4.9-stable patches

added patches:
	nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch
	proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch

diff --git a/queue-4.9/nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch b/queue-4.9/nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch
new file mode 100644 (file)
index 0000000..12faa58
--- /dev/null
+++ b/queue-4.9/nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch
@@ -0,0 +1,44 @@
+From 46f1c52e66dbc0d7a99f7c2a3c9debb497fe7b7b Mon Sep 17 00:00:00 2001
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Wed, 23 Aug 2017 14:41:50 -0700
+Subject: nfp: TX time stamp packets before HW doorbell is rung
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+commit 46f1c52e66dbc0d7a99f7c2a3c9debb497fe7b7b upstream.
+
+TX completion may happen any time after HW queue was kicked.
+We can't access the skb afterwards.  Move the time stamping
+before ringing the doorbell.
+
+Fixes: 4c3523623dc0 ("net: add driver for Netronome NFP4000/NFP6000 NIC VFs")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_common.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -854,6 +854,8 @@ static int nfp_net_tx(struct sk_buff *sk
+ 
+       netdev_tx_sent_queue(nd_q, txbuf->real_len);
+ 
++      skb_tx_timestamp(skb);
++
+       tx_ring->wr_p += nr_frags + 1;
+       if (nfp_net_tx_ring_should_stop(tx_ring))
+               nfp_net_tx_ring_stop(nd_q, tx_ring);
+@@ -866,8 +868,6 @@ static int nfp_net_tx(struct sk_buff *sk
+               tx_ring->wr_ptr_add = 0;
+       }
+ 
+-      skb_tx_timestamp(skb);
+-
+       return NETDEV_TX_OK;
+ 
+ err_unmap:

diff --git a/queue-4.9/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch b/queue-4.9/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch
new file mode 100644 (file)
index 0000000..9fdec7d
--- /dev/null
+++ b/queue-4.9/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch
@@ -0,0 +1,111 @@
+From 7f7ccc2ccc2e70c6054685f5e3522efa81556830 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Fri, 11 May 2018 08:11:44 +0200
+Subject: proc: do not access cmdline nor environ from file-backed areas
+
+From: Willy Tarreau <w@1wt.eu>
+
+commit 7f7ccc2ccc2e70c6054685f5e3522efa81556830 upstream.
+
+proc_pid_cmdline_read() and environ_read() directly access the target
+process' VM to retrieve the command line and environment. If this
+process remaps these areas onto a file via mmap(), the requesting
+process may experience various issues such as extra delays if the
+underlying device is slow to respond.
+
+Let's simply refuse to access file-backed areas in these functions.
+For this we add a new FOLL_ANON gup flag that is passed to all calls
+to access_remote_vm(). The code already takes care of such failures
+(including unmapped areas). Accesses via /proc/pid/mem were not
+changed though.
+
+This was assigned CVE-2018-1120.
+
+Note for stable backports: the patch may apply to kernels prior to 4.11
+but silently miss one location; it must be checked that no call to
+access_remote_vm() keeps zero as the last argument.
+
+Reported-by: Qualys Security Advisory <qsa@qualys.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/base.c     |   10 +++++-----
+ include/linux/mm.h |    1 +
+ mm/gup.c           |    3 +++
+ 3 files changed, 9 insertions(+), 5 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -252,7 +252,7 @@ static ssize_t proc_pid_cmdline_read(str
+        * Inherently racy -- command line shares address space
+        * with code and data.
+        */
+-      rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0);
++      rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON);
+       if (rv <= 0)
+               goto out_free_page;
+ 
+@@ -270,7 +270,7 @@ static ssize_t proc_pid_cmdline_read(str
+                       int nr_read;
+ 
+                       _count = min3(count, len, PAGE_SIZE);
+-                      nr_read = access_remote_vm(mm, p, page, _count, 0);
++                      nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON);
+                       if (nr_read < 0)
+                               rv = nr_read;
+                       if (nr_read <= 0)
+@@ -305,7 +305,7 @@ static ssize_t proc_pid_cmdline_read(str
+                       bool final;
+ 
+                       _count = min3(count, len, PAGE_SIZE);
+-                      nr_read = access_remote_vm(mm, p, page, _count, 0);
++                      nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON);
+                       if (nr_read < 0)
+                               rv = nr_read;
+                       if (nr_read <= 0)
+@@ -354,7 +354,7 @@ skip_argv:
+                       bool final;
+ 
+                       _count = min3(count, len, PAGE_SIZE);
+-                      nr_read = access_remote_vm(mm, p, page, _count, 0);
++                      nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON);
+                       if (nr_read < 0)
+                               rv = nr_read;
+                       if (nr_read <= 0)
+@@ -970,7 +970,7 @@ static ssize_t environ_read(struct file
+               max_len = min_t(size_t, PAGE_SIZE, count);
+               this_len = min(max_len, this_len);
+ 
+-              retval = access_remote_vm(mm, (env_start + src), page, this_len, 0);
++              retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON);
+ 
+               if (retval <= 0) {
+                       ret = retval;
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2246,6 +2246,7 @@ static inline struct page *follow_page(s
+ #define FOLL_MLOCK    0x1000  /* lock present pages */
+ #define FOLL_REMOTE   0x2000  /* we are working on non-current tsk/mm */
+ #define FOLL_COW      0x4000  /* internal GUP flag */
++#define FOLL_ANON     0x8000  /* don't do file mappings */
+ 
+ typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
+                       void *data);
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -430,6 +430,9 @@ static int check_vma_flags(struct vm_are
+       if (vm_flags & (VM_IO | VM_PFNMAP))
+               return -EFAULT;
+ 
++      if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma))
++              return -EFAULT;
++
+       if (write) {
+               if (!(vm_flags & VM_WRITE)) {
+                       if (!(gup_flags & FOLL_FORCE))

diff --git a/queue-4.9/series b/queue-4.9/series
index 6c08fb43431e9374beb62a64d92cf68885b93c9e..addf151a9654ee0d87357ea8fd7bdc3d5063c299 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -29,3 +29,5 @@ xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch
 lockd-lost-rollback-of-set_grace_period-in-lockd_down_net.patch
 revert-arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch
 l2tp-revert-l2tp-fix-missing-print-session-offset-info.patch
+nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch
+proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch