diff options
-rw-r--r-- | .SRCINFO | 10 | ||||
-rw-r--r-- | PKGBUILD | 14 | ||||
-rw-r--r-- | fix_race_condition_in_packet_set_ring.diff | 168 |
3 files changed, 8 insertions, 184 deletions
@@ -1,5 +1,5 @@ pkgbase = linux-lts-selinux - pkgver = 4.4.37 + pkgver = 4.4.43 pkgrel = 1 url = https://www.kernel.org/ arch = i686 @@ -13,20 +13,19 @@ pkgbase = linux-lts-selinux options = !strip source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.tar.xz source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.4.tar.sign - source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.4.37.xz - source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.4.37.sign + source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.4.43.xz + source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.4.43.sign source = config source = config.x86_64 source = 99-linux.hook source = linux-lts-selinux.preset source = change-default-console-loglevel.patch source = 0001-sdhci-revert.patch - source = fix_race_condition_in_packet_set_ring.diff validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886 validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E sha256sums = 401d7c8fef594999a460d10c72c5a94e9c2e1022f16795ec51746b0d165418b2 sha256sums = SKIP - sha256sums = 1dfa256765585bf85a17b7129d717761e12338c654a3a3a803f1d967ccfa54f3 + sha256sums = 000017fb4d658c95fff9754b1409952c177fef2567eacb9386c86a4060ab27ff sha256sums = SKIP sha256sums = a77182fa8011f68567f857e88b140f0164c1c2fb8aae46e20f885a885e295079 sha256sums = 531d6394acb1c27e00ee74cbb62386a6d058f5381746b2b971da44cf7bb530bb @@ -34,7 +33,6 @@ pkgbase = linux-lts-selinux sha256sums = 86c1443fc1b3bece35666a5cdc385ae36a4eb1267ba27c79eb24d049787ae560 sha256sums = 1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99 sha256sums = 5313df7cb5b4d005422bd4cd0dae956b2dadba8f3db904275aaf99ac53894375 - sha256sums = 0723a76690e3b1c37b80b52f3406ae0d5394d7ee086cc46082f9409221995c85 pkgname = linux-lts-selinux pkgdesc = The Linux-lts-selinux kernel and modules @@ -4,7 +4,7 @@ pkgbase=linux-lts-selinux #pkgbase=linux-lts-custom _srcname=linux-4.4 -pkgver=4.4.37 +pkgver=4.4.43 pkgrel=1 arch=('i686' 'x86_64') url="https://www.kernel.org/" @@ -19,20 +19,18 @@ source=(https://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.{xz,sign} # standard config files for mkinitcpio ramdisk "$pkgbase.preset" change-default-console-loglevel.patch - 0001-sdhci-revert.patch - fix_race_condition_in_packet_set_ring.diff) + 0001-sdhci-revert.patch) # https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc sha256sums=('401d7c8fef594999a460d10c72c5a94e9c2e1022f16795ec51746b0d165418b2' 'SKIP' - '1dfa256765585bf85a17b7129d717761e12338c654a3a3a803f1d967ccfa54f3' + '000017fb4d658c95fff9754b1409952c177fef2567eacb9386c86a4060ab27ff' 'SKIP' 'a77182fa8011f68567f857e88b140f0164c1c2fb8aae46e20f885a885e295079' '531d6394acb1c27e00ee74cbb62386a6d058f5381746b2b971da44cf7bb530bb' 'bec776deea68c4412f48047aaa39be32d509de3fd0bfe6ad28128a167cafae09' '86c1443fc1b3bece35666a5cdc385ae36a4eb1267ba27c79eb24d049787ae560' '1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99' - '5313df7cb5b4d005422bd4cd0dae956b2dadba8f3db904275aaf99ac53894375' - '0723a76690e3b1c37b80b52f3406ae0d5394d7ee086cc46082f9409221995c85') + '5313df7cb5b4d005422bd4cd0dae956b2dadba8f3db904275aaf99ac53894375') validpgpkeys=('ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds <torvalds@linux-foundation.org> '647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com> @@ -45,10 +43,6 @@ prepare() { # add upstream patch patch -p1 -i "${srcdir}/patch-${pkgver}" - # fix a race condition that allows to gain root - # https://marc.info/?l=linux-netdev&m=148054660230570&w=2 - patch -p1 -i "${srcdir}/fix_race_condition_in_packet_set_ring.diff" - # add latest fixes from stable queue, if needed # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git diff --git a/fix_race_condition_in_packet_set_ring.diff b/fix_race_condition_in_packet_set_ring.diff deleted file mode 100644 index 304c222cb1a4..000000000000 --- a/fix_race_condition_in_packet_set_ring.diff +++ /dev/null @@ -1,168 +0,0 @@ -From: Philip Pettersson <philip.pettersson@gmail.com> - -When packet_set_ring creates a ring buffer it will initialize a -struct timer_list if the packet version is TPACKET_V3. This value -can then be raced by a different thread calling setsockopt to -set the version to TPACKET_V1 before packet_set_ring has finished. - -This leads to a use-after-free on a function pointer in the -struct timer_list when the socket is closed as the previously -initialized timer will not be deleted. - -The bug is fixed by taking lock_sock(sk) in packet_setsockopt when -changing the packet version while also taking the lock at the start -of packet_set_ring. - -Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") -Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> ---- - net/packet/af_packet.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index d2238b204691b8e4f2e3acb9bc167b553ba32d50..dd2332390c45bbff7c3fc5d259453f2e1ca352bf 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - - if (optlen != sizeof(val)) - return -EINVAL; -- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) -- return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; - switch (val) { - case TPACKET_V1: - case TPACKET_V2: - case TPACKET_V3: -- po->tp_version = val; -- return 0; -+ break; - default: - return -EINVAL; - } -+ lock_sock(sk); -+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { -+ ret = -EBUSY; -+ } else { -+ po->tp_version = val; -+ ret = 0; -+ } -+ release_sock(sk); -+ return ret; - } - case PACKET_RESERVE: - { -@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - /* Added to avoid minimal code churn */ - struct tpacket_req *req = &req_u->req; - -+ lock_sock(sk); - /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ - if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { - net_warn_ratelimited("Tx-ring is not supported.\n"); -@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - goto out; - } - -- lock_sock(sk); - - /* Detach socket from network */ - spin_lock(&po->bind_lock); -@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - if (!tx_ring) - prb_shutdown_retire_blk_timer(po, rb_queue); - } -- release_sock(sk); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->tp_block_nr); - out: -+ release_sock(sk); - return err; - } -From: Philip Pettersson <philip.pettersson@gmail.com> - -When packet_set_ring creates a ring buffer it will initialize a -struct timer_list if the packet version is TPACKET_V3. This value -can then be raced by a different thread calling setsockopt to -set the version to TPACKET_V1 before packet_set_ring has finished. - -This leads to a use-after-free on a function pointer in the -struct timer_list when the socket is closed as the previously -initialized timer will not be deleted. - -The bug is fixed by taking lock_sock(sk) in packet_setsockopt when -changing the packet version while also taking the lock at the start -of packet_set_ring. - -Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") -Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> ---- - net/packet/af_packet.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index d2238b204691b8e4f2e3acb9bc167b553ba32d50..dd2332390c45bbff7c3fc5d259453f2e1ca352bf 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - - if (optlen != sizeof(val)) - return -EINVAL; -- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) -- return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; - switch (val) { - case TPACKET_V1: - case TPACKET_V2: - case TPACKET_V3: -- po->tp_version = val; -- return 0; -+ break; - default: - return -EINVAL; - } -+ lock_sock(sk); -+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { -+ ret = -EBUSY; -+ } else { -+ po->tp_version = val; -+ ret = 0; -+ } -+ release_sock(sk); -+ return ret; - } - case PACKET_RESERVE: - { -@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - /* Added to avoid minimal code churn */ - struct tpacket_req *req = &req_u->req; - -+ lock_sock(sk); - /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ - if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { - net_warn_ratelimited("Tx-ring is not supported.\n"); -@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - goto out; - } - -- lock_sock(sk); - - /* Detach socket from network */ - spin_lock(&po->bind_lock); -@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - if (!tx_ring) - prb_shutdown_retire_blk_timer(po, rb_queue); - } -- release_sock(sk); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->tp_block_nr); - out: -+ release_sock(sk); - return err; - } |