From: Greg Kroah-Hartman Date: Tue, 6 Jan 2015 23:52:54 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.10.64~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c2d63e3e708dfc5ae05a507f7c181b0d998d0c6f;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: keys-fix-stale-key-registration-at-error-path.patch mac80211-fix-multicast-led-blinking-and-counter.patch mac80211-free-management-frame-keys-when-removing-station.patch userns-unbreak-the-unprivileged-remount-tests.patch --- diff --git a/queue-3.10/keys-fix-stale-key-registration-at-error-path.patch b/queue-3.10/keys-fix-stale-key-registration-at-error-path.patch new file mode 100644 index 00000000000..a9ac3f39c32 --- /dev/null +++ b/queue-3.10/keys-fix-stale-key-registration-at-error-path.patch @@ -0,0 +1,45 @@ +From b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 4 Dec 2014 18:25:19 +0100 +Subject: KEYS: Fix stale key registration at error path + +From: Takashi Iwai + +commit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream. + +When loading encrypted-keys module, if the last check of +aes_get_sizes() in init_encrypted() fails, the driver just returns an +error without unregistering its key type. This results in the stale +entry in the list. In addition to memory leaks, this leads to a kernel +crash when registering a new key type later. + +This patch fixes the problem by swapping the calls of aes_get_sizes() +and register_key_type(), and releasing resources properly at the error +paths. + +Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=908163 +Signed-off-by: Takashi Iwai +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/encrypted-keys/encrypted.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -1018,10 +1018,13 @@ static int __init init_encrypted(void) + ret = encrypted_shash_alloc(); + if (ret < 0) + return ret; ++ ret = aes_get_sizes(); ++ if (ret < 0) ++ goto out; + ret = register_key_type(&key_type_encrypted); + if (ret < 0) + goto out; +- return aes_get_sizes(); ++ return 0; + out: + encrypted_shash_release(); + return ret; diff --git a/queue-3.10/mac80211-fix-multicast-led-blinking-and-counter.patch b/queue-3.10/mac80211-fix-multicast-led-blinking-and-counter.patch new file mode 100644 index 00000000000..8139c6c3716 --- /dev/null +++ b/queue-3.10/mac80211-fix-multicast-led-blinking-and-counter.patch @@ -0,0 +1,63 @@ +From d025933e29872cb1fe19fc54d80e4dfa4ee5779c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andreas=20M=C3=BCller?= +Date: Fri, 12 Dec 2014 12:11:11 +0100 +Subject: mac80211: fix multicast LED blinking and counter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Andreas=20M=C3=BCller?= + +commit d025933e29872cb1fe19fc54d80e4dfa4ee5779c upstream. + +As multicast-frames can't be fragmented, "dot11MulticastReceivedFrameCount" +stopped being incremented after the use-after-free fix. Furthermore, the +RX-LED will be triggered by every multicast frame (which wouldn't happen +before) which wouldn't allow the LED to rest at all. + +Fixes https://bugzilla.kernel.org/show_bug.cgi?id=89431 which also had the +patch. + +Fixes: b8fff407a180 ("mac80211: fix use-after-free in defragmentation") +Signed-off-by: Andreas Müller +[rewrite commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1585,14 +1585,14 @@ ieee80211_rx_h_defragment(struct ieee802 + sc = le16_to_cpu(hdr->seq_ctrl); + frag = sc & IEEE80211_SCTL_FRAG; + +- if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) +- goto out; +- + if (is_multicast_ether_addr(hdr->addr1)) { + rx->local->dot11MulticastReceivedFrameCount++; +- goto out; ++ goto out_no_led; + } + ++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) ++ goto out; ++ + I802_DEBUG_INC(rx->local->rx_handlers_fragments); + + if (skb_linearize(rx->skb)) +@@ -1683,9 +1683,10 @@ ieee80211_rx_h_defragment(struct ieee802 + status->rx_flags |= IEEE80211_RX_FRAGMENTED; + + out: ++ ieee80211_led_rx(rx->local); ++ out_no_led: + if (rx->sta) + rx->sta->rx_packets++; +- ieee80211_led_rx(rx->local); + return RX_CONTINUE; + } + diff --git a/queue-3.10/mac80211-free-management-frame-keys-when-removing-station.patch b/queue-3.10/mac80211-free-management-frame-keys-when-removing-station.patch new file mode 100644 index 00000000000..9042ac897e5 --- /dev/null +++ b/queue-3.10/mac80211-free-management-frame-keys-when-removing-station.patch @@ -0,0 +1,35 @@ +From 28a9bc68124c319b2b3dc861e80828a8865fd1ba Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 17 Dec 2014 13:55:49 +0100 +Subject: mac80211: free management frame keys when removing station + +From: Johannes Berg + +commit 28a9bc68124c319b2b3dc861e80828a8865fd1ba upstream. + +When writing the code to allow per-station GTKs, I neglected to +take into account the management frame keys (index 4 and 5) when +freeing the station and only added code to free the first four +data frame keys. + +Fix this by iterating the array of keys over the right length. + +Fixes: e31b82136d1a ("cfg80211/mac80211: allow per-station GTKs") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/key.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -607,7 +607,7 @@ void ieee80211_free_sta_keys(struct ieee + int i; + + mutex_lock(&local->key_mtx); +- for (i = 0; i < NUM_DEFAULT_KEYS; i++) { ++ for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) { + key = key_mtx_dereference(local, sta->gtk[i]); + if (!key) + continue; diff --git a/queue-3.10/series b/queue-3.10/series index 5763a259cd0..33963610e4c 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -12,3 +12,7 @@ dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch isofs-fix-unchecked-printing-of-er-records.patch +keys-fix-stale-key-registration-at-error-path.patch +mac80211-fix-multicast-led-blinking-and-counter.patch +mac80211-free-management-frame-keys-when-removing-station.patch +userns-unbreak-the-unprivileged-remount-tests.patch diff --git a/queue-3.10/userns-unbreak-the-unprivileged-remount-tests.patch b/queue-3.10/userns-unbreak-the-unprivileged-remount-tests.patch new file mode 100644 index 00000000000..d2738d3a041 --- /dev/null +++ b/queue-3.10/userns-unbreak-the-unprivileged-remount-tests.patch @@ -0,0 +1,92 @@ +From db86da7cb76f797a1a8b445166a15cb922c6ff85 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Tue, 2 Dec 2014 13:56:30 -0600 +Subject: userns: Unbreak the unprivileged remount tests + +From: "Eric W. Biederman" + +commit db86da7cb76f797a1a8b445166a15cb922c6ff85 upstream. + +A security fix in caused the way the unprivileged remount tests were +using user namespaces to break. Tweak the way user namespaces are +being used so the test works again. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/mount/unprivileged-remount-test.c | 32 ++++++++++---- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/tools/testing/selftests/mount/unprivileged-remount-test.c ++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c +@@ -48,17 +48,14 @@ static void die(char *fmt, ...) + exit(EXIT_FAILURE); + } + +-static void write_file(char *filename, char *fmt, ...) ++static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap) + { + char buf[4096]; + int fd; + ssize_t written; + int buf_len; +- va_list ap; + +- va_start(ap, fmt); + buf_len = vsnprintf(buf, sizeof(buf), fmt, ap); +- va_end(ap); + if (buf_len < 0) { + die("vsnprintf failed: %s\n", + strerror(errno)); +@@ -69,6 +66,8 @@ static void write_file(char *filename, c + + fd = open(filename, O_WRONLY); + if (fd < 0) { ++ if ((errno == ENOENT) && enoent_ok) ++ return; + die("open of %s failed: %s\n", + filename, strerror(errno)); + } +@@ -87,6 +86,26 @@ static void write_file(char *filename, c + } + } + ++static void maybe_write_file(char *filename, char *fmt, ...) ++{ ++ va_list ap; ++ ++ va_start(ap, fmt); ++ vmaybe_write_file(true, filename, fmt, ap); ++ va_end(ap); ++ ++} ++ ++static void write_file(char *filename, char *fmt, ...) ++{ ++ va_list ap; ++ ++ va_start(ap, fmt); ++ vmaybe_write_file(false, filename, fmt, ap); ++ va_end(ap); ++ ++} ++ + static void create_and_enter_userns(void) + { + uid_t uid; +@@ -100,13 +119,10 @@ static void create_and_enter_userns(void + strerror(errno)); + } + ++ maybe_write_file("/proc/self/setgroups", "deny"); + write_file("/proc/self/uid_map", "0 %d 1", uid); + write_file("/proc/self/gid_map", "0 %d 1", gid); + +- if (setgroups(0, NULL) != 0) { +- die("setgroups failed: %s\n", +- strerror(errno)); +- } + if (setgid(0) != 0) { + die ("setgid(0) failed %s\n", + strerror(errno));