4.9-stable patches

added patches:
	acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
	keys-restrict-proc-keys-by-credentials-at-open-time.patch

diff --git a/queue-4.9/acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch b/queue-4.9/acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
new file mode 100644 (file)
index 0000000..14131c0
--- /dev/null
+++ b/queue-4.9/acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
@@ -0,0 +1,37 @@
+From 8b23570ab001c1982c8a068cde468ff067255314 Mon Sep 17 00:00:00 2001
+From: Erik Schmauss <erik.schmauss@intel.com>
+Date: Fri, 10 Aug 2018 14:43:02 -0700
+Subject: ACPICA: Reference Counts: increase max to 0x4000 for large servers
+
+From: Erik Schmauss <erik.schmauss@intel.com>
+
+commit 8b23570ab001c1982c8a068cde468ff067255314 upstream.
+
+Increase the reference count limit to 0x4000 as the current one is
+not sufficient for some large server systems.
+
+Reviewed-by: Dimitri Sivanich <dimitri.sivanich@hpe.com>
+Tested-by: Russ Anderson <russ.anderson@hpe.com>
+Reported-by: Mike Travis <mike.travis@hpe.com>
+Signed-off-by: Mike Travis <mike.travis@hpe.com>
+Signed-off-by: Erik Schmauss <erik.schmauss@intel.com>
+[ rjw: Changelog ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Frank van der Linden <fllinden@amazon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/acpi/acconfig.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/acpi/acconfig.h
++++ b/include/acpi/acconfig.h
+@@ -122,7 +122,7 @@
+ 
+ /* Maximum object reference count (detects object deletion issues) */
+ 
+-#define ACPI_MAX_REFERENCE_COUNT        0x1000
++#define ACPI_MAX_REFERENCE_COUNT        0x4000
+ 
+ /* Default page size for use in mapping memory for operation regions */
+ 

diff --git a/queue-4.9/keys-restrict-proc-keys-by-credentials-at-open-time.patch b/queue-4.9/keys-restrict-proc-keys-by-credentials-at-open-time.patch
new file mode 100644 (file)
index 0000000..48b187f
--- /dev/null
+++ b/queue-4.9/keys-restrict-proc-keys-by-credentials-at-open-time.patch
@@ -0,0 +1,51 @@
+From 4aa68e07d845562561f5e73c04aa521376e95252 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 18 Sep 2017 11:38:29 -0700
+Subject: KEYS: restrict /proc/keys by credentials at open time
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 4aa68e07d845562561f5e73c04aa521376e95252 upstream.
+
+When checking for permission to view keys whilst reading from
+/proc/keys, we should use the credentials with which the /proc/keys file
+was opened.  This is because, in a classic type of exploit, it can be
+possible to bypass checks for the *current* credentials by passing the
+file descriptor to a suid program.
+
+Following commit 34dbbcdbf633 ("Make file credentials available to the
+seqfile interfaces") we can finally fix it.  So let's do it.
+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Zubin Mithra <zsm@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/proc.c |    8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_fil
+ 
+       struct keyring_search_context ctx = {
+               .index_key              = key->index_key,
+-              .cred                   = current_cred(),
++              .cred                   = m->file->f_cred,
+               .match_data.cmp         = lookup_user_key_possessed,
+               .match_data.raw_data    = key,
+               .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+@@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_fil
+               }
+       }
+ 
+-      /* check whether the current task is allowed to view the key (assuming
+-       * non-possession)
+-       * - the caller holds a spinlock, and thus the RCU read lock, making our
+-       *   access to __current_cred() safe
+-       */
++      /* check whether the current task is allowed to view the key */
+       rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
+       if (rc < 0)
+               return 0;

diff --git a/queue-4.9/series b/queue-4.9/series
new file mode 100644 (file)
index 0000000..8412ef3
--- /dev/null
+++ b/queue-4.9/series
@@ -0,0 +1,2 @@
+acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
+keys-restrict-proc-keys-by-credentials-at-open-time.patch