ static int ahash_def_finup_finish1(struct ahash_request *req, int err)
goto out;
req->base.complete = ahash_def_finup_done2;
- req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
err = crypto_ahash_reqtfm(req)->final(req);
+ if (err == -EINPROGRESS ||
+ (err == -EBUSY && (ahash_request_flags(req) &
+ CRYPTO_TFM_REQ_MAY_BACKLOG)))
+ return err;
out:
- ahash_def_finup_finish2(req, err);
+ ahash_restore_req(req, err);
return err;
}
@@ -401,7 +408,16 @@ static void ahash_def_finup_done1(struct crypto_async_request *req, int err)
{
struct ahash_request *areq = req->data;
+ if (err == -EINPROGRESS) {
+ ahash_notify_einprogress(areq);
+ return;
+ }
+
+ areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
err = ahash_def_finup_finish1(areq, err);
+ if (areq->priv)
+ return;
areq->base.complete(&areq->base, err);
}
@@ -416,6 +432,11 @@ static int ahash_def_finup(struct ahash_request *req)
return err;
err = tfm->update(req);
+ if (err == -EINPROGRESS ||
+ (err == -EBUSY && (ahash_request_flags(req) &
+ CRYPTO_TFM_REQ_MAY_BACKLOG)))
+ return err;
+
return ahash_def_finup_finish1(req, err);
}
diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
index 1d4f365..f6d9af3e 100644
--- a/include/crypto/internal/hash.h
+++ b/include/crypto/internal/hash.h
@@ -166,6 +166,16 @@ static inline struct ahash_instance *ahash_alloc_instance(
return crypto_alloc_instance2(name, alg, ahash_instance_headroom());
}
+static inline void ahash_request_complete(struct ahash_request *req, int err)
+{
+ req->base.complete(&req->base, err);
+}
+
+static inline u32 ahash_request_flags(struct ahash_request *req)
+{
+ return req->base.flags;
+}
+
static inline struct crypto_ahash *crypto_spawn_ahash(
struct crypto_ahash_spawn *spawn)
{
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

1
baseconfig/CONFIG_DEVPORT Normal file
View File

@ -0,0 +1 @@
# CONFIG_DEVPORT is not set

1
kernel-aarch64-debug.config
View File

@ -1126,6 +1126,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
CONFIG_DEVFREQ_THERMAL=y
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-aarch64.config
View File

@ -1117,6 +1117,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
CONFIG_DEVFREQ_THERMAL=y
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-armv7hl-debug.config
View File

@ -1205,6 +1205,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
CONFIG_DEVFREQ_THERMAL=y
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-armv7hl-lpae-debug.config
View File

@ -1159,6 +1159,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
CONFIG_DEVFREQ_THERMAL=y
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-armv7hl-lpae.config
View File

@ -1150,6 +1150,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
CONFIG_DEVFREQ_THERMAL=y
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-armv7hl.config
View File

@ -1196,6 +1196,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
CONFIG_DEVFREQ_THERMAL=y
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-i686-PAE.config
View File

@ -1016,6 +1016,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-i686-PAEdebug.config
View File

@ -1025,6 +1025,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-i686-debug.config
View File

@ -1025,6 +1025,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-i686.config
View File

@ -1016,6 +1016,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-ppc64-debug.config
View File

@ -996,6 +996,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-ppc64.config
View File

@ -987,6 +987,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-ppc64le-debug.config
View File

@ -951,6 +951,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-ppc64le.config
View File

@ -942,6 +942,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-ppc64p7-debug.config
View File

@ -951,6 +951,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-ppc64p7.config
View File

@ -942,6 +942,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-s390x-debug.config
View File

@ -946,6 +946,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-s390x.config
View File

@ -937,6 +937,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-x86_64-debug.config
View File

@ -1055,6 +1055,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

1
kernel-x86_64.config
View File

@ -1046,6 +1046,7 @@ CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=m
# CONFIG_DEVFREQ_GOV_USERSPACE is not set
# CONFIG_DEVKMEM is not set
CONFIG_DEVMEM=y
# CONFIG_DEVPORT is not set
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_DEVTMPFS=y
# CONFIG_DGAP is not set

12
kernel.spec
View File

@ -54,7 +54,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 11
%define stable_update 12
# Set rpm version accordingly
%if 0%{?stable_update}
%define stablerev %{stable_update}
@ -607,15 +607,9 @@ Patch860: 0001-ping-implement-proper-locking.patch
Patch861: 0001-efi-libstub-Treat-missing-SecureBoot-variable-as-Sec.patch
#rhbz 1439613
Patch862: 1-2-media-cxusb-Use-a-dma-capable-buffer-also-for-reading.patch
#rhbz 1441310
Patch863: rhbz_1441310.patch
# CVE-2017-7618 rhbz 1441095 1441093
Patch865: CVE-2017-7618.patch
# CVE-2017-7645 rhbz 1443615 1443617
Patch866: CVE-2017-7645.patch
@ -2188,6 +2182,10 @@ fi
#
#
%changelog
* Fri Apr 21 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.10.12-100
- Linux v4.10.12 (rhbz 1438117 1440736)
- Fixes CVE-2017-7889 (rhbz 1444493 1444496)
* Wed Apr 19 2017 Justin M. Forbes <jforbes@fedoraproject.org>
- Fix CVE-2017-7645 (rhbz 1443615 1443617)

2
sources
View File

@ -1,3 +1,3 @@
SHA512 (linux-4.10.tar.xz) = c3690125a8402df638095bd98a613fcf1a257b81de7611c84711d315cd11e2634ab4636302b3742aedf1e3ba9ce0fea53fe8c7d48e37865d8ee5db3565220d90
SHA512 (perf-man-4.10.tar.gz) = 2c830e06f47211d70a8330961487af73a8bc01073019475e6b6131d3bb8c95658b77ca0ae5f1b44371accf103658bc5a3a4366b3e017a4088a8fd408dd6867e8
SHA512 (patch-4.10.11.xz) = a3515be12639f12c4433c122615e841eea4a70ae1557eb305f9c175ae2fec16439a34f3a79a4d1976c19b4068bf6ff1a7b75ff600c9b6c467cfa0edb1f24fdab
SHA512 (patch-4.10.12.xz) = 39dacec6f9ed28a3bf3339d98c9f0cc86b977252c8d2cabf5d39572cc1dff078bf8f52afdd7e6bc3213d00f7b42474d9c6a4ba641497d091b122e748a48ff0f9