[linux] 01/01: Update to 4.9.25
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Thu Apr 27 18:33:19 UTC 2017
This is an automated email from the git hooks/post-receive script.
carnil pushed a commit to branch sid
in repository linux.
commit 4c666bd4dae212549d67761e2be87c26d1178339
Author: Salvatore Bonaccorso <carnil at debian.org>
Date: Thu Apr 27 19:42:52 2017 +0200
Update to 4.9.25
---
debian/changelog | 32 +++-
...ow-keyrings-beginning-with-.-to-be-joined.patch | 76 ---------
...yctl_set_reqkey_keyring-to-not-leak-threa.patch | 174 ---------------------
debian/patches/series | 2 -
4 files changed, 27 insertions(+), 257 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index 2256323..dde1a0b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-linux (4.9.24-1) UNRELEASED; urgency=medium
+linux (4.9.25-1) UNRELEASED; urgency=medium
* New upstream stable update:
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.19
@@ -301,6 +301,32 @@ linux (4.9.24-1) UNRELEASED; urgency=medium
- dvb-usb-firmware: don't do DMA on stack (CVE-2017-8061)
- cxusb: Use a dma capable buffer also for reading (CVE-2017-8063)
- virtio-console: avoid DMA from stack (CVE-2017-8067)
+ https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.25
+ - KEYS: Disallow keyrings beginning with '.' to be joined as session
+ keyrings (CVE-2016-9604)
+ - KEYS: Change the name of the dead type to ".dead" to prevent user access
+ (CVE-2017-6951)
+ - KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
+ (CVE-2017-7472)
+ - tracing: Allocate the snapshot buffer before enabling probe
+ - ring-buffer: Have ring_buffer_iter_empty() return true when empty
+ - mm: prevent NR_ISOLATE_* stats from going negative
+ - cifs: Do not send echoes before Negotiate is complete
+ - CIFS: remove bad_network_name flag
+ - [s390x] mm: fix CMMA vs KSM vs others
+ - Input: elantech - add Fujitsu Lifebook E547 to force crc_enabled
+ - ACPI / power: Avoid maybe-uninitialized warning
+ - [armhf] mmc: sdhci-esdhc-imx: increase the pad I/O drive strength for
+ DDR50 card
+ - ubifs: Fix RENAME_WHITEOUT support
+ - ubifs: Fix O_TMPFILE corner case in ubifs_link()
+ - mac80211: reject ToDS broadcast data frames
+ - mac80211: fix MU-MIMO follow-MAC mode
+ - ubi/upd: Always flush after prepared for an update
+ - [powerpc*] kprobe: Fix oops when kprobed on 'stdu' instruction
+ - [x86] mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs
+ - [x86] mce: Make the MCE notifier a blocking one
+ - device-dax: switch to srcu, fix rcu_read_lock() vs pte allocation
[ Ben Hutchings ]
* w1: Really enable W1_MASTER_GPIO as module (Closes: #858975)
@@ -328,10 +354,6 @@ linux (4.9.24-1) UNRELEASED; urgency=medium
- rtmutex: Provide rt_mutex_lock_state()
- rtmutex: Provide locked slowpath
- rwsem/rt: Lift single reader restriction
- * KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings
- (CVE-2016-9604)
- * KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
- (CVE-2017-7472)
* PCI: Enable PCIE_PTM (except on armel/marvell)
* 6lowpan: Enable Generic Header Compression modules
* net/sched: Enable NET_ACT_SKBMOD as module
diff --git a/debian/patches/bugfix/all/keys-disallow-keyrings-beginning-with-.-to-be-joined.patch b/debian/patches/bugfix/all/keys-disallow-keyrings-beginning-with-.-to-be-joined.patch
deleted file mode 100644
index 2ce0055..0000000
--- a/debian/patches/bugfix/all/keys-disallow-keyrings-beginning-with-.-to-be-joined.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From: David Howells <dhowells at redhat.com>
-Date: Tue, 18 Apr 2017 15:31:07 +0100
-Subject: KEYS: Disallow keyrings beginning with '.' to be joined as session
- keyrings
-Origin: https://git.kernel.org/linus/ee8f844e3c5a73b999edf733df1c529d6503ec2f
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2016-9604
-
-This fixes CVE-2016-9604.
-
-Keyrings whose name begin with a '.' are special internal keyrings and so
-userspace isn't allowed to create keyrings by this name to prevent
-shadowing. However, the patch that added the guard didn't fix
-KEYCTL_JOIN_SESSION_KEYRING. Not only can that create dot-named keyrings,
-it can also subscribe to them as a session keyring if they grant SEARCH
-permission to the user.
-
-This, for example, allows a root process to set .builtin_trusted_keys as
-its session keyring, at which point it has full access because now the
-possessor permissions are added. This permits root to add extra public
-keys, thereby bypassing module verification.
-
-This also affects kexec and IMA.
-
-This can be tested by (as root):
-
- keyctl session .builtin_trusted_keys
- keyctl add user a a @s
- keyctl list @s
-
-which on my test box gives me:
-
- 2 keys in keyring:
- 180010936: ---lswrv 0 0 asymmetric: Build time autogenerated kernel key: ae3d4a31b82daa8e1a75b49dc2bba949fd992a05
- 801382539: --alswrv 0 0 user: a
-
-
-Fix this by rejecting names beginning with a '.' in the keyctl.
-
-Signed-off-by: David Howells <dhowells at redhat.com>
-Acked-by: Mimi Zohar <zohar at linux.vnet.ibm.com>
-cc: linux-ima-devel at lists.sourceforge.net
-cc: stable at vger.kernel.org
----
- security/keys/keyctl.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
---- a/security/keys/keyctl.c
-+++ b/security/keys/keyctl.c
-@@ -271,7 +271,8 @@ error:
- * Create and join an anonymous session keyring or join a named session
- * keyring, creating it if necessary. A named session keyring must have Search
- * permission for it to be joined. Session keyrings without this permit will
-- * be skipped over.
-+ * be skipped over. It is not permitted for userspace to create or join
-+ * keyrings whose name begin with a dot.
- *
- * If successful, the ID of the joined session keyring will be returned.
- */
-@@ -288,12 +289,16 @@ long keyctl_join_session_keyring(const c
- ret = PTR_ERR(name);
- goto error;
- }
-+
-+ ret = -EPERM;
-+ if (name[0] == '.')
-+ goto error_name;
- }
-
- /* join the session */
- ret = join_session_keyring(name);
-+error_name:
- kfree(name);
--
- error:
- return ret;
- }
diff --git a/debian/patches/bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch b/debian/patches/bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch
deleted file mode 100644
index 3b9eeb8..0000000
--- a/debian/patches/bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch
+++ /dev/null
@@ -1,174 +0,0 @@
-From: Eric Biggers <ebiggers at google.com>
-Date: Tue, 18 Apr 2017 15:31:09 +0100
-Subject: KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
-Origin: https://git.kernel.org/linus/c9f838d104fed6f2f61d68164712e3204bf5271b
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-7472
-
-This fixes CVE-2017-7472.
-
-Running the following program as an unprivileged user exhausts kernel
-memory by leaking thread keyrings:
-
- #include <keyutils.h>
-
- int main()
- {
- for (;;)
- keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);
- }
-
-Fix it by only creating a new thread keyring if there wasn't one before.
-To make things more consistent, make install_thread_keyring_to_cred()
-and install_process_keyring_to_cred() both return 0 if the corresponding
-keyring is already present.
-
-Fixes: d84f4f992cbd ("CRED: Inaugurate COW credentials")
-Cc: stable at vger.kernel.org # 2.6.29+
-Signed-off-by: Eric Biggers <ebiggers at google.com>
-Signed-off-by: David Howells <dhowells at redhat.com>
----
- security/keys/keyctl.c | 11 ++++-------
- security/keys/process_keys.c | 44 +++++++++++++++++++++++++++-----------------
- 2 files changed, 31 insertions(+), 24 deletions(-)
-
---- a/security/keys/keyctl.c
-+++ b/security/keys/keyctl.c
-@@ -1256,8 +1256,8 @@ error:
- * Read or set the default keyring in which request_key() will cache keys and
- * return the old setting.
- *
-- * If a process keyring is specified then this will be created if it doesn't
-- * yet exist. The old setting will be returned if successful.
-+ * If a thread or process keyring is specified then it will be created if it
-+ * doesn't yet exist. The old setting will be returned if successful.
- */
- long keyctl_set_reqkey_keyring(int reqkey_defl)
- {
-@@ -1282,11 +1282,8 @@ long keyctl_set_reqkey_keyring(int reqke
-
- case KEY_REQKEY_DEFL_PROCESS_KEYRING:
- ret = install_process_keyring_to_cred(new);
-- if (ret < 0) {
-- if (ret != -EEXIST)
-- goto error;
-- ret = 0;
-- }
-+ if (ret < 0)
-+ goto error;
- goto set;
-
- case KEY_REQKEY_DEFL_DEFAULT:
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -127,13 +127,18 @@ error:
- }
-
- /*
-- * Install a fresh thread keyring directly to new credentials. This keyring is
-- * allowed to overrun the quota.
-+ * Install a thread keyring to the given credentials struct if it didn't have
-+ * one already. This is allowed to overrun the quota.
-+ *
-+ * Return: 0 if a thread keyring is now present; -errno on failure.
- */
- int install_thread_keyring_to_cred(struct cred *new)
- {
- struct key *keyring;
-
-+ if (new->thread_keyring)
-+ return 0;
-+
- keyring = keyring_alloc("_tid", new->uid, new->gid, new,
- KEY_POS_ALL | KEY_USR_VIEW,
- KEY_ALLOC_QUOTA_OVERRUN,
-@@ -146,7 +151,9 @@ int install_thread_keyring_to_cred(struc
- }
-
- /*
-- * Install a fresh thread keyring, discarding the old one.
-+ * Install a thread keyring to the current task if it didn't have one already.
-+ *
-+ * Return: 0 if a thread keyring is now present; -errno on failure.
- */
- static int install_thread_keyring(void)
- {
-@@ -157,8 +164,6 @@ static int install_thread_keyring(void)
- if (!new)
- return -ENOMEM;
-
-- BUG_ON(new->thread_keyring);
--
- ret = install_thread_keyring_to_cred(new);
- if (ret < 0) {
- abort_creds(new);
-@@ -169,17 +174,17 @@ static int install_thread_keyring(void)
- }
-
- /*
-- * Install a process keyring directly to a credentials struct.
-+ * Install a process keyring to the given credentials struct if it didn't have
-+ * one already. This is allowed to overrun the quota.
- *
-- * Returns -EEXIST if there was already a process keyring, 0 if one installed,
-- * and other value on any other error
-+ * Return: 0 if a process keyring is now present; -errno on failure.
- */
- int install_process_keyring_to_cred(struct cred *new)
- {
- struct key *keyring;
-
- if (new->process_keyring)
-- return -EEXIST;
-+ return 0;
-
- keyring = keyring_alloc("_pid", new->uid, new->gid, new,
- KEY_POS_ALL | KEY_USR_VIEW,
-@@ -193,11 +198,9 @@ int install_process_keyring_to_cred(stru
- }
-
- /*
-- * Make sure a process keyring is installed for the current process. The
-- * existing process keyring is not replaced.
-+ * Install a process keyring to the current task if it didn't have one already.
- *
-- * Returns 0 if there is a process keyring by the end of this function, some
-- * error otherwise.
-+ * Return: 0 if a process keyring is now present; -errno on failure.
- */
- static int install_process_keyring(void)
- {
-@@ -211,14 +214,18 @@ static int install_process_keyring(void)
- ret = install_process_keyring_to_cred(new);
- if (ret < 0) {
- abort_creds(new);
-- return ret != -EEXIST ? ret : 0;
-+ return ret;
- }
-
- return commit_creds(new);
- }
-
- /*
-- * Install a session keyring directly to a credentials struct.
-+ * Install the given keyring as the session keyring of the given credentials
-+ * struct, replacing the existing one if any. If the given keyring is NULL,
-+ * then install a new anonymous session keyring.
-+ *
-+ * Return: 0 on success; -errno on failure.
- */
- int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
- {
-@@ -253,8 +260,11 @@ int install_session_keyring_to_cred(stru
- }
-
- /*
-- * Install a session keyring, discarding the old one. If a keyring is not
-- * supplied, an empty one is invented.
-+ * Install the given keyring as the session keyring of the current task,
-+ * replacing the existing one if any. If the given keyring is NULL, then
-+ * install a new anonymous session keyring.
-+ *
-+ * Return: 0 on success; -errno on failure.
- */
- static int install_session_keyring(struct key *keyring)
- {
diff --git a/debian/patches/series b/debian/patches/series
index 47b1db7..4ec0541 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -108,8 +108,6 @@ debian/time-mark-timer_stats-as-broken.patch
bugfix/all/net-packet-fix-overflow-in-check-for-tp_frame_nr.patch
bugfix/all/net-packet-fix-overflow-in-check-for-tp_reserve.patch
bugfix/all/ping-implement-proper-locking.patch
-bugfix/all/keys-disallow-keyrings-beginning-with-.-to-be-joined.patch
-bugfix/all/keys-fix-keyctl_set_reqkey_keyring-to-not-leak-threa.patch
bugfix/all/macsec-avoid-heap-overflow-in-skb_to_sgvec.patch
bugfix/all/macsec-dynamically-allocate-space-for-sglist.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list