[linux] 02/04: Update to 4.3-rc3

debian-kernel at lists.debian.org debian-kernel at lists.debian.org
Sun Sep 27 18:23:30 UTC 2015


This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch master
in repository linux.

commit 21444b88380bb39bd662ed886c5e71fe1d4257d9
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Sun Sep 27 18:36:09 2015 +0100

    Update to 4.3-rc3
---
 debian/changelog                                   |   2 +-
 ...fix-race-on-protocol-netns-initialization.patch | 227 ---------------------
 ...iteheat-fix-potential-null-deref-at-probe.patch |  79 -------
 debian/patches/series                              |   2 -
 4 files changed, 1 insertion(+), 309 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index eabf4ba..28c0397 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-linux (4.3~rc2-1~exp1) UNRELEASED; urgency=medium
+linux (4.3~rc3-1~exp1) UNRELEASED; urgency=medium
 
   * New upstream release candidate
 
diff --git a/debian/patches/bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch b/debian/patches/bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch
deleted file mode 100644
index 8d4385b..0000000
--- a/debian/patches/bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch
+++ /dev/null
@@ -1,227 +0,0 @@
-From: Marcelo Ricardo Leitner <marcelo.leitner at gmail.com>
-Date: Thu, 10 Sep 2015 17:31:15 -0300
-Subject: sctp: fix race on protocol/netns initialization
-Origin: https://git.kernel.org/linus/8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4
-
-Consider sctp module is unloaded and is being requested because an user
-is creating a sctp socket.
-
-During initialization, sctp will add the new protocol type and then
-initialize pernet subsys:
-
-        status = sctp_v4_protosw_init();
-        if (status)
-                goto err_protosw_init;
-
-        status = sctp_v6_protosw_init();
-        if (status)
-                goto err_v6_protosw_init;
-
-        status = register_pernet_subsys(&sctp_net_ops);
-
-The problem is that after those calls to sctp_v{4,6}_protosw_init(), it
-is possible for userspace to create SCTP sockets like if the module is
-already fully loaded. If that happens, one of the possible effects is
-that we will have readers for net->sctp.local_addr_list list earlier
-than expected and sctp_net_init() does not take precautions while
-dealing with that list, leading to a potential panic but not limited to
-that, as sctp_sock_init() will copy a bunch of blank/partially
-initialized values from net->sctp.
-
-The race happens like this:
-
-     CPU 0                           |  CPU 1
-  socket()                           |
-   __sock_create                     | socket()
-    inet_create                      |  __sock_create
-     list_for_each_entry_rcu(        |
-        answer, &inetsw[sock->type], |
-        list) {                      |   inet_create
-      /* no hits */                  |
-     if (unlikely(err)) {            |
-      ...                            |
-      request_module()               |
-      /* socket creation is blocked  |
-       * the module is fully loaded  |
-       */                            |
-       sctp_init                     |
-        sctp_v4_protosw_init         |
-         inet_register_protosw       |
-          list_add_rcu(&p->list,     |
-                       last_perm);   |
-                                     |  list_for_each_entry_rcu(
-                                     |     answer, &inetsw[sock->type],
-        sctp_v6_protosw_init         |     list) {
-                                     |     /* hit, so assumes protocol
-                                     |      * is already loaded
-                                     |      */
-                                     |  /* socket creation continues
-                                     |   * before netns is initialized
-                                     |   */
-        register_pernet_subsys       |
-
-Simply inverting the initialization order between
-register_pernet_subsys() and sctp_v4_protosw_init() is not possible
-because register_pernet_subsys() will create a control sctp socket, so
-the protocol must be already visible by then. Deferring the socket
-creation to a work-queue is not good specially because we loose the
-ability to handle its errors.
-
-So, as suggested by Vlad, the fix is to split netns initialization in
-two moments: defaults and control socket, so that the defaults are
-already loaded by when we register the protocol, while control socket
-initialization is kept at the same moment it is today.
-
-Fixes: 4db67e808640 ("sctp: Make the address lists per network namespace")
-Signed-off-by: Vlad Yasevich <vyasevich at gmail.com>
-Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner at gmail.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
----
- net/sctp/protocol.c | 64 ++++++++++++++++++++++++++++++++++-------------------
- 1 file changed, 41 insertions(+), 23 deletions(-)
-
---- a/net/sctp/protocol.c
-+++ b/net/sctp/protocol.c
-@@ -1166,7 +1166,7 @@ static void sctp_v4_del_protocol(void)
- 	unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
- }
- 
--static int __net_init sctp_net_init(struct net *net)
-+static int __net_init sctp_defaults_init(struct net *net)
- {
- 	int status;
- 
-@@ -1259,12 +1259,6 @@ static int __net_init sctp_net_init(stru
- 
- 	sctp_dbg_objcnt_init(net);
- 
--	/* Initialize the control inode/socket for handling OOTB packets.  */
--	if ((status = sctp_ctl_sock_init(net))) {
--		pr_err("Failed to initialize the SCTP control sock\n");
--		goto err_ctl_sock_init;
--	}
--
- 	/* Initialize the local address list. */
- 	INIT_LIST_HEAD(&net->sctp.local_addr_list);
- 	spin_lock_init(&net->sctp.local_addr_lock);
-@@ -1280,9 +1274,6 @@ static int __net_init sctp_net_init(stru
- 
- 	return 0;
- 
--err_ctl_sock_init:
--	sctp_dbg_objcnt_exit(net);
--	sctp_proc_exit(net);
- err_init_proc:
- 	cleanup_sctp_mibs(net);
- err_init_mibs:
-@@ -1291,15 +1282,12 @@ err_sysctl_register:
- 	return status;
- }
- 
--static void __net_exit sctp_net_exit(struct net *net)
-+static void __net_exit sctp_defaults_exit(struct net *net)
- {
- 	/* Free the local address list */
- 	sctp_free_addr_wq(net);
- 	sctp_free_local_addr_list(net);
- 
--	/* Free the control endpoint.  */
--	inet_ctl_sock_destroy(net->sctp.ctl_sock);
--
- 	sctp_dbg_objcnt_exit(net);
- 
- 	sctp_proc_exit(net);
-@@ -1307,9 +1295,32 @@ static void __net_exit sctp_net_exit(str
- 	sctp_sysctl_net_unregister(net);
- }
- 
--static struct pernet_operations sctp_net_ops = {
--	.init = sctp_net_init,
--	.exit = sctp_net_exit,
-+static struct pernet_operations sctp_defaults_ops = {
-+	.init = sctp_defaults_init,
-+	.exit = sctp_defaults_exit,
-+};
-+
-+static int __net_init sctp_ctrlsock_init(struct net *net)
-+{
-+	int status;
-+
-+	/* Initialize the control inode/socket for handling OOTB packets.  */
-+	status = sctp_ctl_sock_init(net);
-+	if (status)
-+		pr_err("Failed to initialize the SCTP control sock\n");
-+
-+	return status;
-+}
-+
-+static void __net_init sctp_ctrlsock_exit(struct net *net)
-+{
-+	/* Free the control endpoint.  */
-+	inet_ctl_sock_destroy(net->sctp.ctl_sock);
-+}
-+
-+static struct pernet_operations sctp_ctrlsock_ops = {
-+	.init = sctp_ctrlsock_init,
-+	.exit = sctp_ctrlsock_exit,
- };
- 
- /* Initialize the universe into something sensible.  */
-@@ -1442,8 +1453,11 @@ static __init int sctp_init(void)
- 	sctp_v4_pf_init();
- 	sctp_v6_pf_init();
- 
--	status = sctp_v4_protosw_init();
-+	status = register_pernet_subsys(&sctp_defaults_ops);
-+	if (status)
-+		goto err_register_defaults;
- 
-+	status = sctp_v4_protosw_init();
- 	if (status)
- 		goto err_protosw_init;
- 
-@@ -1451,9 +1465,9 @@ static __init int sctp_init(void)
- 	if (status)
- 		goto err_v6_protosw_init;
- 
--	status = register_pernet_subsys(&sctp_net_ops);
-+	status = register_pernet_subsys(&sctp_ctrlsock_ops);
- 	if (status)
--		goto err_register_pernet_subsys;
-+		goto err_register_ctrlsock;
- 
- 	status = sctp_v4_add_protocol();
- 	if (status)
-@@ -1469,12 +1483,14 @@ out:
- err_v6_add_protocol:
- 	sctp_v4_del_protocol();
- err_add_protocol:
--	unregister_pernet_subsys(&sctp_net_ops);
--err_register_pernet_subsys:
-+	unregister_pernet_subsys(&sctp_ctrlsock_ops);
-+err_register_ctrlsock:
- 	sctp_v6_protosw_exit();
- err_v6_protosw_init:
- 	sctp_v4_protosw_exit();
- err_protosw_init:
-+	unregister_pernet_subsys(&sctp_defaults_ops);
-+err_register_defaults:
- 	sctp_v4_pf_exit();
- 	sctp_v6_pf_exit();
- 	sctp_sysctl_unregister();
-@@ -1507,12 +1523,14 @@ static __exit void sctp_exit(void)
- 	sctp_v6_del_protocol();
- 	sctp_v4_del_protocol();
- 
--	unregister_pernet_subsys(&sctp_net_ops);
-+	unregister_pernet_subsys(&sctp_ctrlsock_ops);
- 
- 	/* Free protosw registrations */
- 	sctp_v6_protosw_exit();
- 	sctp_v4_protosw_exit();
- 
-+	unregister_pernet_subsys(&sctp_defaults_ops);
-+
- 	/* Unregister with socket layer. */
- 	sctp_v6_pf_exit();
- 	sctp_v4_pf_exit();
diff --git a/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch b/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
deleted file mode 100644
index 4380958..0000000
--- a/debian/patches/bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Johan Hovold <johan at kernel.org>
-Date: Wed, 23 Sep 2015 11:41:42 -0700
-Subject: USB: whiteheat: fix potential null-deref at probe
-Origin: https://git.kernel.org/cgit/linux/kernel/git/gregkh/usb.git/commit?id=cbb4be652d374f64661137756b8f357a1827d6a4
-
-Fix potential null-pointer dereference at probe by making sure that the
-required endpoints are present.
-
-The whiteheat driver assumes there are at least five pairs of bulk
-endpoints, of which the final pair is used for the "command port". An
-attempt to bind to an interface with fewer bulk endpoints would
-currently lead to an oops.
-
-Fixes CVE-2015-5257.
-
-Reported-by: Moein Ghasemzadeh <moein at istuary.com>
-Cc: stable <stable at vger.kernel.org>
-Signed-off-by: Johan Hovold <johan at kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
----
- drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
-
-diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
-index 6c3734d..d3ea90b 100644
---- a/drivers/usb/serial/whiteheat.c
-+++ b/drivers/usb/serial/whiteheat.c
-@@ -80,6 +80,8 @@ static int  whiteheat_firmware_download(struct usb_serial *serial,
- static int  whiteheat_firmware_attach(struct usb_serial *serial);
- 
- /* function prototypes for the Connect Tech WhiteHEAT serial converter */
-+static int whiteheat_probe(struct usb_serial *serial,
-+				const struct usb_device_id *id);
- static int  whiteheat_attach(struct usb_serial *serial);
- static void whiteheat_release(struct usb_serial *serial);
- static int  whiteheat_port_probe(struct usb_serial_port *port);
-@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = {
- 	.description =		"Connect Tech - WhiteHEAT",
- 	.id_table =		id_table_std,
- 	.num_ports =		4,
-+	.probe =		whiteheat_probe,
- 	.attach =		whiteheat_attach,
- 	.release =		whiteheat_release,
- 	.port_probe =		whiteheat_port_probe,
-@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
- /*****************************************************************************
-  * Connect Tech's White Heat serial driver functions
-  *****************************************************************************/
-+
-+static int whiteheat_probe(struct usb_serial *serial,
-+				const struct usb_device_id *id)
-+{
-+	struct usb_host_interface *iface_desc;
-+	struct usb_endpoint_descriptor *endpoint;
-+	size_t num_bulk_in = 0;
-+	size_t num_bulk_out = 0;
-+	size_t min_num_bulk;
-+	unsigned int i;
-+
-+	iface_desc = serial->interface->cur_altsetting;
-+
-+	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
-+		endpoint = &iface_desc->endpoint[i].desc;
-+		if (usb_endpoint_is_bulk_in(endpoint))
-+			++num_bulk_in;
-+		if (usb_endpoint_is_bulk_out(endpoint))
-+			++num_bulk_out;
-+	}
-+
-+	min_num_bulk = COMMAND_PORT + 1;
-+	if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
-+		return -ENODEV;
-+
-+	return 0;
-+}
-+
- static int whiteheat_attach(struct usb_serial *serial)
- {
- 	struct usb_serial_port *command_port;
diff --git a/debian/patches/series b/debian/patches/series
index bc2e334..b02bbe4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -81,6 +81,4 @@ features/all/grsecurity/grsecurity-kconfig.patch
 #features/all/grsecurity/grsecurity-kbuild.patch
 features/all/grsecurity/grkernsec_perf_harden.patch
 
-bugfix/all/usb-whiteheat-fix-potential-null-deref-at-probe.patch
 bugfix/all/media-uvcvideo-disable-hardware-timestamps-by-defaul.patch
-bugfix/all/sctp-fix-race-on-protocol-netns-initialization.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git



More information about the Kernel-svn-changes mailing list