Update to 4.20.12-2

4 files changed, 58 insertions, 5 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 389fb623766b..e172f10d13e8 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,8 +1,8 @@
 # Generated by mksrcinfo v8
-# Sat Feb 23 11:08:41 UTC 2019
+# Sat Feb 23 11:15:07 UTC 2019
 pkgbase = linux-ck
 	pkgver = 4.20.12
-	pkgrel = 1
+	pkgrel = 2
 	url = https://wiki.archlinux.org/index.php/Linux-ck
 	arch = x86_64
 	license = GPL2
@@ -20,7 +20,8 @@ pkgbase = linux-ck
 	source = enable_additional_cpu_optimizations-20180509.tar.gz::https://github.com/graysky2/kernel_gcc_patch/archive/20180509.tar.gz
 	source = http://ck.kolivas.org/patches/4.0/4.20/4.20-ck1/patch-4.20-ck1.xz
 	source = 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-	source = 0002-unfuck-ck1-for-kvm-intel-symbol.patch
+	source = 0002-exec-Fix-mem-leak-in-kernel_read_file.patch
+	source = 0003-unfuck-ck1-for-kvm-intel-symbol.patch
 	sha256sums = 1cf544308195250805e0731c716691bea4c1ed29e03e6f9ae5be6dc16785a504
 	sha256sums = SKIP
 	sha256sums = 4ff10c16fa729f808e812e3ff53ef8087ab9c220c84d860676d3bfb5c1c63c5d
@@ -30,6 +31,7 @@ pkgbase = linux-ck
 	sha256sums = 226e30068ea0fecdb22f337391385701996bfbdba37cdcf0f1dbf55f1080542d
 	sha256sums = 4bd614333fcbe509118b5362889f76d241e1d33e1ee691bd24fd82384ce7f2de
 	sha256sums = b6eea702f203632f12fa9edd4a38781d66498c20b1baedb23722537930b9a863
+	sha256sums = a8962ae10431de7c5eebe07a34fff5acd613904865dcabbcea03e8108d11b1fb
 	sha256sums = 3e8c7d3015bb593e8a861be0b2b9f1de74fcb25e00c6e3eacee3165c6bec6f64
 
 pkgname = linux-ck
diff --git a/0002-exec-Fix-mem-leak-in-kernel_read_file.patch b/0002-exec-Fix-mem-leak-in-kernel_read_file.patch
new file mode 100644
index 000000000000..bed047b765a2
--- /dev/null
+++ b/0002-exec-Fix-mem-leak-in-kernel_read_file.patch
@@ -0,0 +1,49 @@
+From 3096ba94fa87b22664baa91e71a55ce698bb8aed Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 19 Feb 2019 10:10:38 +0800
+Subject: [PATCH 2/3] exec: Fix mem leak in kernel_read_file
+
+syzkaller report this:
+BUG: memory leak
+unreferenced object 0xffffc9000488d000 (size 9195520):
+  comm "syz-executor.0", pid 2752, jiffies 4294787496 (age 18.757s)
+  hex dump (first 32 bytes):
+    ff ff ff ff ff ff ff ff a8 00 00 00 01 00 00 00  ................
+    02 00 00 00 00 00 00 00 80 a1 7a c1 ff ff ff ff  ..........z.....
+  backtrace:
+    [<000000000863775c>] __vmalloc_node mm/vmalloc.c:1795 [inline]
+    [<000000000863775c>] __vmalloc_node_flags mm/vmalloc.c:1809 [inline]
+    [<000000000863775c>] vmalloc+0x8c/0xb0 mm/vmalloc.c:1831
+    [<000000003f668111>] kernel_read_file+0x58f/0x7d0 fs/exec.c:924
+    [<000000002385813f>] kernel_read_file_from_fd+0x49/0x80 fs/exec.c:993
+    [<0000000011953ff1>] __do_sys_finit_module+0x13b/0x2a0 kernel/module.c:3895
+    [<000000006f58491f>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+    [<00000000ee78baf4>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+    [<00000000241f889b>] 0xffffffffffffffff
+
+It should goto 'out_free' lable to free allocated buf while kernel_read
+fails.
+
+Fixes: 39d637af5aa7 ("vfs: forbid write access when reading a file into memory")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+---
+ fs/exec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/exec.c b/fs/exec.c
+index fc281b738a98..20c33029a062 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -929,7 +929,7 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size,
+ 		bytes = kernel_read(file, *buf + pos, i_size - pos, &pos);
+ 		if (bytes < 0) {
+ 			ret = bytes;
+-			goto out;
++			goto out_free;
+ 		}
+ 
+ 		if (bytes == 0)
+-- 
+2.20.1
+
diff --git a/0002-unfuck-ck1-for-kvm-intel-symbol.patch b/0003-unfuck-ck1-for-kvm-intel-symbol.patch
index fd8568a24ab4..fd8568a24ab4 100644
--- a/0002-unfuck-ck1-for-kvm-intel-symbol.patch
+++ b/0003-unfuck-ck1-for-kvm-intel-symbol.patch
diff --git a/PKGBUILD b/PKGBUILD
index d0c894c8acb6..fa1def81850a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -63,7 +63,7 @@ _localmodcfg=
 pkgbase=linux-ck
 _srcver=4.20.12-arch1
 pkgver=${_srcver%-*}
-pkgrel=1
+pkgrel=2
 _ckpatchversion=1
 arch=(x86_64)
 url="https://wiki.archlinux.org/index.php/Linux-ck"
@@ -81,7 +81,8 @@ source=(
   "enable_additional_cpu_optimizations-$_gcc_more_v.tar.gz::https://github.com/graysky2/kernel_gcc_patch/archive/$_gcc_more_v.tar.gz"
   "http://ck.kolivas.org/patches/4.0/4.20/4.20-ck${_ckpatchversion}/$_ckpatch.xz"
   0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-  0002-unfuck-ck1-for-kvm-intel-symbol.patch
+  0002-exec-Fix-mem-leak-in-kernel_read_file.patch
+  0003-unfuck-ck1-for-kvm-intel-symbol.patch
 )
 validpgpkeys=(
   'ABAF11C65A2970B130ABE3C479BE3E4300411886'  # Linus Torvalds
@@ -96,6 +97,7 @@ sha256sums=('1cf544308195250805e0731c716691bea4c1ed29e03e6f9ae5be6dc16785a504'
             '226e30068ea0fecdb22f337391385701996bfbdba37cdcf0f1dbf55f1080542d'
             '4bd614333fcbe509118b5362889f76d241e1d33e1ee691bd24fd82384ce7f2de'
             'b6eea702f203632f12fa9edd4a38781d66498c20b1baedb23722537930b9a863'
+            'a8962ae10431de7c5eebe07a34fff5acd613904865dcabbcea03e8108d11b1fb'
             '3e8c7d3015bb593e8a861be0b2b9f1de74fcb25e00c6e3eacee3165c6bec6f64')
 
 _kernelname=${pkgbase#linux}