diff options
| -rw-r--r-- | .SRCINFO | 5 | ||||
| -rw-r--r-- | 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch | 103 | ||||
| -rw-r--r-- | 0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch | 42 | ||||
| -rw-r--r-- | 0003-ssb-Do-not-disable-PCI-host-on-non-Mips.patch | 37 | ||||
| -rw-r--r-- | 0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch | 49 | ||||
| -rw-r--r-- | 0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch | 114 | ||||
| -rw-r--r-- | PKGBUILD | 3 |
7 files changed, 1 insertions, 352 deletions
@@ -1,5 +1,5 @@ # Generated by mksrcinfo v8 -# Mon Apr 2 03:36:49 UTC 2018 +# Sun Apr 8 07:22:05 UTC 2018 pkgbase = linux-pf pkgdesc = Linux kernel and modules with the pf-kernel patch (uksm, PDS). pkgver = 4.15.6 @@ -23,9 +23,6 @@ pkgbase = linux-pf source = https://github.com/pfactum/pf-kernel/compare/v4.15...v4.15-pf6.diff source = 90-linux.hook source = 60-linux.hook - source = 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch - source = 0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch - source = 0003-ssb-Do-not-disable-PCI-host-on-non-Mips.patch sha256sums = 5a26478906d5005f4f809402e981518d2b8844949199f60c4b6e1f986ca2a769 sha256sums = 102d518779dc312af35faf7e07ff01df3c04521d40d8757fc4e8eba9c595c395 sha256sums = f38927db126ec7141ea2dd70cabb2ef378552672b31db4ab621493928497abd7 diff --git a/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch b/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch deleted file mode 100644 index ec60bc9f300b..000000000000 --- a/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch +++ /dev/null @@ -1,103 +0,0 @@ -From d817891efd179bdb0b5d30fa8aafaeb2a96af76c Mon Sep 17 00:00:00 2001 -Message-Id: <d817891efd179bdb0b5d30fa8aafaeb2a96af76c.1518115547.git.jan.steffens@gmail.com> -From: Serge Hallyn <serge.hallyn@canonical.com> -Date: Fri, 31 May 2013 19:12:12 +0100 -Subject: [PATCH 1/3] add sysctl to disallow unprivileged CLONE_NEWUSER by - default - -Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> -[bwh: Remove unneeded binary sysctl bits] -Signed-off-by: Daniel Micay <danielmicay@gmail.com> ---- - kernel/fork.c | 15 +++++++++++++++ - kernel/sysctl.c | 12 ++++++++++++ - kernel/user_namespace.c | 3 +++ - 3 files changed, 30 insertions(+) - -diff --git a/kernel/fork.c b/kernel/fork.c -index 2295fc69717f..6f320a216e7d 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -102,6 +102,11 @@ - - #define CREATE_TRACE_POINTS - #include <trace/events/task.h> -+#ifdef CONFIG_USER_NS -+extern int unprivileged_userns_clone; -+#else -+#define unprivileged_userns_clone 0 -+#endif - - /* - * Minimum number of threads to boot the kernel -@@ -1550,6 +1555,10 @@ static __latent_entropy struct task_struct *copy_process( - if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) - return ERR_PTR(-EINVAL); - -+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) -+ if (!capable(CAP_SYS_ADMIN)) -+ return ERR_PTR(-EPERM); -+ - /* - * Thread groups must share signals as well, and detached threads - * can only be started up within the thread group. -@@ -2343,6 +2352,12 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags) - if (unshare_flags & CLONE_NEWNS) - unshare_flags |= CLONE_FS; - -+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { -+ err = -EPERM; -+ if (!capable(CAP_SYS_ADMIN)) -+ goto bad_unshare_out; -+ } -+ - err = check_unshare_flags(unshare_flags); - if (err) - goto bad_unshare_out; -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 557d46728577..c19d7a828913 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -105,6 +105,9 @@ extern int core_uses_pid; - extern char core_pattern[]; - extern unsigned int core_pipe_limit; - #endif -+#ifdef CONFIG_USER_NS -+extern int unprivileged_userns_clone; -+#endif - extern int pid_max; - extern int pid_max_min, pid_max_max; - extern int percpu_pagelist_fraction; -@@ -513,6 +516,15 @@ static struct ctl_table kern_table[] = { - .proc_handler = proc_dointvec, - }, - #endif -+#ifdef CONFIG_USER_NS -+ { -+ .procname = "unprivileged_userns_clone", -+ .data = &unprivileged_userns_clone, -+ .maxlen = sizeof(int), -+ .mode = 0644, -+ .proc_handler = proc_dointvec, -+ }, -+#endif - #ifdef CONFIG_PROC_SYSCTL - { - .procname = "tainted", -diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c -index 246d4d4ce5c7..f64432b45cec 100644 ---- a/kernel/user_namespace.c -+++ b/kernel/user_namespace.c -@@ -26,6 +26,9 @@ - #include <linux/bsearch.h> - #include <linux/sort.h> - -+/* sysctl */ -+int unprivileged_userns_clone; -+ - static struct kmem_cache *user_ns_cachep __read_mostly; - static DEFINE_MUTEX(userns_state_mutex); - --- -2.16.1 - diff --git a/0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch b/0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch deleted file mode 100644 index 22141236e8b8..000000000000 --- a/0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch +++ /dev/null @@ -1,42 +0,0 @@ -From f256ec7564d904b5c245c34a7cb091e6912b22c3 Mon Sep 17 00:00:00 2001 -Message-Id: <f256ec7564d904b5c245c34a7cb091e6912b22c3.1518115547.git.jan.steffens@gmail.com> -In-Reply-To: <d817891efd179bdb0b5d30fa8aafaeb2a96af76c.1518115547.git.jan.steffens@gmail.com> -References: <d817891efd179bdb0b5d30fa8aafaeb2a96af76c.1518115547.git.jan.steffens@gmail.com> -From: Jim Bride <jim.bride@linux.intel.com> -Date: Mon, 6 Nov 2017 13:38:57 -0800 -Subject: [PATCH 2/3] drm/i915/edp: Only use the alternate fixed mode if it's - asked for - -In commit dc911f5bd8aa ("drm/i915/edp: Allow alternate fixed mode for -eDP if available."), the patch allows for the use of an alternate fixed -mode if it is available, but the patch was not ensuring that the only -time the alternate mode is used is when it is specifically requested. -This patch adds an additional comparison to intel_edp_compare_alt_mode -to ensure that we only use the alternate mode if it is directly -requested. - -Fixes: dc911f5bd8aac ("Allow alternate fixed mode for eDP if available.") -Cc: David Weinehall <david.weinehall@linux.intel.com> -Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> -Signed-off-by: Jim Bride <jim.bride@linux.intel.com> ---- - drivers/gpu/drm/i915/intel_dp.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index 158438bb0389..69b16df868ea 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -1616,7 +1616,8 @@ static bool intel_edp_compare_alt_mode(struct drm_display_mode *m1, - m1->vdisplay == m2->vdisplay && - m1->vsync_start == m2->vsync_start && - m1->vsync_end == m2->vsync_end && -- m1->vtotal == m2->vtotal); -+ m1->vtotal == m2->vtotal && -+ m1->vrefresh == m2->vrefresh); - return bres; - } - --- -2.16.1 - diff --git a/0003-ssb-Do-not-disable-PCI-host-on-non-Mips.patch b/0003-ssb-Do-not-disable-PCI-host-on-non-Mips.patch deleted file mode 100644 index f1102e0b92a4..000000000000 --- a/0003-ssb-Do-not-disable-PCI-host-on-non-Mips.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 1a0e4c170e4622947c0d1d530d63a3241a99b93c Mon Sep 17 00:00:00 2001 -Message-Id: <1a0e4c170e4622947c0d1d530d63a3241a99b93c.1518115547.git.jan.steffens@gmail.com> -In-Reply-To: <d817891efd179bdb0b5d30fa8aafaeb2a96af76c.1518115547.git.jan.steffens@gmail.com> -References: <d817891efd179bdb0b5d30fa8aafaeb2a96af76c.1518115547.git.jan.steffens@gmail.com> -From: Sven Joachim <svenjoac@gmx.de> -Date: Fri, 26 Jan 2018 10:38:01 +0100 -Subject: [PATCH 3/3] ssb: Do not disable PCI host on non-Mips - -After upgrading an old laptop to 4.15-rc9, I found that the eth0 and -wlan0 interfaces had disappeared. It turns out that the b43 and b44 -drivers require SSB_PCIHOST_POSSIBLE which depends on -PCI_DRIVERS_LEGACY, a config option that only exists on Mips. - -Fixes: 58eae1416b80 ("ssb: Disable PCI host for PCI_DRIVERS_GENERIC") -Cc: stable@vger.org -Signed-off-by: Sven Joachim <svenjoac@gmx.de> -Reviewed-by: James Hogan <jhogan@kernel.org> ---- - drivers/ssb/Kconfig | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig -index 71c73766ee22..65af12c3bdb2 100644 ---- a/drivers/ssb/Kconfig -+++ b/drivers/ssb/Kconfig -@@ -32,7 +32,7 @@ config SSB_BLOCKIO - - config SSB_PCIHOST_POSSIBLE - bool -- depends on SSB && (PCI = y || PCI = SSB) && PCI_DRIVERS_LEGACY -+ depends on SSB && (PCI = y || PCI = SSB) && (PCI_DRIVERS_LEGACY || !MIPS) - default y - - config SSB_PCIHOST --- -2.16.1 - diff --git a/0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch b/0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch deleted file mode 100644 index 6b4de3a648d9..000000000000 --- a/0004-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 5a11be3bab2dcd6fe061206662969c4cea46988f Mon Sep 17 00:00:00 2001 -Message-Id: <5a11be3bab2dcd6fe061206662969c4cea46988f.1515173964.git.jan.steffens@gmail.com> -In-Reply-To: <0b716bdb952b678d9bb5eb32198dbc82ec492df2.1515173964.git.jan.steffens@gmail.com> -References: <0b716bdb952b678d9bb5eb32198dbc82ec492df2.1515173964.git.jan.steffens@gmail.com> -From: Steffen Klassert <steffen.klassert@secunet.com> -Date: Fri, 22 Dec 2017 10:44:57 +0100 -Subject: [PATCH 4/6] xfrm: Fix stack-out-of-bounds read on socket policy - lookup. - -When we do tunnel or beet mode, we pass saddr and daddr from the -template to xfrm_state_find(), this is ok. On transport mode, -we pass the addresses from the flowi, assuming that the IP -addresses (and address family) don't change during transformation. -This assumption is wrong in the IPv4 mapped IPv6 case, packet -is IPv4 and template is IPv6. - -Fix this by catching address family missmatches of the policy -and the flow already before we do the lookup. - -Reported-by: syzbot <syzkaller@googlegroups.com> -Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> ---- - net/xfrm/xfrm_policy.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 6bc16bb61b5533ef..50c5f46b5cca942e 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -1169,9 +1169,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir, - again: - pol = rcu_dereference(sk->sk_policy[dir]); - if (pol != NULL) { -- bool match = xfrm_selector_match(&pol->selector, fl, family); -+ bool match; - int err = 0; - -+ if (pol->family != family) { -+ pol = NULL; -+ goto out; -+ } -+ -+ match = xfrm_selector_match(&pol->selector, fl, family); - if (match) { - if ((sk->sk_mark & pol->mark.m) != pol->mark.v) { - pol = NULL; --- -2.15.1 - diff --git a/0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch b/0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch deleted file mode 100644 index 3090318aacb8..000000000000 --- a/0005-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch +++ /dev/null @@ -1,114 +0,0 @@ -From eadda028a73a567edd8462ccd0e8c28e023cde28 Mon Sep 17 00:00:00 2001 -Message-Id: <eadda028a73a567edd8462ccd0e8c28e023cde28.1515173964.git.jan.steffens@gmail.com> -In-Reply-To: <0b716bdb952b678d9bb5eb32198dbc82ec492df2.1515173964.git.jan.steffens@gmail.com> -References: <0b716bdb952b678d9bb5eb32198dbc82ec492df2.1515173964.git.jan.steffens@gmail.com> -From: Tejun Heo <tj@kernel.org> -Date: Wed, 20 Dec 2017 07:09:19 -0800 -Subject: [PATCH 5/6] cgroup: fix css_task_iter crash on CSS_TASK_ITER_PROC - -While teaching css_task_iter to handle skipping over tasks which -aren't group leaders, bc2fb7ed089f ("cgroup: add @flags to -css_task_iter_start() and implement CSS_TASK_ITER_PROCS") introduced a -silly bug. - -CSS_TASK_ITER_PROCS is implemented by repeating -css_task_iter_advance() while the advanced cursor is pointing to a -non-leader thread. However, the cursor variable, @l, wasn't updated -when the iteration has to advance to the next css_set and the -following repetition would operate on the terminal @l from the -previous iteration which isn't pointing to a valid task leading to -oopses like the following or infinite looping. - - BUG: unable to handle kernel NULL pointer dereference at 0000000000000254 - IP: __task_pid_nr_ns+0xc7/0xf0 - PGD 0 P4D 0 - Oops: 0000 [#1] SMP - ... - CPU: 2 PID: 1 Comm: systemd Not tainted 4.14.4-200.fc26.x86_64 #1 - Hardware name: System manufacturer System Product Name/PRIME B350M-A, BIOS 3203 11/09/2017 - task: ffff88c4baee8000 task.stack: ffff96d5c3158000 - RIP: 0010:__task_pid_nr_ns+0xc7/0xf0 - RSP: 0018:ffff96d5c315bd50 EFLAGS: 00010206 - RAX: 0000000000000000 RBX: ffff88c4b68c6000 RCX: 0000000000000250 - RDX: ffffffffa5e47960 RSI: 0000000000000000 RDI: ffff88c490f6ab00 - RBP: ffff96d5c315bd50 R08: 0000000000001000 R09: 0000000000000005 - R10: ffff88c4be006b80 R11: ffff88c42f1b8004 R12: ffff96d5c315bf18 - R13: ffff88c42d7dd200 R14: ffff88c490f6a510 R15: ffff88c4b68c6000 - FS: 00007f9446f8ea00(0000) GS:ffff88c4be680000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000254 CR3: 00000007f956f000 CR4: 00000000003406e0 - Call Trace: - cgroup_procs_show+0x19/0x30 - cgroup_seqfile_show+0x4c/0xb0 - kernfs_seq_show+0x21/0x30 - seq_read+0x2ec/0x3f0 - kernfs_fop_read+0x134/0x180 - __vfs_read+0x37/0x160 - ? security_file_permission+0x9b/0xc0 - vfs_read+0x8e/0x130 - SyS_read+0x55/0xc0 - entry_SYSCALL_64_fastpath+0x1a/0xa5 - RIP: 0033:0x7f94455f942d - RSP: 002b:00007ffe81ba2d00 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 - RAX: ffffffffffffffda RBX: 00005574e2233f00 RCX: 00007f94455f942d - RDX: 0000000000001000 RSI: 00005574e2321a90 RDI: 000000000000002b - RBP: 0000000000000000 R08: 00005574e2321a90 R09: 00005574e231de60 - R10: 00007f94458c8b38 R11: 0000000000000293 R12: 00007f94458c8ae0 - R13: 00007ffe81ba3800 R14: 0000000000000000 R15: 00005574e2116560 - Code: 04 74 0e 89 f6 48 8d 04 76 48 8d 04 c5 f0 05 00 00 48 8b bf b8 05 00 00 48 01 c7 31 c0 48 8b 0f 48 85 c9 74 18 8b b2 30 08 00 00 <3b> 71 04 77 0d 48 c1 e6 05 48 01 f1 48 3b 51 38 74 09 5d c3 8b - RIP: __task_pid_nr_ns+0xc7/0xf0 RSP: ffff96d5c315bd50 - -Fix it by moving the initialization of the cursor below the repeat -label. While at it, rename it to @next for readability. - -Signed-off-by: Tejun Heo <tj@kernel.org> -Fixes: bc2fb7ed089f ("cgroup: add @flags to css_task_iter_start() and implement CSS_TASK_ITER_PROCS") -Cc: stable@vger.kernel.org # v4.14+ -Reported-by: Laura Abbott <labbott@redhat.com> -Reported-by: Bronek Kozicki <brok@incorrekt.com> -Reported-by: George Amanakis <gamanakis@gmail.com> -Signed-off-by: Tejun Heo <tj@kernel.org> ---- - kernel/cgroup/cgroup.c | 14 ++++++-------- - 1 file changed, 6 insertions(+), 8 deletions(-) - -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index 44857278eb8aa6a2..030e4286f14c715e 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -4059,26 +4059,24 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it) - - static void css_task_iter_advance(struct css_task_iter *it) - { -- struct list_head *l = it->task_pos; -+ struct list_head *next; - - lockdep_assert_held(&css_set_lock); -- WARN_ON_ONCE(!l); -- - repeat: - /* - * Advance iterator to find next entry. cset->tasks is consumed - * first and then ->mg_tasks. After ->mg_tasks, we move onto the - * next cset. - */ -- l = l->next; -+ next = it->task_pos->next; - -- if (l == it->tasks_head) -- l = it->mg_tasks_head->next; -+ if (next == it->tasks_head) -+ next = it->mg_tasks_head->next; - -- if (l == it->mg_tasks_head) -+ if (next == it->mg_tasks_head) - css_task_iter_advance_css_set(it); - else -- it->task_pos = l; -+ it->task_pos = next; - - /* if PROCS, skip over tasks which aren't group leaders */ - if ((it->flags & CSS_TASK_ITER_PROCS) && it->task_pos && --- -2.15.1 - @@ -83,9 +83,6 @@ source=("https://www.kernel.org/pub/linux/kernel/v${_major}.x/linux-${_basekerne "${_pfpatchhome}/${_pfpatchname}" # the -pf patchset "90-linux.hook" "60-linux.hook" - '0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch' - '0002-drm-i915-edp-Only-use-the-alternate-fixed-mode-if-it.patch' - '0003-ssb-Do-not-disable-PCI-host-on-non-Mips.patch' ) # 'cx23885_move_CI_AC_registration_to_a_separate_function.patch' |