rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

merge 3.0.3rc1 patches. 

(contains fix for CVE-2011-2905)
This commit is contained in:
Dave Jones 2011-08-15 23:55:31 -04:00
parent 8f238d3c73
commit 9fe2f4befc
5 changed files with 76 additions and 135 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -5,3 +5,4 @@ clog
kernel-2.6.*/
kernel-3.*/
/patch-3.0.2-rc1.gz
/patch-3.0.3-rc1.gz

116
CVE-2011-2905.patch
View File

@ -1,116 +0,0 @@
commit aba8d056078e47350d85b06a9cabd5afcc4b72ea
Author: Jonathan Nieder <jrnieder@gmail.com>
Date: Fri Aug 5 18:58:38 2011 +0200
perf tools: do not look at ./config for configuration
In addition to /etc/perfconfig and $HOME/.perfconfig, perf looks for
configuration in the file ./config, imitating git which looks at
$GIT_DIR/config. If ./config is not a perf configuration file, it
fails, or worse, treats it as a configuration file and changes behavior
in some unexpected way.
"config" is not an unusual name for a file to be lying around and perf
does not have a private directory dedicated for its own use, so let's
just stop looking for configuration in the cwd. Callers needing
context-sensitive configuration can use the PERF_CONFIG environment
variable.
Requested-by: Christian Ohm <chr.ohm@gmx.net>
Cc: 632923@bugs.debian.org
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Christian Ohm <chr.ohm@gmx.net>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/20110805165838.GA7237@elie.gateway.2wire.net
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
index e02d78c..6c86eca 100644
--- a/tools/perf/util/config.c
+++ b/tools/perf/util/config.c
@@ -399,7 +399,6 @@ static int perf_config_global(void)
int perf_config(config_fn_t fn, void *data)
{
int ret = 0, found = 0;
- char *repo_config = NULL;
const char *home = NULL;
/* Setting $PERF_CONFIG makes perf read _only_ the given config file. */
@@ -421,12 +420,6 @@ int perf_config(config_fn_t fn, void *data)
free(user_config);
}
- repo_config = perf_pathdup("config");
- if (!access(repo_config, R_OK)) {
- ret += perf_config_from_file(fn, repo_config, data);
- found += 1;
- }
- free(repo_config);
if (found == 0)
return -1;
return ret;
commit 069e3725dd9be3b759a98e8c80ac5fc38b392b23
Author: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Tue Aug 9 12:42:13 2011 -0300
perf tools: Check $HOME/.perfconfig ownership
Just like we do already for perf.data files.
Requested-by: Ingo Molnar <mingo@elte.hu>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Christian Ohm <chr.ohm@gmx.net>
Cc: David Ahern <dsahern@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jonathan Nieder <jrnieder@gmail.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/n/tip-qgokmxsmvppwpc5404qhyk7e@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
index 6c86eca..fe02903 100644
--- a/tools/perf/util/config.c
+++ b/tools/perf/util/config.c
@@ -413,13 +413,32 @@ int perf_config(config_fn_t fn, void *data)
home = getenv("HOME");
if (perf_config_global() && home) {
char *user_config = strdup(mkpath("%s/.perfconfig", home));
- if (!access(user_config, R_OK)) {
- ret += perf_config_from_file(fn, user_config, data);
- found += 1;
+ struct stat st;
+
+ if (user_config == NULL) {
+ warning("Not enough memory to process %s/.perfconfig, "
+ "ignoring it.", home);
+ goto out;
+ }
+
+ if (stat(user_config, &st) < 0)
+ goto out_free;
+
+ if (st.st_uid && (st.st_uid != geteuid())) {
+ warning("File %s not owned by current user or root, "
+ "ignoring it.", user_config);
+ goto out_free;
}
+
+ if (!st.st_size)
+ goto out_free;
+
+ ret += perf_config_from_file(fn, user_config, data);
+ found += 1;
+out_free:
free(user_config);
}
-
+out:
if (found == 0)
return -1;
return ret;

31
kernel.spec
View File

@ -51,7 +51,7 @@ Summary: The Linux kernel
# For non-released -rc kernels, this will be prepended with "0.", so
# for example a 3 here will become 0.3
#
%global baserelease 1
%global baserelease 0
%global fedora_build %{baserelease}
# base_sublevel is the kernel version we're starting with and patching
@ -64,7 +64,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 2
%define stable_update 3
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@ -582,6 +582,7 @@ Source1000: config-local
Patch00: patch-3.0.bz2
Patch01: patch-3.0.2.bz2
Patch02: patch-3.0.3-rc1.gz
# we also need compile fixes for -vanilla
Patch04: linux-2.6-compile-fixes.patch
@ -594,10 +595,10 @@ Patch05: linux-2.6-makefile-after_link.patch
# revert upstream patches we get via other methods
Patch09: linux-2.6-upstream-reverts.patch
Patch10: CVE-2011-2905.patch
# Standalone patches
Patch100: perf-check-ownership.patch
Patch150: linux-2.6.29-sparc-IOC_TYPECHECK.patch
Patch160: linux-2.6-32bit-mmap-exec-randomization.patch
@ -1099,6 +1100,7 @@ done
# Update vanilla to the latest upstream. (2.6.39 -> 3.0)
ApplyPatch patch-3.0.bz2
ApplyPatch patch-3.0.2.bz2
ApplyPatch patch-3.0.3-rc1.gz
ApplyPatch linux-2.6-makefile-after_link.patch
@ -1112,20 +1114,8 @@ ApplyOptionalPatch linux-2.6-compile-fixes.patch
# revert patches from upstream that conflict or that we get via other means
ApplyOptionalPatch linux-2.6-upstream-reverts.patch -R
# CVE fixes
ApplyPatch CVE-2011-2905.patch
# Architecture patches
# x86(-64)
#
# Intel IOMMU
#
#
# PowerPC
#
ApplyPatch perf-check-ownership.patch
#
# SPARC64
@ -1892,8 +1882,11 @@ fi
# and build.
%changelog
* Mon Aug 15 2011 Dave Jones <davej@redhat.com> 2.6.40.2-1
- 3.0.2
* Mon Aug 15 2011 Dave Jones <davej@redhat.com> 2.6.40.3-0
- Apply patches from 3.0.3-rc1
* Mon Aug 15 2011 Dave Jones <davej@redhat.com>
- Apply patches from 3.0.2
* Mon Aug 15 2011 Dave Jones <davej@redhat.com>
- CVE-2011-2905 perf tools may parse user-controlled config file. (rhbz 729809)

62
perf-check-ownership.patch Normal file
View File

@ -0,0 +1,62 @@
commit 069e3725dd9be3b759a98e8c80ac5fc38b392b23
Author: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Tue Aug 9 12:42:13 2011 -0300
perf tools: Check $HOME/.perfconfig ownership
Just like we do already for perf.data files.
Requested-by: Ingo Molnar <mingo@elte.hu>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Christian Ohm <chr.ohm@gmx.net>
Cc: David Ahern <dsahern@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jonathan Nieder <jrnieder@gmail.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lkml.kernel.org/n/tip-qgokmxsmvppwpc5404qhyk7e@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
index 6c86eca..fe02903 100644
--- a/tools/perf/util/config.c
+++ b/tools/perf/util/config.c
@@ -413,13 +413,32 @@ int perf_config(config_fn_t fn, void *data)
home = getenv("HOME");
if (perf_config_global() && home) {
char *user_config = strdup(mkpath("%s/.perfconfig", home));
- if (!access(user_config, R_OK)) {
- ret += perf_config_from_file(fn, user_config, data);
- found += 1;
+ struct stat st;
+
+ if (user_config == NULL) {
+ warning("Not enough memory to process %s/.perfconfig, "
+ "ignoring it.", home);
+ goto out;
+ }
+
+ if (stat(user_config, &st) < 0)
+ goto out_free;
+
+ if (st.st_uid && (st.st_uid != geteuid())) {
+ warning("File %s not owned by current user or root, "
+ "ignoring it.", user_config);
+ goto out_free;
}
+
+ if (!st.st_size)
+ goto out_free;
+
+ ret += perf_config_from_file(fn, user_config, data);
+ found += 1;
+out_free:
free(user_config);
}
-
+out:
if (found == 0)
return -1;
return ret;

1
sources
View File

@ -1,3 +1,4 @@
1aab7a741abe08d42e8eccf20de61e05 linux-2.6.39.tar.bz2
df5790b51f218fc5e5463162b26afbfc patch-3.0.bz2
f5743283e6075282cebfbde62e65240b patch-3.0.2.bz2
23b4aad2d34ea209f62b199e67a88240 patch-3.0.3-rc1.gz