[kernel] r17308 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/bugfix/arm patches/series
Ben Hutchings
benh at alioth.debian.org
Sat May 7 03:13:12 UTC 2011
Author: benh
Date: Sat May 7 03:12:58 2011
New Revision: 17308
Log:
Cherry-pick security fixes from 2.6.38.6-rc1
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/can-add-missing-socket-check-in-can-bcm-release.patch
dists/sid/linux-2.6/debian/patches/bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
dists/sid/linux-2.6/debian/patches/bugfix/arm/arm-6891-1-prevent-heap-corruption-in-oabi-semtimedop.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/5
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Thu May 5 23:40:38 2011 (r17307)
+++ dists/sid/linux-2.6/debian/changelog Sat May 7 03:12:58 2011 (r17308)
@@ -38,6 +38,9 @@
- agp: Fix OOM and buffer overflow (CVE-2011-1746)
For the complete list of changes, see:
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38.5
+ * mpt2sas: Prevent heap overflows and unchecked reads
+ * [armel] Prevent heap corruption in OABI semtimedop
+ * can: Add missing socket check in can/bcm release
-- Ben Hutchings <ben at decadent.org.uk> Mon, 25 Apr 2011 02:15:23 +0100
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/can-add-missing-socket-check-in-can-bcm-release.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/can-add-missing-socket-check-in-can-bcm-release.patch Sat May 7 03:12:58 2011 (r17308)
@@ -0,0 +1,38 @@
+From c6914a6f261aca0c9f715f883a353ae7ff51fe83 Mon Sep 17 00:00:00 2001
+From: Dave Jones <davej at redhat.com>
+Date: Tue, 19 Apr 2011 20:36:59 -0700
+Subject: can: Add missing socket check in can/bcm release.
+
+From: Dave Jones <davej at redhat.com>
+
+commit c6914a6f261aca0c9f715f883a353ae7ff51fe83 upstream.
+
+We can get here with a NULL socket argument passed from userspace,
+so we need to handle it accordingly.
+
+Signed-off-by: Dave Jones <davej at redhat.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+---
+ net/can/bcm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -1427,9 +1427,14 @@ static int bcm_init(struct sock *sk)
+ static int bcm_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
+- struct bcm_sock *bo = bcm_sk(sk);
++ struct bcm_sock *bo;
+ struct bcm_op *op, *next;
+
++ if (sk == NULL)
++ return 0;
++
++ bo = bcm_sk(sk);
++
+ /* remove bcm_ops, timer, rx_unregister(), etc. */
+
+ unregister_netdevice_notifier(&bo->notifier);
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch Sat May 7 03:12:58 2011 (r17308)
@@ -0,0 +1,86 @@
+From a1f74ae82d133ebb2aabb19d181944b4e83e9960 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg at vsecurity.com>
+Date: Tue, 5 Apr 2011 12:45:59 -0400
+Subject: [SCSI] mpt2sas: prevent heap overflows and unchecked reads
+
+From: Dan Rosenberg <drosenberg at vsecurity.com>
+
+commit a1f74ae82d133ebb2aabb19d181944b4e83e9960 upstream.
+
+At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
+length values are used to copy data from userspace into heap buffers
+without bounds checking, allowing controllable heap corruption and
+subsequently privilege escalation.
+
+Additionally, user-supplied values are used to determine the size of a
+copy_to_user() as well as the offset into the buffer to be read, with no
+bounds checking, allowing users to read arbitrary kernel memory.
+
+Signed-off-by: Dan Rosenberg <drosenberg at vsecurity.com>
+Acked-by: Eric Moore <eric.moore at lsi.com>
+Signed-off-by: James Bottomley <James.Bottomley at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_ctl.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPT
+ goto out;
+ }
+
++ /* Check for overflow and wraparound */
++ if (karg.data_sge_offset * 4 > ioc->request_sz ||
++ karg.data_sge_offset > (UINT_MAX / 4)) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ /* copy in request message frame from user */
+ if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
+ printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
+@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg,
+ Mpi2DiagBufferPostReply_t *mpi_reply;
+ int rc, i;
+ u8 buffer_type;
+- unsigned long timeleft;
++ unsigned long timeleft, request_size, copy_size;
+ u16 smid;
+ u16 ioc_status;
+ u8 issue_reset = 0;
+@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg,
+ return -ENOMEM;
+ }
+
++ request_size = ioc->diag_buffer_sz[buffer_type];
++
+ if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
+ printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
+ "or bytes_to_read are not 4 byte aligned\n", ioc->name,
+@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg,
+ return -EINVAL;
+ }
+
++ if (karg.starting_offset > request_size)
++ return -EINVAL;
++
+ diag_data = (void *)(request_data + karg.starting_offset);
+ dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
+ "offset(%d), sz(%d)\n", ioc->name, __func__,
+ diag_data, karg.starting_offset, karg.bytes_to_read));
+
++ /* Truncate data on requests that are too large */
++ if ((diag_data + karg.bytes_to_read < diag_data) ||
++ (diag_data + karg.bytes_to_read > request_data + request_size))
++ copy_size = request_size - karg.starting_offset;
++ else
++ copy_size = karg.bytes_to_read;
++
+ if (copy_to_user((void __user *)uarg->diagnostic_data,
+- diag_data, karg.bytes_to_read)) {
++ diag_data, copy_size)) {
+ printk(MPT2SAS_ERR_FMT "%s: Unable to write "
+ "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
+ __func__, diag_data);
Added: dists/sid/linux-2.6/debian/patches/bugfix/arm/arm-6891-1-prevent-heap-corruption-in-oabi-semtimedop.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/arm/arm-6891-1-prevent-heap-corruption-in-oabi-semtimedop.patch Sat May 7 03:12:58 2011 (r17308)
@@ -0,0 +1,34 @@
+From 0f22072ab50cac7983f9660d33974b45184da4f9 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg at vsecurity.com>
+Date: Fri, 29 Apr 2011 15:48:07 +0100
+Subject: ARM: 6891/1: prevent heap corruption in OABI semtimedop
+
+From: Dan Rosenberg <drosenberg at vsecurity.com>
+
+commit 0f22072ab50cac7983f9660d33974b45184da4f9 upstream.
+
+When CONFIG_OABI_COMPAT is set, the wrapper for semtimedop does not
+bound the nsops argument. A sufficiently large value will cause an
+integer overflow in allocation size, followed by copying too much data
+into the allocated buffer. Fix this by restricting nsops to SEMOPM.
+Untested.
+
+Signed-off-by: Dan Rosenberg <drosenberg at vsecurity.com>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+---
+ arch/arm/kernel/sys_oabi-compat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/kernel/sys_oabi-compat.c
++++ b/arch/arm/kernel/sys_oabi-compat.c
+@@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int
+ long err;
+ int i;
+
+- if (nsops < 1)
++ if (nsops < 1 || nsops > SEMOPM)
+ return -EINVAL;
+ sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
+ if (!sops)
Modified: dists/sid/linux-2.6/debian/patches/series/5
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/5 Thu May 5 23:40:38 2011 (r17307)
+++ dists/sid/linux-2.6/debian/patches/series/5 Sat May 7 03:12:58 2011 (r17308)
@@ -11,3 +11,6 @@
- bugfix/s390/S390-pfault-fix-token-handling.patch
- bugfix/all/kconfig-Avoid-buffer-underrun-in-choice-input.patch
+ bugfix/all/stable/2.6.38.5.patch
++ bugfix/all/mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
++ bugfix/arm/arm-6891-1-prevent-heap-corruption-in-oabi-semtimedop.patch
++ bugfix/all/can-add-missing-socket-check-in-can-bcm-release.patch
More information about the Kernel-svn-changes
mailing list