[linux] 01/02: Drop partial mitigation for CVE-2013-4312
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Fri Feb 5 14:58:43 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch squeeze-security
in repository linux.
commit 8fe187a3d43d0abcf20861739821e23b6edaf95a
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Thu Feb 4 19:05:42 2016 +0000
Drop partial mitigation for CVE-2013-4312
It's not worth bothering with at this point.
---
debian/changelog | 1 -
...ly-account-for-FDs-passed-over-unix-socke.patch | 130 ---------------------
...unix-fix-abi-change-for-cve-2013-4312-fix.patch | 33 ------
debian/patches/features/all/openvz/openvz.patch | 8 +-
debian/patches/series/48squeeze19 | 2 -
5 files changed, 4 insertions(+), 170 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index a90edff..329fe34 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,7 +5,6 @@ linux-2.6 (2.6.32-48squeeze19) UNRELEASED; urgency=medium
* sctp: Prevent soft lockup when sctp_accept() is called during a timeout event
(CVE-2015-8767)
* tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) (CVE-2016-0723)
- * unix: properly account for FDs passed over unix sockets (CVE-2013-4312)
* Add stable release 2.6.32.70:
- ip6mr: call del_timer_sync() in ip6mr_free_table()
- sctp: translate host order to network order when setting a hmacid
diff --git a/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch b/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
deleted file mode 100644
index eae5ef7..0000000
--- a/debian/patches/bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From: willy tarreau <w at 1wt.eu>
-Date: Sun, 10 Jan 2016 07:54:56 +0100
-Subject: unix: properly account for FDs passed over unix sockets
-Origin: https://git.kernel.org/linus/712f4aad406bb1ed67f3f98d04c044191f0ff593
-
-It is possible for a process to allocate and accumulate far more FDs than
-the process' limit by sending them over a unix socket then closing them
-to keep the process' fd count low.
-
-This change addresses this problem by keeping track of the number of FDs
-in flight per user and preventing non-privileged processes from having
-more FDs in flight than their configured FD limit.
-
-Reported-by: socketpair at gmail.com
-Reported-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
-Mitigates: CVE-2013-4312 (Linux 2.0+)
-Suggested-by: Linus Torvalds <torvalds at linux-foundation.org>
-Acked-by: Hannes Frederic Sowa <hannes at stressinduktion.org>
-Signed-off-by: Willy Tarreau <w at 1wt.eu>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-[carnil: Backported to 3.16: adjust context]
-[bwh: Backported to 2.6.32: adjust context further]
----
- include/linux/sched.h | 1 +
- net/unix/af_unix.c | 24 ++++++++++++++++++++----
- net/unix/garbage.c | 13 ++++++++-----
- 3 files changed, 29 insertions(+), 9 deletions(-)
-
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -724,6 +724,7 @@ struct user_struct {
- unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
- #endif
- unsigned long locked_shm; /* How many pages of mlocked shm ? */
-+ unsigned long unix_inflight; /* How many files in flight in unix sockets */
-
- #ifdef CONFIG_KEYS
- struct key *uid_keyring; /* UID specific keyring */
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -1445,6 +1445,21 @@ static void unix_destruct_scm(struct sk_
- sock_wfree(skb);
- }
-
-+/*
-+ * The "user->unix_inflight" variable is protected by the garbage
-+ * collection lock, and we just read it locklessly here. If you go
-+ * over the limit, there might be a tiny race in actually noticing
-+ * it across threads. Tough.
-+ */
-+static inline bool too_many_unix_fds(struct task_struct *p)
-+{
-+ struct user_struct *user = current_user();
-+
-+ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
-+ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
-+ return false;
-+}
-+
- #define MAX_RECURSION_LEVEL 4
-
- static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
-@@ -1453,6 +1468,9 @@ static int unix_attach_fds(struct scm_co
- unsigned char max_level = 0;
- int unix_sock_count = 0;
-
-+ if (too_many_unix_fds(current))
-+ return -ETOOMANYREFS;
-+
- for (i = scm->fp->count - 1; i >= 0; i--) {
- struct sock *sk = unix_get_socket(scm->fp->fp[i]);
-
-@@ -1474,10 +1492,8 @@ static int unix_attach_fds(struct scm_co
- if (!UNIXCB(skb).fp)
- return -ENOMEM;
-
-- if (unix_sock_count) {
-- for (i = scm->fp->count - 1; i >= 0; i--)
-- unix_inflight(scm->fp->fp[i]);
-- }
-+ for (i = scm->fp->count - 1; i >= 0; i--)
-+ unix_inflight(scm->fp->fp[i]);
- skb->destructor = unix_destruct_fds;
- return max_level;
- }
---- a/net/unix/garbage.c
-+++ b/net/unix/garbage.c
-@@ -126,9 +126,11 @@ struct sock *unix_get_socket(struct file
- void unix_inflight(struct file *fp)
- {
- struct sock *s = unix_get_socket(fp);
-+
-+ spin_lock(&unix_gc_lock);
-+
- if (s) {
- struct unix_sock *u = unix_sk(s);
-- spin_lock(&unix_gc_lock);
- if (atomic_long_inc_return(&u->inflight) == 1) {
- BUG_ON(!list_empty(&u->link));
- list_add_tail(&u->link, &gc_inflight_list);
-@@ -136,22 +138,26 @@ void unix_inflight(struct file *fp)
- BUG_ON(list_empty(&u->link));
- }
- unix_tot_inflight++;
-- spin_unlock(&unix_gc_lock);
- }
-+ fp->f_cred->user->unix_inflight++;
-+ spin_unlock(&unix_gc_lock);
- }
-
- void unix_notinflight(struct file *fp)
- {
- struct sock *s = unix_get_socket(fp);
-+
-+ spin_lock(&unix_gc_lock);
-+
- if (s) {
- struct unix_sock *u = unix_sk(s);
-- spin_lock(&unix_gc_lock);
- BUG_ON(list_empty(&u->link));
- if (atomic_long_dec_and_test(&u->inflight))
- list_del_init(&u->link);
- unix_tot_inflight--;
-- spin_unlock(&unix_gc_lock);
- }
-+ fp->f_cred->user->unix_inflight--;
-+ spin_unlock(&unix_gc_lock);
- }
-
- static inline struct sk_buff *sock_queue_head(struct sock *sk)
diff --git a/debian/patches/debian/unix-fix-abi-change-for-cve-2013-4312-fix.patch b/debian/patches/debian/unix-fix-abi-change-for-cve-2013-4312-fix.patch
deleted file mode 100644
index 6c8a376..0000000
--- a/debian/patches/debian/unix-fix-abi-change-for-cve-2013-4312-fix.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: Ben Hutchings <ben at decadent.org.uk>
-Date: Sun, 17 Jan 2016 15:55:02 +0000
-Subject: unix: Fix ABI change for CVE-2013-4312
-Forwarded: not-needed
-
-The fix for CVE-2013-4312 added a new structure member,
-user_struct::unix_inflight. As this is always allocated in
-kernel/user.c and the new member is only used by af_unix which is also
-built-in, we can safely add new members at the end. So move it to the
-end and hide it from genksyms.
-
----
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -724,7 +724,6 @@ struct user_struct {
- unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
- #endif
- unsigned long locked_shm; /* How many pages of mlocked shm ? */
-- unsigned long unix_inflight; /* How many files in flight in unix sockets */
-
- #ifdef CONFIG_KEYS
- struct key *uid_keyring; /* UID specific keyring */
-@@ -739,6 +738,10 @@ struct user_struct {
- #ifdef CONFIG_PERF_EVENTS
- atomic_long_t locked_vm;
- #endif
-+
-+#ifndef __GENKSYMS__
-+ unsigned long unix_inflight; /* How many files in flight in unix sockets */
-+#endif
- };
-
- extern int uids_sysfs_init(void);
diff --git a/debian/patches/features/all/openvz/openvz.patch b/debian/patches/features/all/openvz/openvz.patch
index 2eaee87..ee8fb90 100644
--- a/debian/patches/features/all/openvz/openvz.patch
+++ b/debian/patches/features/all/openvz/openvz.patch
@@ -90366,8 +90366,8 @@ Date: Mon Feb 15 15:17:35 2010 +0300
}
+EXPORT_SYMBOL_GPL(unix_destruct_fds);
- /*
- * The "user->unix_inflight" variable is protected by the garbage
+ #define MAX_RECURSION_LEVEL 4
+
@@ -1547,6 +1558,16 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
size = len-sent;
@@ -90438,8 +90438,8 @@ index 19c17e4..686d373 100644
#include <net/sock.h>
#include <net/af_unix.h>
@@ -153,6 +154,7 @@ void unix_notinflight(struct file *fp)
- fp->f_cred->user->unix_inflight--;
- spin_unlock(&unix_gc_lock);
+ spin_unlock(&unix_gc_lock);
+ }
}
+EXPORT_SYMBOL_GPL(unix_notinflight);
diff --git a/debian/patches/series/48squeeze19 b/debian/patches/series/48squeeze19
index aab5052..e7fda20 100644
--- a/debian/patches/series/48squeeze19
+++ b/debian/patches/series/48squeeze19
@@ -1,8 +1,6 @@
+ bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
+ bugfix/all/sctp-prevent-soft-lockup-when-sctp_accept-is-called-.patch
+ bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
-+ bugfix/all/unix-properly-account-for-FDs-passed-over-unix-socke.patch
-+ debian/unix-fix-abi-change-for-cve-2013-4312-fix.patch
# Drop conflicting patch
- debian/af_unix-avoid-abi-changes.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list