[kernel] r22863 - in dists/jessie-security/linux/debian: . patches patches/bugfix/all

[Ben Hutchings]

Author: benh
Date: Mon Jul 27 18:13:59 2015
New Revision: 22863

Log:
Add two security fixes

Added:
   dists/jessie-security/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
   dists/jessie-security/linux/debian/patches/bugfix/all/path_openat-fix-double-fput.patch
Modified:
   dists/jessie-security/linux/debian/changelog
   dists/jessie-security/linux/debian/patches/series

Modified: dists/jessie-security/linux/debian/changelog
==============================================================================
--- dists/jessie-security/linux/debian/changelog	Mon Jul 27 18:12:37 2015	(r22862)
+++ dists/jessie-security/linux/debian/changelog	Mon Jul 27 18:13:59 2015	(r22863)
@@ -1,3 +1,10 @@
+linux (3.16.7-ckt11-1+deb8u3) UNRELEASED; urgency=medium
+
+  * path_openat(): fix double fput()
+  * KEYS: ensure we free the assoc array edit if edit is valid (CVE-2015-1333)
+
+ -- Ben Hutchings <ben at decadent.org.uk>  Sun, 26 Jul 2015 20:37:03 +0100
+
 linux (3.16.7-ckt11-1+deb8u2) jessie-security; urgency=high
 
   * [amd64] Restore "perf/x86: Further optimize copy_from_user_nmi()"

Added: dists/jessie-security/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/jessie-security/linux/debian/patches/bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch	Mon Jul 27 18:13:59 2015	(r22863)
@@ -0,0 +1,37 @@
+From: Colin Ian King <colin.king at canonical.com>
+Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid
+Origin: https://marc.info/?l=oss-security&m=143800676725867&w=2
+
+__key_link_end is not freeing the associated array edit structure
+and this leads to a 512 byte memory leak each time an identical
+existing key is added with add_key().
+
+The reason the add_key() system call returns okay is that
+key_create_or_update() calls __key_link_begin() before checking to see
+whether it can update a key directly rather than adding/replacing - which
+it turns out it can.  Thus __key_link() is not called through
+__key_instantiate_and_link() and __key_link_end() must cancel the edit.
+
+CVE-2015-1333
+
+Signed-off-by: Colin Ian King <colin.king at canonical.com>
+Signed-off-by: David Howells <dhowells at redhat.com>
+---
+
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -1152,9 +1152,11 @@ void __key_link_end(struct key *keyring,
+ 	if (index_key->type == &key_type_keyring)
+ 		up_write(&keyring_serialise_link_sem);
+ 
+-	if (edit && !edit->dead_leaf) {
+-		key_payload_reserve(keyring,
+-				    keyring->datalen - KEYQUOTA_LINK_BYTES);
++	if (edit) {
++		if (!edit->dead_leaf) {
++			key_payload_reserve(keyring,
++				keyring->datalen - KEYQUOTA_LINK_BYTES);
++		}
+ 		assoc_array_cancel_edit(edit);
+ 	}
+ 	up_write(&keyring->sem);

Added: dists/jessie-security/linux/debian/patches/bugfix/all/path_openat-fix-double-fput.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/jessie-security/linux/debian/patches/bugfix/all/path_openat-fix-double-fput.patch	Mon Jul 27 18:13:59 2015	(r22863)
@@ -0,0 +1,41 @@
+From: Al Viro <viro at zeniv.linux.org.uk>
+Date: Fri, 8 May 2015 22:53:15 -0400
+Subject: path_openat(): fix double fput()
+Origin: http://kernel.ubuntu.com/git/ubuntu/linux.git/commit?id=bedf03d0b88db4de0b66a1ef81df4faec7a0ceb4
+
+commit f15133df088ecadd141ea1907f2c96df67c729f0 upstream.
+
+path_openat() jumps to the wrong place after do_tmpfile() - it has
+already done path_cleanup() (as part of path_lookupat() called by
+do_tmpfile()), so doing that again can lead to double fput().
+
+Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
+[ luis: backported to 3.16:
+  - adjusted context as 3.16 doesn't have path_cleanup() helper,
+    introduced by 893b7775a70e ("fs/namei.c: new helper (path_cleanup())") ]
+Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
+---
+ fs/namei.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/namei.c b/fs/namei.c
+index 19ac9c8..15fc3f5 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -3194,7 +3194,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
+ 
+ 	if (unlikely(file->f_flags & __O_TMPFILE)) {
+ 		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
+-		goto out;
++		goto out2;
+ 	}
+ 
+ 	error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base);
+@@ -3232,6 +3232,7 @@ out:
+ 		path_put(&nd->root);
+ 	if (base)
+ 		fput(base);
++out2:
+ 	if (!(opened & FILE_OPENED)) {
+ 		BUG_ON(!error);
+ 		put_filp(file);

Modified: dists/jessie-security/linux/debian/patches/series
==============================================================================
--- dists/jessie-security/linux/debian/patches/series	Mon Jul 27 18:12:37 2015	(r22862)
+++ dists/jessie-security/linux/debian/patches/series	Mon Jul 27 18:13:59 2015	(r22863)
@@ -633,3 +633,5 @@
 bugfix/x86/0007-x86-nmi-64-Improve-nested-NMI-comments.patch
 bugfix/x86/0008-x86-nmi-64-Reorder-nested-NMI-checks.patch
 bugfix/x86/0009-x86-nmi-64-Use-DF-to-avoid-userspace-RSP-confusing-n.patch
+bugfix/all/path_openat-fix-double-fput.patch
+bugfix/all/keys-ensure-we-free-the-assoc-array-edit-if-edit-is-valid.patch