From: Greg Kroah-Hartman Date: Fri, 18 May 2018 07:25:58 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.16.10~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=09b60ecbf00786b32fbf0be38accc1c155107c79;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch --- diff --git a/queue-4.9/nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch b/queue-4.9/nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch new file mode 100644 index 00000000000..12faa58a69d --- /dev/null +++ b/queue-4.9/nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch @@ -0,0 +1,44 @@ +From 46f1c52e66dbc0d7a99f7c2a3c9debb497fe7b7b Mon Sep 17 00:00:00 2001 +From: Jakub Kicinski +Date: Wed, 23 Aug 2017 14:41:50 -0700 +Subject: nfp: TX time stamp packets before HW doorbell is rung + +From: Jakub Kicinski + +commit 46f1c52e66dbc0d7a99f7c2a3c9debb497fe7b7b upstream. + +TX completion may happen any time after HW queue was kicked. +We can't access the skb afterwards. Move the time stamping +before ringing the doorbell. + +Fixes: 4c3523623dc0 ("net: add driver for Netronome NFP4000/NFP6000 NIC VFs") +Signed-off-by: Jakub Kicinski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Cc: Willy Tarreau +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +@@ -854,6 +854,8 @@ static int nfp_net_tx(struct sk_buff *sk + + netdev_tx_sent_queue(nd_q, txbuf->real_len); + ++ skb_tx_timestamp(skb); ++ + tx_ring->wr_p += nr_frags + 1; + if (nfp_net_tx_ring_should_stop(tx_ring)) + nfp_net_tx_ring_stop(nd_q, tx_ring); +@@ -866,8 +868,6 @@ static int nfp_net_tx(struct sk_buff *sk + tx_ring->wr_ptr_add = 0; + } + +- skb_tx_timestamp(skb); +- + return NETDEV_TX_OK; + + err_unmap: diff --git a/queue-4.9/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch b/queue-4.9/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch new file mode 100644 index 00000000000..9fdec7dd92c --- /dev/null +++ b/queue-4.9/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch @@ -0,0 +1,111 @@ +From 7f7ccc2ccc2e70c6054685f5e3522efa81556830 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Fri, 11 May 2018 08:11:44 +0200 +Subject: proc: do not access cmdline nor environ from file-backed areas + +From: Willy Tarreau + +commit 7f7ccc2ccc2e70c6054685f5e3522efa81556830 upstream. + +proc_pid_cmdline_read() and environ_read() directly access the target +process' VM to retrieve the command line and environment. If this +process remaps these areas onto a file via mmap(), the requesting +process may experience various issues such as extra delays if the +underlying device is slow to respond. + +Let's simply refuse to access file-backed areas in these functions. +For this we add a new FOLL_ANON gup flag that is passed to all calls +to access_remote_vm(). The code already takes care of such failures +(including unmapped areas). Accesses via /proc/pid/mem were not +changed though. + +This was assigned CVE-2018-1120. + +Note for stable backports: the patch may apply to kernels prior to 4.11 +but silently miss one location; it must be checked that no call to +access_remote_vm() keeps zero as the last argument. + +Reported-by: Qualys Security Advisory +Cc: Linus Torvalds +Cc: Andy Lutomirski +Cc: Oleg Nesterov +Cc: stable@vger.kernel.org +Signed-off-by: Willy Tarreau +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 10 +++++----- + include/linux/mm.h | 1 + + mm/gup.c | 3 +++ + 3 files changed, 9 insertions(+), 5 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -252,7 +252,7 @@ static ssize_t proc_pid_cmdline_read(str + * Inherently racy -- command line shares address space + * with code and data. + */ +- rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0); ++ rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON); + if (rv <= 0) + goto out_free_page; + +@@ -270,7 +270,7 @@ static ssize_t proc_pid_cmdline_read(str + int nr_read; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -305,7 +305,7 @@ static ssize_t proc_pid_cmdline_read(str + bool final; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -354,7 +354,7 @@ skip_argv: + bool final; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -970,7 +970,7 @@ static ssize_t environ_read(struct file + max_len = min_t(size_t, PAGE_SIZE, count); + this_len = min(max_len, this_len); + +- retval = access_remote_vm(mm, (env_start + src), page, this_len, 0); ++ retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON); + + if (retval <= 0) { + ret = retval; +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2246,6 +2246,7 @@ static inline struct page *follow_page(s + #define FOLL_MLOCK 0x1000 /* lock present pages */ + #define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */ + #define FOLL_COW 0x4000 /* internal GUP flag */ ++#define FOLL_ANON 0x8000 /* don't do file mappings */ + + typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr, + void *data); +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -430,6 +430,9 @@ static int check_vma_flags(struct vm_are + if (vm_flags & (VM_IO | VM_PFNMAP)) + return -EFAULT; + ++ if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) ++ return -EFAULT; ++ + if (write) { + if (!(vm_flags & VM_WRITE)) { + if (!(gup_flags & FOLL_FORCE)) diff --git a/queue-4.9/series b/queue-4.9/series index 6c08fb43431..addf151a965 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -29,3 +29,5 @@ xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch lockd-lost-rollback-of-set_grace_period-in-lockd_down_net.patch revert-arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch l2tp-revert-l2tp-fix-missing-print-session-offset-info.patch +nfp-tx-time-stamp-packets-before-hw-doorbell-is-rung.patch +proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch