rpms/kernel
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Linux v3.15-7926-gd53b47c08d8f

Browse Source
This commit is contained in:
Josh Boyer 2014-06-12 13:02:42 -04:00
parent 0247327513
commit 8cc85e9033
6 changed files with 49 additions and 171 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

128
auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
View File

@ -1,128 +0,0 @@
Bugzilla: 1102715
Upstream-status: Submitted for 3.15 and CC'd to stable
Delivered-To: jwboyer@gmail.com
Received: by 10.76.6.212 with SMTP id d20csp285523oaa;
Wed, 28 May 2014 20:10:58 -0700 (PDT)
X-Received: by 10.66.250.166 with SMTP id zd6mr4872927pac.7.1401333057574;
Wed, 28 May 2014 20:10:57 -0700 (PDT)
Return-Path: <stable-owner@vger.kernel.org>
Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
by mx.google.com with ESMTP id j1si26042371pbw.214.2014.05.28.20.10.31
for <multiple recipients>;
Wed, 28 May 2014 20:10:57 -0700 (PDT)
Received-SPF: none (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67;
Authentication-Results: mx.google.com;
spf=neutral (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) smtp.mail=stable-owner@vger.kernel.org
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
id S1755059AbaE2DKa (ORCPT <rfc822;takashi.bg@gmail.com>
+ 73 others); Wed, 28 May 2014 23:10:30 -0400
Received: from mx1.redhat.com ([209.132.183.28]:34907 "EHLO mx1.redhat.com"
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
id S1753861AbaE2DK3 (ORCPT <rfc822;stable@vger.kernel.org>);
Wed, 28 May 2014 23:10:29 -0400
Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26])
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3AQfK017267
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);
Wed, 28 May 2014 23:10:26 -0400
Received: from paris.rdu.redhat.com (paris.rdu.redhat.com [10.13.136.28])
by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3APd7019240;
Wed, 28 May 2014 23:10:26 -0400
From: Eric Paris <eparis@redhat.com>
To: torvalds@linux-foundation.org
Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org,
Andy Lutomirski <luto@amacapital.net>, stable@vger.kernel.org,
Eric Paris <eparis@redhat.com>
Subject: [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking
Date: Wed, 28 May 2014 23:09:58 -0400
Message-Id: <1401332999-15167-1-git-send-email-eparis@redhat.com>
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26
Sender: stable-owner@vger.kernel.org
Precedence: bulk
List-ID: <stable.vger.kernel.org>
X-Mailing-List: stable@vger.kernel.org
From: Andy Lutomirski <luto@amacapital.net>
Fixes an easy DoS and possible information disclosure.
This does nothing about the broken state of x32 auditing.
eparis: If the admin has enabled auditd and has specifically loaded audit
rules. This bug has been around since before git. Wow...
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
kernel/auditsc.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 254ce20..842f58a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -728,6 +728,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
return AUDIT_BUILD_CONTEXT;
}
+static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
+{
+ int word, bit;
+
+ if (val > 0xffffffff)
+ return false;
+
+ word = AUDIT_WORD(val);
+ if (word >= AUDIT_BITMASK_SIZE)
+ return false;
+
+ bit = AUDIT_BIT(val);
+
+ return rule->mask[word] & bit;
+}
+
/* At syscall entry and exit time, this filter is called if the
* audit_state is not low enough that auditing cannot take place, but is
* also not high enough that we already know we have to write an audit
@@ -745,11 +761,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
rcu_read_lock();
if (!list_empty(list)) {
- int word = AUDIT_WORD(ctx->major);
- int bit = AUDIT_BIT(ctx->major);
-
list_for_each_entry_rcu(e, list, list) {
- if ((e->rule.mask[word] & bit) == bit &&
+ if (audit_in_mask(&e->rule, ctx->major) &&
audit_filter_rules(tsk, &e->rule, ctx, NULL,
&state, false)) {
rcu_read_unlock();
@@ -769,20 +782,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
static int audit_filter_inode_name(struct task_struct *tsk,
struct audit_names *n,
struct audit_context *ctx) {
- int word, bit;
int h = audit_hash_ino((u32)n->ino);
struct list_head *list = &audit_inode_hash[h];
struct audit_entry *e;
enum audit_state state;
- word = AUDIT_WORD(ctx->major);
- bit = AUDIT_BIT(ctx->major);
-
if (list_empty(list))
return 0;
list_for_each_entry_rcu(e, list, list) {
- if ((e->rule.mask[word] & bit) == bit &&
+ if (audit_in_mask(&e->rule, ctx->major) &&
audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
ctx->current_state = state;
return 1;
--
1.9.0
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

1
config-armv7-generic
View File

@ -187,6 +187,7 @@ CONFIG_SPI_SUN6I=m
CONFIG_MMC_SUNXI=m
CONFIG_GPIO_PCA953X=m
CONFIG_POWER_RESET_SUN6I=y
# CONFIG_TOUCHSCREEN_SUN4I is not set
CONFIG_REGMAP=y
CONFIG_REGMAP_I2C=m

1
config-generic
View File

@ -4764,6 +4764,7 @@ CONFIG_FTRACE_MCOUNT_RECORD=y
# CONFIG_FTRACE_STARTUP_TEST is not set
# CONFIG_TRACE_BRANCH_PROFILING is not set
CONFIG_FUNCTION_PROFILER=y
# CONFIG_TRACEPOINT_BENCHMARK is not set
CONFIG_RING_BUFFER_BENCHMARK=m
# CONFIG_RING_BUFFER_STARTUP_TEST is not set
# CONFIG_RBTREE_TEST is not set

11
kernel.spec
View File

@ -67,7 +67,7 @@ Summary: The Linux kernel
# The rc snapshot level
%define rcrev 0
# The git snapshot level
%define gitrev 3
%define gitrev 4
# Set rpm version accordingly
%define rpmversion 3.%{upstream_sublevel}.0
%endif
@ -624,9 +624,6 @@ Patch25063: disable-libdw-unwind-on-non-x86.patch
#rhbz 983342 1093120
Patch25069: 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
# CVE-2014-3917 rhbz 1102571 1102715
Patch25093: auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
Patch26000: perf-lib64.patch
# Patch series from Hans for various backlight and platform driver fixes
@ -1343,9 +1340,6 @@ ApplyPatch disable-libdw-unwind-on-non-x86.patch
#rhbz 983342 1093120
ApplyPatch 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
# CVE-2014-3917 rhbz 1102571 1102715
ApplyPatch auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
ApplyPatch perf-lib64.patch
# Patch series from Hans for various backlight and platform driver fixes
@ -2231,6 +2225,9 @@ fi
# ||----w |
# || ||
%changelog
* Thu Jun 12 2014 Josh Boyer <jwboyer@fedoraproject.org> - 3.16.0-0.rc0.git4.1
- Linux v3.15-7926-gd53b47c08d8f
* Thu Jun 12 2014 Josh Boyer <jwboyer@fedoraproject.org> - 3.16.0-0.rc0.git3.1
- Linux v3.15-7378-g14208b0ec569

2
sources
View File

@ -1,3 +1,3 @@
97ca1625bb40368dc41b9a7971549071 linux-3.15.tar.xz
ef8f4db937f521a7e323ec589536ba25 perf-man-3.15.tar.gz
12ead2b79d5eddedbecad0426f96b49a patch-3.15-git3.xz
d1e2847f95d142ddcf96f4bd995b3467 patch-3.15-git4.xz

77
x86-vdso-Fix-vdso_install.patch
View File

@ -1,72 +1,79 @@
Delivered-To: jwboyer@gmail.com
Received: by 10.76.6.212 with SMTP id d20csp286438oaa;
Wed, 11 Jun 2014 12:25:34 -0700 (PDT)
X-Received: by 10.66.66.135 with SMTP id f7mr16103670pat.22.1402514734508;
Wed, 11 Jun 2014 12:25:34 -0700 (PDT)
Received: by 10.76.6.212 with SMTP id d20csp344695oaa;
Thu, 12 Jun 2014 08:28:19 -0700 (PDT)
X-Received: by 10.52.117.16 with SMTP id ka16mr607162vdb.72.1402586899259;
Thu, 12 Jun 2014 08:28:19 -0700 (PDT)
Return-Path: <luto@amacapital.net>
Received: from bastion.fedoraproject.org (bastion02.fedoraproject.org. [209.132.181.3])
by mx.google.com with ESMTP id px17si7599032pab.171.2014.06.11.12.25.34
by mx.google.com with ESMTP id av9si41982084pbd.28.2014.06.12.08.28.18
for <jwboyer@gmail.com>;
Wed, 11 Jun 2014 12:25:34 -0700 (PDT)
Thu, 12 Jun 2014 08:28:19 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning luto@amacapital.net does not designate 209.132.181.3 as permitted sender) client-ip=209.132.181.3;
Authentication-Results: mx.google.com;
spf=softfail (google.com: domain of transitioning luto@amacapital.net does not designate 209.132.181.3 as permitted sender) smtp.mail=luto@amacapital.net
Received: by bastion02.phx2.fedoraproject.org (Postfix)
id E8FA440A1B; Wed, 11 Jun 2014 19:25:33 +0000 (UTC)
id 99AB440A0C; Thu, 12 Jun 2014 15:28:18 +0000 (UTC)
Delivered-To: jwboyer@fedoraproject.org
Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16])
by bastion02.phx2.fedoraproject.org (Postfix) with ESMTP id C7A2B409CE
for <jwboyer@fedoraproject.org>; Wed, 11 Jun 2014 19:25:33 +0000 (UTC)
Received: from mail-pb0-f41.google.com (mail-pb0-f41.google.com [209.85.160.41])
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s5BJPWY6031412
for <jwboyer@fedoraproject.org>; Wed, 11 Jun 2014 15:25:32 -0400
Received: by mail-pb0-f41.google.com with SMTP id ma3so134149pbc.14
for <jwboyer@fedoraproject.org>; Wed, 11 Jun 2014 12:25:32 -0700 (PDT)
by bastion02.phx2.fedoraproject.org (Postfix) with ESMTP id 004DA409E2
for <jwboyer@fedoraproject.org>; Thu, 12 Jun 2014 15:28:17 +0000 (UTC)
Received: from mail-pb0-f53.google.com (mail-pb0-f53.google.com [209.85.160.53])
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s5CFSGU5021153
for <jwboyer@fedoraproject.org>; Thu, 12 Jun 2014 11:28:17 -0400
Received: by mail-pb0-f53.google.com with SMTP id uo5so852395pbc.40
for <jwboyer@fedoraproject.org>; Thu, 12 Jun 2014 08:28:16 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to
:references;
bh=3SQxyOCkOEd7ZqBxGm7GVdRdWte9s/+lnDgnWxAd/KE=;
b=aDS8HAiLCK/Rp4I/5iUikYimi8LKsU7iI7K+lCuBGaFVgUY6pa4zykb8A2q/aJWuZY
UDJbBhP0gnZ+xlKkVrRVa9iCwYAJHHf/Ipdidjs0lwFVTlSZuyxXR61vFdRhgN2HFtl9
AHx95u6UKn2KLoVxtRU6ZiYMMpVacmmQlHh6iZcMsVq2C52qTBchO6r0rGMmeP0f69QZ
h86teTPCUlRQXQCUH9pvTEtmamygxGmf9VBYom8qD3KYuAlQkOGRTo7fwiRjgTHCXk92
veKA7umfd4rqs9iIIi2qnh4NTonxfWG7lfJVW+j2Ep+gHfCm1hyuM5CVS8fybRvf2gv0
gKNA==
X-Gm-Message-State: ALoCoQnKVS9+ljO89CTRxFu6zQ1VI6ucPd7i9b7bFnfJZAyZDVXkacL2IJbXQ11P4CBXW2DOSlaH
X-Received: by 10.68.201.10 with SMTP id jw10mr7480616pbc.25.1402514732325;
Wed, 11 Jun 2014 12:25:32 -0700 (PDT)
bh=ddu2G5u9JbFRc8+rX1oe08XVbsdCMg9zOAD5WpZAUW8=;
b=fGKwrcdoPNjePGLV+Bc6LhnQhGwD8n1Ebib3P/R3WpBb0z4cnDERuW3gKfaytc6cOl
xBP26iybb80BEyJFw7gJMDn7KATuyqTu5xc+XjsEJBnPAKxAQlupq97raiC6R10h0jeD
XL4370OCs5p+GkiEBaH9PkNdbNB2f75RzBRvKwwgLCVQrQcY1KNDGsorxhkMEPLMCv6I
tQM89Z4qlMI50Bu8lF6cPudAK2/SYHYfjVWPwZIbMRkbZamv0tcmTQZ860anhZJOq9wk
1aRKO8ZU8sBfNeWsteXUGFYLo9hAqWzbpljGUjX0FGaq7ldT1jG34j5aZmemnsxRHY5U
1jLA==
X-Gm-Message-State: ALoCoQnnT5XR2WzJyaDMk0ZtGPJbGJ+HGV9+e3BVpsAuSBaM7+evtF8bDD3h0gOE+kHqnZF6uXgV
X-Received: by 10.66.242.171 with SMTP id wr11mr21567507pac.111.1402586896547;
Thu, 12 Jun 2014 08:28:16 -0700 (PDT)
Received: from localhost (50-76-60-73-ip-static.hfc.comcastbusiness.net. [50.76.60.73])
by mx.google.com with ESMTPSA id id10sm76404116pbc.35.2014.06.11.12.25.30
by mx.google.com with ESMTPSA id ir10sm80996154pbc.59.2014.06.12.08.28.15
for <multiple recipients>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 11 Jun 2014 12:25:31 -0700 (PDT)
Thu, 12 Jun 2014 08:28:15 -0700 (PDT)
From: Andy Lutomirski <luto@amacapital.net>
To: "H. Peter Anvin" <hpa@zytor.com>, Josh Boyer <jwboyer@fedoraproject.org>
Cc: Michal Marek <mmarek@suse.cz>, linux-kbuild@vger.kernel.org,
"Linux-Kernel@Vger. Kernel. Org" <linux-kernel@vger.kernel.org>,
Andy Lutomirski <luto@amacapital.net>
Subject: [PATCH v2] x86,vdso: Fix vdso_install
Date: Wed, 11 Jun 2014 12:25:29 -0700
Message-Id: <5d5e221e59be20a3a7ceb99452e74e233383e7b4.1402514715.git.luto@amacapital.net>
<sam@ravnborg.org>, Andy Lutomirski <luto@amacapital.net>
Subject: [PATCH v3] x86,vdso: Fix vdso_install
Date: Thu, 12 Jun 2014 08:28:10 -0700
Message-Id: <b10299edd8ba98d17e07dafcd895b8ecf4d99eff.1402586707.git.luto@amacapital.net>
X-Mailer: git-send-email 1.9.3
In-Reply-To: <sam@ravnborg.org>
References: <sam@ravnborg.org>
In-Reply-To: <CA+5PVA5rP4cF14-ckD4K4MgBNtfHB+xPg3whEL26JkxegE7qpg@mail.gmail.com>
References: <CA+5PVA5rP4cF14-ckD4K4MgBNtfHB+xPg3whEL26JkxegE7qpg@mail.gmail.com>
X-RedHat-Spam-Score: -2.7 (BAYES_00,DCC_REPUT_13_19,RCVD_IN_DNSWL_LOW,SPF_PASS,URIBL_BLOCKED)
X-Scanned-By: MIMEDefang 2.68 on 10.5.110.16
The filenames are different now. Inspired by a patch from
Sam Ravnborg.
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Reported-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
---
I kept Sam's ack from v2, since v3 has only a trivial change.
Changes from v1: Remove core kbuild change
Changes from v2: Name the result .so files again, not .so.dbg
arch/x86/vdso/Makefile | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
index 9769df0..e3683d6 100644
index 9769df0..845b45e 100644
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -9,11 +9,6 @@ VDSOX32-$(CONFIG_X86_X32_ABI) := y
@ -94,12 +101,12 @@ index 9769df0..e3683d6 100644
+quiet_cmd_vdso_install = INSTALL $(@:install_%=%)
+ cmd_vdso_install = cp $< $(MODLIB)/vdso/$(@:install_%=%)
+
+vdso_img_insttargets := $(vdso_img_sodbg:%=install_%)
+vdso_img_insttargets := $(vdso_img_sodbg:%.dbg=install_%)
+
+$(MODLIB)/vdso: FORCE
@mkdir -p $(MODLIB)/vdso
+
+$(vdso_img_insttargets): install_%: $(obj)/% $(MODLIB)/vdso FORCE
+$(vdso_img_insttargets): install_%: $(obj)/%.dbg $(MODLIB)/vdso FORCE
$(call cmd,vdso_install)
-PHONY += vdso_install $(vdso-install-y)