diff options
| -rw-r--r-- | .SRCINFO | 20 | ||||
| -rw-r--r-- | 0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch | 65 | ||||
| -rw-r--r-- | PKGBUILD | 26 | ||||
| -rw-r--r-- | fix_race_condition_in_packet_set_ring.diff | 84 |
4 files changed, 88 insertions, 107 deletions
@@ -1,6 +1,6 @@ pkgbase = linux-rt-bfq - pkgver = 4.8.11_rt7 - pkgrel = 3 + pkgver = 4.8.14_rt8 + pkgrel = 1 url = http://algo.ing.unimo.it arch = i686 arch = x86_64 @@ -11,10 +11,10 @@ pkgbase = linux-rt-bfq options = !strip source = http://www.kernel.org/pub/linux/kernel/v4.x/linux-4.8.tar.xz source = https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.8.tar.sign - source = http://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.11.xz - source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.11.sign - source = http://www.kernel.org/pub/linux/kernel/projects/rt/4.8/patch-4.8.11-rt7.patch.xz - source = http://www.kernel.org/pub/linux/kernel/projects/rt/4.8/patch-4.8.11-rt7.patch.sign + source = http://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.14.xz + source = https://www.kernel.org/pub/linux/kernel/v4.x/patch-4.8.14.sign + source = http://www.kernel.org/pub/linux/kernel/projects/rt/4.8/patch-4.8.14-rt8.patch.xz + source = http://www.kernel.org/pub/linux/kernel/projects/rt/4.8/patch-4.8.14-rt8.patch.sign source = http://algo.ing.unimo.it/people/paolo/disk_sched/patches/4.8.0-v8r4/0001-block-cgroups-kconfig-build-bits-for-BFQ-v7r11-4.8.0.patch source = http://algo.ing.unimo.it/people/paolo/disk_sched/patches/4.8.0-v8r4/0002-block-introduce-the-BFQ-v7r11-I-O-sched-to-be-ported.patch source = http://algo.ing.unimo.it/people/paolo/disk_sched/patches/4.8.0-v8r4/0003-block-bfq-add-Early-Queue-Merge-EQM-to-BFQ-v7r11-to-.patch @@ -26,8 +26,8 @@ pkgbase = linux-rt-bfq source = config.x86_64 source = 99-linux.hook source = linux.preset - source = fix_race_condition_in_packet_set_ring.diff source = net_handle_no_dst_on_skb_in_icmp6_send.patch + source = 0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch source = 0005-BFQ-Fix.patch source = 0006-BFQ-Fix.patch validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886 @@ -37,9 +37,9 @@ pkgbase = linux-rt-bfq validpgpkeys = E644E2F1D45FA0B2EAA02F33109F098506FF0B14 sha512sums = a48a065f21e1c7c4de4cf8ca47b8b8d9a70f86b64e7cfa6e01be490f78895745b9c8790734b1d22182cf1f930fb87eaaa84e62ec8cc1f64ac4be9b949e7c0358 sha512sums = SKIP - sha512sums = b77fd9fa3ae1e5f80ffe555ecec7d7f5b60cad3efc81d51f66a486f5d3ce862083a1553fa3e148452fab62a25d2d953abf5c23c7a51fe094b9c0946e09dbc30b + sha512sums = 374b849aac6736f3a8d7afd224d51a5f4bab5c0fefaa8738982bae7188687149b7775e53878efe25466b4c0d40769b284e8af55c1d3bae500bccdbf565c0453a sha512sums = SKIP - sha512sums = d6e20493065fcab333cfa64c58c1147161d4120bc8982a7626134fd5a1941c764a06e7f0e4207368ffb02a718df03d956d54cdf1a6c0fa0c4a9e2eb64ce9238f + sha512sums = b3381b7e283358b2903a06da200aec58bb70326d6bba6eb5f1790b0e84f4849230286d903fa491ef8221b8fe13bea02775206152ce9cb706c791c3c63f111db6 sha512sums = SKIP sha512sums = 95a7b9dc5a6c378b19e199285b5c1c397ca0ca0cf03c42d185b57da68329e59d59294d1879998f4020a0dee10d36c550acf30f28970c82adb2e7604c86424178 sha512sums = dc0649dfe2a5ce8e8879a62df29a4a1959eb1a84e5d896a9cb119d6a85a9bad1b17135371799e0be96532e17c66043d298e4a14b18fad3078a1f425108f888c9 @@ -52,8 +52,8 @@ pkgbase = linux-rt-bfq sha512sums = a6200ad0c8bc44b97233c0cbd4c419c37727f06e735f2c6b60a28e94bfdc6d31d7f26d24f9f898c62fceefe08dfd3bdbd5d71acf2b5fcedbda8ea3881d284daa sha512sums = d6faa67f3ef40052152254ae43fee031365d0b1524aa0718b659eb75afc21a3f79ea8d62d66ea311a800109bed545bc8f79e8752319cd378eef2cbd3a09aba22 sha512sums = 2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf - sha512sums = fd5800dcc1b9e7825892dfaedf78d9b64f354695992c9a1b0014e66664c6f0f4c80989439df360c994aab03dc4aa1f4e3481f153a6b4383c9e39da93c8d235d0 sha512sums = c53bd47527adbd2599a583e05a7d24f930dc4e86b1de017486588205ad6f262a51a4551593bc7a1218c96541ea073ea03b770278d947b1cd0d2801311fcc80e5 + sha512sums = 002d5e0ccfa5824c1750912a6400ff722672d6587b74ba66b1127cf1228048f604bba107617cf4f4477884039af4d4d196cf1b74cefe43b0bddc82270f11940d sha512sums = 3889679e288d51f6fecc7ed6581ccde34acbf1e4861f5c9ca237a1ad13158502757d3fc457d7b6caf1c8c99c9dba842265004154a71cffb8ec14e1030e49e312 sha512sums = 3c3f3b6407d9a1a63cd91c2b5c35e6c932afa5bf33f1b2e8a530dbd9eacda8c8f956616c4cc9228657624da58e354ba5714252237d84ff3386fd65cf44f06ddc diff --git a/0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch b/0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch new file mode 100644 index 000000000000..8cef8463520f --- /dev/null +++ b/0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch @@ -0,0 +1,65 @@ +From 885bad1e5f32bbf30787ead9578f8174047e6904 Mon Sep 17 00:00:00 2001 +From: Yu-cheng Yu <yu-cheng.yu@intel.com> +Date: Thu, 17 Nov 2016 09:11:35 -0800 +Subject: [PATCH] x86/fpu: Fix invalid FPU ptrace state after execve() + +commit b22cbe404a9cc3c7949e380fa1861e31934c8978 upstream. + +Robert O'Callahan reported that after an execve PTRACE_GETREGSET +NT_X86_XSTATE continues to return the pre-exec register values +until the exec'ed task modifies FPU state. + +The test code is at: + + https://bugzilla.redhat.com/attachment.cgi?id=1164286. + +What is happening is fpu__clear() does not properly clear fpstate. +Fix it by doing just that. + +Reported-by: Robert O'Callahan <robert@ocallahan.org> +Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com> +Cc: Andy Lutomirski <luto@kernel.org> +Cc: Borislav Petkov <bp@suse.de> +Cc: David Hansen <dave.hansen@linux.intel.com> +Cc: Fenghua Yu <fenghua.yu@intel.com> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Peter Zijlstra <peterz@infradead.org> +Cc: Ravi V. Shankar <ravi.v.shankar@intel.com> +Cc: Thomas Gleixner <tglx@linutronix.de> +Link: http://lkml.kernel.org/r/1479402695-6553-1-git-send-email-yu-cheng.yu@intel.com +Signed-off-by: Ingo Molnar <mingo@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/x86/kernel/fpu/core.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index 3fc03a09a93b1710..c289e2f4a6e5b464 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -517,14 +517,14 @@ void fpu__clear(struct fpu *fpu) + { + WARN_ON_FPU(fpu != ¤t->thread.fpu); /* Almost certainly an anomaly */ + +- if (!use_eager_fpu() || !static_cpu_has(X86_FEATURE_FPU)) { +- /* FPU state will be reallocated lazily at the first use. */ +- fpu__drop(fpu); +- } else { +- if (!fpu->fpstate_active) { +- fpu__activate_curr(fpu); +- user_fpu_begin(); +- } ++ fpu__drop(fpu); ++ ++ /* ++ * Make sure fpstate is cleared and initialized. ++ */ ++ if (static_cpu_has(X86_FEATURE_FPU)) { ++ fpu__activate_curr(fpu); ++ user_fpu_begin(); + copy_init_fpstate_to_fpregs(); + } + } +-- +2.10.2 + @@ -51,10 +51,10 @@ _use_current= pkgbase=linux-rt-bfq # pkgname=('linux-rt-bfq' 'linux-rt-bfq-headers' 'linux-rt-bfq-docs') _srcname=linux-4.8 -_pkgver=4.8.11 -_rtpatchver=rt7 +_pkgver=4.8.14 +_rtpatchver=rt8 pkgver=${_pkgver}_${_rtpatchver} -pkgrel=3 +pkgrel=1 arch=('i686' 'x86_64') url="http://algo.ing.unimo.it" license=('GPL2') @@ -85,8 +85,8 @@ source=("http://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.xz" '99-linux.hook' # standard config files for mkinitcpio ramdisk 'linux.preset' - 'fix_race_condition_in_packet_set_ring.diff' 'net_handle_no_dst_on_skb_in_icmp6_send.patch' + '0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch' # patches from https://github.com/linusw/linux-bfq/commits/bfq-v8 '0005-BFQ-Fix.patch' '0006-BFQ-Fix.patch') @@ -115,14 +115,14 @@ prepare() { msg "Patching set DEFAULT_CONSOLE_LOGLEVEL to 4" patch -p1 -i "${srcdir}/change-default-console-loglevel.patch" - ### fix a race condition that allows to gain root - # https://marc.info/?l=linux-netdev&m=148054660230570&w=2 - msg "Fix a race condition that allows to gain root" - patch -p1 -i "${srcdir}/fix_race_condition_in_packet_set_ring.diff" - ### fix https://bugzilla.kernel.org/show_bug.cgi?id=189851 msg "Fix https://bugzilla.kernel.org/show_bug.cgi?id=189851" - patch -p1 -i "${srcdir}/net_handle_no_dst_on_skb_in_icmp6_send.patch" + patch -p1 -i "${srcdir}/net_handle_no_dst_on_skb_in_icmp6_send.patch" + + ### Revert a commit that causes memory corruption in i686 chroots on our + # build server ("valgrind bash" immediately crashes) + msg "Revert a commit that causes memory corruption in i686 chroots on our build server" + patch -Rp1 -i "${srcdir}/0001-x86-fpu-Fix-invalid-FPU-ptrace-state-after-execve.patch" ### Patch source with BFQ msg "Patching source with BFQ patches" @@ -468,9 +468,9 @@ done sha512sums=('a48a065f21e1c7c4de4cf8ca47b8b8d9a70f86b64e7cfa6e01be490f78895745b9c8790734b1d22182cf1f930fb87eaaa84e62ec8cc1f64ac4be9b949e7c0358' 'SKIP' - 'b77fd9fa3ae1e5f80ffe555ecec7d7f5b60cad3efc81d51f66a486f5d3ce862083a1553fa3e148452fab62a25d2d953abf5c23c7a51fe094b9c0946e09dbc30b' + '374b849aac6736f3a8d7afd224d51a5f4bab5c0fefaa8738982bae7188687149b7775e53878efe25466b4c0d40769b284e8af55c1d3bae500bccdbf565c0453a' 'SKIP' - 'd6e20493065fcab333cfa64c58c1147161d4120bc8982a7626134fd5a1941c764a06e7f0e4207368ffb02a718df03d956d54cdf1a6c0fa0c4a9e2eb64ce9238f' + 'b3381b7e283358b2903a06da200aec58bb70326d6bba6eb5f1790b0e84f4849230286d903fa491ef8221b8fe13bea02775206152ce9cb706c791c3c63f111db6' 'SKIP' '95a7b9dc5a6c378b19e199285b5c1c397ca0ca0cf03c42d185b57da68329e59d59294d1879998f4020a0dee10d36c550acf30f28970c82adb2e7604c86424178' 'dc0649dfe2a5ce8e8879a62df29a4a1959eb1a84e5d896a9cb119d6a85a9bad1b17135371799e0be96532e17c66043d298e4a14b18fad3078a1f425108f888c9' @@ -483,8 +483,8 @@ sha512sums=('a48a065f21e1c7c4de4cf8ca47b8b8d9a70f86b64e7cfa6e01be490f78895745b9c 'a6200ad0c8bc44b97233c0cbd4c419c37727f06e735f2c6b60a28e94bfdc6d31d7f26d24f9f898c62fceefe08dfd3bdbd5d71acf2b5fcedbda8ea3881d284daa' 'd6faa67f3ef40052152254ae43fee031365d0b1524aa0718b659eb75afc21a3f79ea8d62d66ea311a800109bed545bc8f79e8752319cd378eef2cbd3a09aba22' '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf' - 'fd5800dcc1b9e7825892dfaedf78d9b64f354695992c9a1b0014e66664c6f0f4c80989439df360c994aab03dc4aa1f4e3481f153a6b4383c9e39da93c8d235d0' 'c53bd47527adbd2599a583e05a7d24f930dc4e86b1de017486588205ad6f262a51a4551593bc7a1218c96541ea073ea03b770278d947b1cd0d2801311fcc80e5' + '002d5e0ccfa5824c1750912a6400ff722672d6587b74ba66b1127cf1228048f604bba107617cf4f4477884039af4d4d196cf1b74cefe43b0bddc82270f11940d' '3889679e288d51f6fecc7ed6581ccde34acbf1e4861f5c9ca237a1ad13158502757d3fc457d7b6caf1c8c99c9dba842265004154a71cffb8ec14e1030e49e312' '3c3f3b6407d9a1a63cd91c2b5c35e6c932afa5bf33f1b2e8a530dbd9eacda8c8f956616c4cc9228657624da58e354ba5714252237d84ff3386fd65cf44f06ddc') diff --git a/fix_race_condition_in_packet_set_ring.diff b/fix_race_condition_in_packet_set_ring.diff deleted file mode 100644 index 12048f611d1a..000000000000 --- a/fix_race_condition_in_packet_set_ring.diff +++ /dev/null @@ -1,84 +0,0 @@ -From: Philip Pettersson <philip.pettersson@gmail.com> - -When packet_set_ring creates a ring buffer it will initialize a -struct timer_list if the packet version is TPACKET_V3. This value -can then be raced by a different thread calling setsockopt to -set the version to TPACKET_V1 before packet_set_ring has finished. - -This leads to a use-after-free on a function pointer in the -struct timer_list when the socket is closed as the previously -initialized timer will not be deleted. - -The bug is fixed by taking lock_sock(sk) in packet_setsockopt when -changing the packet version while also taking the lock at the start -of packet_set_ring. - -Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") -Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com> -Signed-off-by: Eric Dumazet <edumazet@google.com> ---- - net/packet/af_packet.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index d2238b204691b8e4f2e3acb9bc167b553ba32d50..dd2332390c45bbff7c3fc5d259453f2e1ca352bf 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - - if (optlen != sizeof(val)) - return -EINVAL; -- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) -- return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; - switch (val) { - case TPACKET_V1: - case TPACKET_V2: - case TPACKET_V3: -- po->tp_version = val; -- return 0; -+ break; - default: - return -EINVAL; - } -+ lock_sock(sk); -+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { -+ ret = -EBUSY; -+ } else { -+ po->tp_version = val; -+ ret = 0; -+ } -+ release_sock(sk); -+ return ret; - } - case PACKET_RESERVE: - { -@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - /* Added to avoid minimal code churn */ - struct tpacket_req *req = &req_u->req; - -+ lock_sock(sk); - /* Opening a Tx-ring is NOT supported in TPACKET_V3 */ - if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) { - net_warn_ratelimited("Tx-ring is not supported.\n"); -@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - goto out; - } - -- lock_sock(sk); - - /* Detach socket from network */ - spin_lock(&po->bind_lock); -@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - if (!tx_ring) - prb_shutdown_retire_blk_timer(po, rb_queue); - } -- release_sock(sk); - - if (pg_vec) - free_pg_vec(pg_vec, order, req->tp_block_nr); - out: -+ release_sock(sk); - return err; - } |