Author: benh
Date: Tue Aug 4 23:37:34 2015
New Revision: 22932
Log:
Merge changes from jessie-security up to 3.16.7-ckt11-1+deb8u3
Added:
dists/jessie/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
- copied unchanged from r22928, dists/jessie-security/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
dists/jessie/linux/debian/patches/bugfix/all/md-use-kzalloc-when-bitmap-is-disabled.patch
- copied unchanged from r22928, dists/jessie-security/linux/debian/patches/bugfix/all/md-use-kzalloc-when-bitmap-is-disabled.patch
dists/jessie/linux/debian/patches/bugfix/all/sg_start_req-make-sure-that-there-s-not-too-many-ele.patch
- copied unchanged from r22928, dists/jessie-security/linux/debian/patches/bugfix/all/sg_start_req-make-sure-that-there-s-not-too-many-ele.patch
Modified:
dists/jessie/linux/ (props changed)
dists/jessie/linux/debian/changelog
dists/jessie/linux/debian/patches/series
Modified: dists/jessie/linux/debian/changelog
==============================================================================
--- dists/jessie/linux/debian/changelog Tue Aug 4 23:34:34 2015 (r22931)
+++ dists/jessie/linux/debian/changelog Tue Aug 4 23:37:34 2015 (r22932)
@@ -476,6 +476,19 @@
-- Ben Hutchings <ben at decadent.org.uk> Tue, 26 May 2015 01:42:36 +0100
+linux (3.16.7-ckt11-1+deb8u3) jessie-security; urgency=high
+
+ * path_openat(): fix double fput() (CVE-2015-5706)
+ * KEYS: ensure we free the assoc array edit if edit is valid (CVE-2015-1333)
+ * sctp: fix ASCONF list handling (CVE-2015-3212)
+ * [x86] kvm: fix kvm_apic_has_events to check for NULL pointer (CVE-2015-4692)
+ * [x86] bpf_jit: fix compilation of large bpf programs (CVE-2015-4700)
+ * sg_start_req(): make sure that there's not too many elements in iovec
+ (CVE-2015-5707)
+ * md: use kzalloc() when bitmap is disabled (CVE-2015-5697)
+
+ -- Ben Hutchings <ben at decadent.org.uk> Tue, 04 Aug 2015 01:50:04 +0100
+
linux (3.16.7-ckt11-1+deb8u2) jessie-security; urgency=high
* [amd64] Restore "perf/x86: Further optimize copy_from_user_nmi()"
Copied: dists/jessie/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch (from r22928, dists/jessie-security/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/jessie/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch Tue Aug 4 23:37:34 2015 (r22932, copy of r22928, dists/jessie-security/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch)
@@ -0,0 +1,37 @@
+From: Colin Ian King <colin.king at canonical.com>
+Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid
+Origin: https://marc.info/?l=oss-security&m=143800676725867&w=2
+
+__key_link_end is not freeing the associated array edit structure
+and this leads to a 512 byte memory leak each time an identical
+existing key is added with add_key().
+
+The reason the add_key() system call returns okay is that
+key_create_or_update() calls __key_link_begin() before checking to see
+whether it can update a key directly rather than adding/replacing - which
+it turns out it can. Thus __key_link() is not called through
+__key_instantiate_and_link() and __key_link_end() must cancel the edit.
+
+CVE-2015-1333
+
+Signed-off-by: Colin Ian King <colin.king at canonical.com>
+Signed-off-by: David Howells <dhowells at redhat.com>
+---
+
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -1152,9 +1152,11 @@ void __key_link_end(struct key *keyring,
+ if (index_key->type == &key_type_keyring)
+ up_write(&keyring_serialise_link_sem);
+
+- if (edit && !edit->dead_leaf) {
+- key_payload_reserve(keyring,
+- keyring->datalen - KEYQUOTA_LINK_BYTES);
++ if (edit) {
++ if (!edit->dead_leaf) {
++ key_payload_reserve(keyring,
++ keyring->datalen - KEYQUOTA_LINK_BYTES);
++ }
+ assoc_array_cancel_edit(edit);
+ }
+ up_write(&keyring->sem);
Copied: dists/jessie/linux/debian/patches/bugfix/all/md-use-kzalloc-when-bitmap-is-disabled.patch (from r22928, dists/jessie-security/linux/debian/patches/bugfix/all/md-use-kzalloc-when-bitmap-is-disabled.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/jessie/linux/debian/patches/bugfix/all/md-use-kzalloc-when-bitmap-is-disabled.patch Tue Aug 4 23:37:34 2015 (r22932, copy of r22928, dists/jessie-security/linux/debian/patches/bugfix/all/md-use-kzalloc-when-bitmap-is-disabled.patch)
@@ -0,0 +1,42 @@
+From: Benjamin Randazzo <benjamin at randazzo.fr>
+Date: Sat, 25 Jul 2015 16:36:50 +0200
+Subject: md: use kzalloc() when bitmap is disabled
+Origin: http://git.neil.brown.name/?p=md.git;a=commit;h=77ba0569d4c8389c0a2162ab0c7c16a6f3b199e4
+
+In drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a
+mdu_bitmap_file_t called "file".
+
+5769 file = kmalloc(sizeof(*file), GFP_NOIO);
+5770 if (!file)
+5771 return -ENOMEM;
+
+This structure is copied to user space at the end of the function.
+
+5786 if (err == 0 &&
+5787 copy_to_user(arg, file, sizeof(*file)))
+5788 err = -EFAULT
+
+But if bitmap is disabled only the first byte of "file" is initialized
+with zero, so it's possible to read some bytes (up to 4095) of kernel
+space memory from user space. This is an information leak.
+
+5775 /* bitmap disabled, zero the first byte and copy out */
+5776 if (!mddev->bitmap_info.file)
+5777 file->pathname[0] = '\0';
+
+Signed-off-by: Benjamin Randazzo <benjamin at randazzo.fr>
+Signed-off-by: NeilBrown <neilb at suse.com>
+[bwh: Backported to 3.16: don't touch anything but the allocation call, as
+ the following code is significantly different here.]
+---
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5624,7 +5624,7 @@ static int get_bitmap_file(struct mddev
+ char *ptr, *buf = NULL;
+ int err = -ENOMEM;
+
+- file = kmalloc(sizeof(*file), GFP_NOIO);
++ file = kzalloc(sizeof(*file), GFP_NOIO);
+
+ if (!file)
+ goto out;
Copied: dists/jessie/linux/debian/patches/bugfix/all/sg_start_req-make-sure-that-there-s-not-too-many-ele.patch (from r22928, dists/jessie-security/linux/debian/patches/bugfix/all/sg_start_req-make-sure-that-there-s-not-too-many-ele.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/jessie/linux/debian/patches/bugfix/all/sg_start_req-make-sure-that-there-s-not-too-many-ele.patch Tue Aug 4 23:37:34 2015 (r22932, copy of r22928, dists/jessie-security/linux/debian/patches/bugfix/all/sg_start_req-make-sure-that-there-s-not-too-many-ele.patch)
@@ -0,0 +1,34 @@
+From: Al Viro <viro at zeniv.linux.org.uk>
+Date: Sat, 21 Mar 2015 20:08:18 -0400
+Subject: sg_start_req(): make sure that there's not too many elements in iovec
+Origin: https://git.kernel.org/linus/451a2886b6bf90e2fb378f7c46c655450fb96e81
+
+unfortunately, allowing an arbitrary 16bit value means a possibility of
+overflow in the calculation of total number of pages in bio_map_user_iov() -
+we rely on there being no more than PAGE_SIZE members of sum in the
+first loop there. If that sum wraps around, we end up allocating
+too small array of pointers to pages and it's easy to overflow it in
+the second loop.
+
+X-Coverup: TINC (and there's no lumber cartel either)
+Cc: stable at vger.kernel.org # way, way back
+Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
+[bwh: s/MAX_UIOVEC/UIO_MAXIOV/. This was fixed upstream by commit
+ fdc81f45e9f5 ("sg_start_req(): use import_iovec()"), but we don't have
+ that function.]
+---
+ drivers/scsi/sg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1693,6 +1693,9 @@ static int sg_start_req(Sg_request *srp,
+ md->from_user = 0;
+ }
+
++ if (unlikely(iov_count > UIO_MAXIOV))
++ return -EINVAL;
++
+ if (iov_count) {
+ int len, size = sizeof(struct sg_iovec) * iov_count;
+ struct iovec *iov;
Modified: dists/jessie/linux/debian/patches/series
==============================================================================
--- dists/jessie/linux/debian/patches/series Tue Aug 4 23:34:34 2015 (r22931)
+++ dists/jessie/linux/debian/patches/series Tue Aug 4 23:37:34 2015 (r22932)
@@ -634,3 +634,6 @@
bugfix/all/libata-add-ata_horkage_notrim.patch
bugfix/all/libata-force-disable-trim-for-supersspeed-s238.patch
bugfix/all/block-do-a-full-clone-when-splitting-discard-bios.patch
+bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
+bugfix/all/sg_start_req-make-sure-that-there-s-not-too-many-ele.patch
+bugfix/all/md-use-kzalloc-when-bitmap-is-disabled.patch