diff options
| -rw-r--r-- | .SRCINFO | 12 | ||||
| -rw-r--r-- | PKGBUILD | 13 | ||||
| -rw-r--r-- | fix_race_condition_in_packet_set_ring.diff | 84 |
3 files changed, 8 insertions, 101 deletions
@@ -1,6 +1,6 @@ pkgbase = linux-bfq - pkgver = 4.8.13 - pkgrel = 2 + pkgver = 4.8.14 + pkgrel = 1 url = http://algo.ing.unimo.it arch = i686 arch = x86_64 @@ -11,8 +11,8 @@ pkgbase = linux-bfq options = !strip source = http://www.kernel.org/pub/linux/kernel/v4.x/linux-4.8.tar.xz source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.8.tar.sign - source = http://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.13.xz - source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.13.sign + source = http://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.14.xz + source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.14.sign source = http://algo.ing.unimo.it/people/paolo/disk_sched/patches/4.8.0-v8r4/0001-block-cgroups-kconfig-build-bits-for-BFQ-v7r11-4.8.0.patch source = http://algo.ing.unimo.it/people/paolo/disk_sched/patches/4.8.0-v8r4/0002-block-introduce-the-BFQ-v7r11-I-O-sched-to-be-ported.patch source = http://algo.ing.unimo.it/people/paolo/disk_sched/patches/4.8.0-v8r4/0003-block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r11-to-.patch @@ -23,7 +23,6 @@ pkgbase = linux-bfq source = config.x86_64 source = 99-linux.hook source = linux.preset - source = fix_race_condition_in_packet_set_ring.diff source = net_handle_no_dst_on_skb_in_icmp6_send.patch source = 0005-BFQ-Fix.patch source = 0006-BFQ-Fix.patch @@ -31,7 +30,7 @@ pkgbase = linux-bfq validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E sha512sums = a48a065f21e1c7c4de4cf8ca47b8b8d9a70f86b64e7cfa6e01be490f78895745b9c8790734b1d22182cf1f930fb87eaaa84e62ec8cc1f64ac4be9b949e7c0358 sha512sums = SKIP - sha512sums = ab8d664208a8749c29730cf66cdc4b76b450a879550cdb5dfffc24234c1825949ddaefe98d5105626f556ab8a90be557f859b633f4ce8eda2c190e13efe199ec + sha512sums = 374b849aac6736f3a8d7afd224d51a5f4bab5c0fefaa8738982bae7188687149b7775e53878efe25466b4c0d40769b284e8af55c1d3bae500bccdbf565c0453a sha512sums = SKIP sha512sums = 95a7b9dc5a6c378b19e199285b5c1c397ca0ca0cf03c42d185b57da68329e59d59294d1879998f4020a0dee10d36c550acf30f28970c82adb2e7604c86424178 sha512sums = dc0649dfe2a5ce8e8879a62df29a4a1959eb1a84e5d896a9cb119d6a85a9bad1b17135371799e0be96532e17c66043d298e4a14b18fad3078a1f425108f888c9 @@ -43,7 +42,6 @@ pkgbase = linux-bfq sha512sums = 94fbb7e67b77bb8911b69cdb23bbb74317e75a4ed786e4c6486bf2927042f9374e932ea879d1b250837e42c628abf7082fd6f895a2257c5d3ad652f6a520306a sha512sums = d6faa67f3ef40052152254ae43fee031365d0b1524aa0718b659eb75afc21a3f79ea8d62d66ea311a800109bed545bc8f79e8752319cd378eef2cbd3a09aba22 sha512sums = 2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf - sha512sums = fd5800dcc1b9e7825892dfaedf78d9b64f354695992c9a1b0014e66664c6f0f4c80989439df360c994aab03dc4aa1f4e3481f153a6b4383c9e39da93c8d235d0 sha512sums = c53bd47527adbd2599a583e05a7d24f930dc4e86b1de017486588205ad6f262a51a4551593bc7a1218c96541ea073ea03b770278d947b1cd0d2801311fcc80e5 sha512sums = 3889679e288d51f6fecc7ed6581ccde34acbf1e4861f5c9ca237a1ad13158502757d3fc457d7b6caf1c8c99c9dba842265004154a71cffb8ec14e1030e49e312 sha512sums = 3c3f3b6407d9a1a63cd91c2b5c35e6c932afa5bf33f1b2e8a530dbd9eacda8c8f956616c4cc9228657624da58e354ba5714252237d84ff3386fd65cf44f06ddc @@ -51,8 +51,8 @@ _use_current= pkgbase=linux-bfq # pkgname=('linux-bfq' 'linux-bfq-headers' 'linux-bfq-docs') _srcname=linux-4.8 -pkgver=4.8.13 -pkgrel=2 +pkgver=4.8.14 +pkgrel=1 arch=('i686' 'x86_64') url="http://algo.ing.unimo.it" license=('GPL2') @@ -80,7 +80,6 @@ source=("http://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.xz" '99-linux.hook' # standard config files for mkinitcpio ramdisk 'linux.preset' - 'fix_race_condition_in_packet_set_ring.diff' 'net_handle_no_dst_on_skb_in_icmp6_send.patch' # patches from https://github.com/linusw/linux-bfq/commits/bfq-v8 '0005-BFQ-Fix.patch' @@ -100,11 +99,6 @@ prepare() { # (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227) msg "Patching set DEFAULT_CONSOLE_LOGLEVEL to 4" patch -p1 -i "${srcdir}/change-default-console-loglevel.patch" - - ### fix a race condition that allows to gain root - # https://marc.info/?l=linux-netdev&m=148054660230570&w=2 - msg "Fix a race condition that allows to gain root" - patch -p1 -i "${srcdir}/fix_race_condition_in_packet_set_ring.diff" ### fix https://bugzilla.kernel.org/show_bug.cgi?id=189851 msg "Fix https://bugzilla.kernel.org/show_bug.cgi?id=189851" @@ -455,7 +449,7 @@ done sha512sums=('a48a065f21e1c7c4de4cf8ca47b8b8d9a70f86b64e7cfa6e01be490f78895745b9c8790734b1d22182cf1f930fb87eaaa84e62ec8cc1f64ac4be9b949e7c0358' 'SKIP' - 'ab8d664208a8749c29730cf66cdc4b76b450a879550cdb5dfffc24234c1825949ddaefe98d5105626f556ab8a90be557f859b633f4ce8eda2c190e13efe199ec' + '374b849aac6736f3a8d7afd224d51a5f4bab5c0fefaa8738982bae7188687149b7775e53878efe25466b4c0d40769b284e8af55c1d3bae500bccdbf565c0453a' 'SKIP' '95a7b9dc5a6c378b19e199285b5c1c397ca0ca0cf03c42d185b57da68329e59d59294d1879998f4020a0dee10d36c550acf30f28970c82adb2e7604c86424178' 'dc0649dfe2a5ce8e8879a62df29a4a1959eb1a84e5d896a9cb119d6a85a9bad1b17135371799e0be96532e17c66043d298e4a14b18fad3078a1f425108f888c9' @@ -467,7 +461,6 @@ sha512sums=('a48a065f21e1c7c4de4cf8ca47b8b8d9a70f86b64e7cfa6e01be490f78895745b9c '94fbb7e67b77bb8911b69cdb23bbb74317e75a4ed786e4c6486bf2927042f9374e932ea879d1b250837e42c628abf7082fd6f895a2257c5d3ad652f6a520306a' 'd6faa67f3ef40052152254ae43fee031365d0b1524aa0718b659eb75afc21a3f79ea8d62d66ea311a800109bed545bc8f79e8752319cd378eef2cbd3a09aba22' '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf' - 'fd5800dcc1b9e7825892dfaedf78d9b64f354695992c9a1b0014e66664c6f0f4c80989439df360c994aab03dc4aa1f4e3481f153a6b4383c9e39da93c8d235d0' 'c53bd47527adbd2599a583e05a7d24f930dc4e86b1de017486588205ad6f262a51a4551593bc7a1218c96541ea073ea03b770278d947b1cd0d2801311fcc80e5' '3889679e288d51f6fecc7ed6581ccde34acbf1e4861f5c9ca237a1ad13158502757d3fc457d7b6caf1c8c99c9dba842265004154a71cffb8ec14e1030e49e312' '3c3f3b6407d9a1a63cd91c2b5c35e6c932afa5bf33f1b2e8a530dbd9eacda8c8f956616c4cc9228657624da58e354ba5714252237d84ff3386fd65cf44f06ddc') diff --git a/fix_race_condition_in_packet_set_ring.diff b/fix_race_condition_in_packet_set_ring.diff deleted file mode 100644 index 12048f611d1a..000000000000 --- a/fix_race_condition_in_packet_set_ring.diff +++ /dev/null @@ -1,84 +0,0 @@ -From: Philip Pettersson <philip.pettersson@gmail.com> - -When packet_set_ring creates a ring buffer it will initialize a -struct timer_list if the packet version is TPACKET_V3. This value -can then be raced by a different thread calling setsockopt to -set the version to TPACKET_V1 before packet_set_ring has finished. - -This leads to a use-after-free on a function pointer in the -struct timer_list when the socket is closed as the previously -initialized timer will not be deleted. - -The bug is fixed by taking lock_sock(sk) in packet_setsockopt when -changing the packet version while also taking the lock at the start -of packet_set_ring. - -Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") -Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> ---- - net/packet/af_packet.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index d2238b204691b8e4f2e3acb9bc167b553ba32d50..dd2332390c45bbff7c3fc5d259453f2e1ca352bf 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - - if (optlen != sizeof(val)) - return -EINVAL; -- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) -- return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; - switch (val) { - case TPACKET_V1: - case TPACKET_V2: - case TPACKET_V3: -- po->tp_version = val; -- return 0; -+ break; - default: - return -EINVAL; - } -+ lock_sock(sk); -+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { -+ ret = -EBUSY; -+ } else { -+ po->tp_version = val; -+ ret = 0; -+ } -+ release_sock(sk); -+ return ret; - } - case PACKET_RESERVE: - { -@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - /* Added to avoid minimal code churn */ - struct tpacket_req *req = &req_u->req; - -+ lock_sock(sk); - /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ - if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { - net_warn_ratelimited("Tx-ring is not supported.\n"); -@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - goto out; - } - -- lock_sock(sk); - - /* Detach socket from network */ - spin_lock(&po->bind_lock); -@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - if (!tx_ring) - prb_shutdown_retire_blk_timer(po, rb_queue); - } -- release_sock(sk); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->tp_block_nr); - out: -+ release_sock(sk); - return err; - } |