From: Greg Kroah-Hartman Date: Tue, 29 Jul 2014 14:49:12 +0000 (-0700) Subject: remove broken s390 patch X-Git-Tag: v3.15.8~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d329e3c8a22b4aaba6ccd893bf01de6f0adc7977;p=thirdparty%2Fkernel%2Fstable-queue.git remove broken s390 patch --- diff --git a/queue-3.10/s390-ptrace-fix-psw-mask-check.patch b/queue-3.10/s390-ptrace-fix-psw-mask-check.patch deleted file mode 100644 index e6df764b491..00000000000 --- a/queue-3.10/s390-ptrace-fix-psw-mask-check.patch +++ /dev/null @@ -1,73 +0,0 @@ -From dab6cf55f81a6e16b8147aed9a843e1691dcd318 Mon Sep 17 00:00:00 2001 -From: Martin Schwidefsky -Date: Mon, 23 Jun 2014 15:29:40 +0200 -Subject: s390/ptrace: fix PSW mask check - -From: Martin Schwidefsky - -commit dab6cf55f81a6e16b8147aed9a843e1691dcd318 upstream. - -The PSW mask check of the PTRACE_POKEUSR_AREA command is incorrect. -The PSW_MASK_USER define contains the PSW_MASK_ASC bits, the ptrace -interface accepts all combinations for the address-space-control -bits. To protect the kernel space the PSW mask check in ptrace needs -to reject the address-space-control bit combination for home space. - -Fixes CVE-2014-3534 - -Signed-off-by: Martin Schwidefsky -[bwh: Backported to 3.2: - - The PSW user-settable bitmasks are constant, never including PSW_MASK_RI - - The kernel can run in either home or primary space, so instead of - checking that the ASC bits are not equal to PSW_ASC_HOME, we have to - check that they don't match psw_kernel_bits - - For the same reason, the required values of non-user-settable bits - are variables (psw_user_bits/psw32_user_bits) and remain so] -Signed-off-by: Ben Hutchings -Signed-off-by: Greg Kroah-Hartman - ---- - arch/s390/kernel/ptrace.c | 23 +++++++++++++++++------ - 1 file changed, 17 insertions(+), 6 deletions(-) - ---- a/arch/s390/kernel/ptrace.c -+++ b/arch/s390/kernel/ptrace.c -@@ -313,11 +313,18 @@ static int __poke_user(struct task_struc - /* - * psw and gprs are stored on the stack - */ -- if (addr == (addr_t) &dummy->regs.psw.mask && -- ((data & ~PSW_MASK_USER) != psw_user_bits || -- ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA)))) -- /* Invalid psw mask. */ -- return -EINVAL; -+ if (addr == (addr_t) &dummy->regs.psw.mask) { -+ if ((data ^ psw_user_bits) & ~PSW_MASK_USER) -+ /* Invalid psw mask. */ -+ return -EINVAL; -+ if ((data & PSW_MASK_ASC) == -+ (psw_kernel_bits & PSW_MASK_ASC)) -+ /* Invalid address-space-control bits */ -+ return -EINVAL; -+ if ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA)) -+ /* Invalid addressing mode bits */ -+ return -EINVAL; -+ } - *(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data; - - } else if (addr < (addr_t) (&dummy->regs.orig_gpr2)) { -@@ -627,9 +634,13 @@ static int __poke_user_compat(struct tas - */ - if (addr == (addr_t) &dummy32->regs.psw.mask) { - /* Build a 64 bit psw mask from 31 bit mask. */ -- if ((tmp & ~PSW32_MASK_USER) != psw32_user_bits) -+ if ((tmp ^ psw32_user_bits) & ~PSW32_MASK_USER) - /* Invalid psw mask. */ - return -EINVAL; -+ if ((data & PSW32_MASK_ASC) == -+ ((psw_kernel_bits & PSW_MASK_ASC) >> 32)) -+ /* Invalid address-space-control bits */ -+ return -EINVAL; - regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) | - (regs->psw.mask & PSW_MASK_BA) | - (__u64)(tmp & PSW32_MASK_USER) << 32; diff --git a/queue-3.10/series b/queue-3.10/series index 0574e661e9d..ad29f3d4175 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -4,7 +4,6 @@ block-provide-compat-ioctl-for-blkzeroout.patch block-don-t-assume-last-put-of-shared-tags-is-for-the-host.patch libata-support-the-ata-host-which-implements-a-queue-depth-less-than-32.patch libata-introduce-ata_host-n_tags-to-avoid-oops-on-sas-controllers.patch -s390-ptrace-fix-psw-mask-check.patch ahci-add-support-for-the-promise-fasttrak-tx8660-sata-hba-ahci-mode.patch blkcg-don-t-call-into-policy-draining-if-root_blkg-is-already-gone.patch tracing-fix-wraparound-problems-in-uptime-trace-clock.patch diff --git a/queue-3.4/s390-ptrace-fix-psw-mask-check.patch b/queue-3.4/s390-ptrace-fix-psw-mask-check.patch deleted file mode 100644 index 3886c7995ed..00000000000 --- a/queue-3.4/s390-ptrace-fix-psw-mask-check.patch +++ /dev/null @@ -1,73 +0,0 @@ -From dab6cf55f81a6e16b8147aed9a843e1691dcd318 Mon Sep 17 00:00:00 2001 -From: Martin Schwidefsky -Date: Mon, 23 Jun 2014 15:29:40 +0200 -Subject: s390/ptrace: fix PSW mask check - -From: Martin Schwidefsky - -commit dab6cf55f81a6e16b8147aed9a843e1691dcd318 upstream. - -The PSW mask check of the PTRACE_POKEUSR_AREA command is incorrect. -The PSW_MASK_USER define contains the PSW_MASK_ASC bits, the ptrace -interface accepts all combinations for the address-space-control -bits. To protect the kernel space the PSW mask check in ptrace needs -to reject the address-space-control bit combination for home space. - -Fixes CVE-2014-3534 - -Signed-off-by: Martin Schwidefsky -[bwh: Backported to 3.2: - - The PSW user-settable bitmasks are constant, never including PSW_MASK_RI - - The kernel can run in either home or primary space, so instead of - checking that the ASC bits are not equal to PSW_ASC_HOME, we have to - check that they don't match psw_kernel_bits - - For the same reason, the required values of non-user-settable bits - are variables (psw_user_bits/psw32_user_bits) and remain so] -Signed-off-by: Ben Hutchings -Signed-off-by: Greg Kroah-Hartman - ---- - arch/s390/kernel/ptrace.c | 23 +++++++++++++++++------ - 1 file changed, 17 insertions(+), 6 deletions(-) - ---- a/arch/s390/kernel/ptrace.c -+++ b/arch/s390/kernel/ptrace.c -@@ -291,11 +291,18 @@ static int __poke_user(struct task_struc - /* - * psw and gprs are stored on the stack - */ -- if (addr == (addr_t) &dummy->regs.psw.mask && -- ((data & ~PSW_MASK_USER) != psw_user_bits || -- ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA)))) -- /* Invalid psw mask. */ -- return -EINVAL; -+ if (addr == (addr_t) &dummy->regs.psw.mask) { -+ if ((data ^ psw_user_bits) & ~PSW_MASK_USER) -+ /* Invalid psw mask. */ -+ return -EINVAL; -+ if ((data & PSW_MASK_ASC) == -+ (psw_kernel_bits & PSW_MASK_ASC)) -+ /* Invalid address-space-control bits */ -+ return -EINVAL; -+ if ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA)) -+ /* Invalid addressing mode bits */ -+ return -EINVAL; -+ } - *(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data; - - } else if (addr < (addr_t) (&dummy->regs.orig_gpr2)) { -@@ -595,9 +602,13 @@ static int __poke_user_compat(struct tas - */ - if (addr == (addr_t) &dummy32->regs.psw.mask) { - /* Build a 64 bit psw mask from 31 bit mask. */ -- if ((tmp & ~PSW32_MASK_USER) != psw32_user_bits) -+ if ((tmp ^ psw32_user_bits) & ~PSW32_MASK_USER) - /* Invalid psw mask. */ - return -EINVAL; -+ if ((data & PSW32_MASK_ASC) == -+ ((psw_kernel_bits & PSW_MASK_ASC) >> 32)) -+ /* Invalid address-space-control bits */ -+ return -EINVAL; - regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) | - (regs->psw.mask & PSW_MASK_BA) | - (__u64)(tmp & PSW32_MASK_USER) << 32; diff --git a/queue-3.4/series b/queue-3.4/series index d6e1577fcf4..14328e0799e 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -1,7 +1,6 @@ block-don-t-assume-last-put-of-shared-tags-is-for-the-host.patch libata-support-the-ata-host-which-implements-a-queue-depth-less-than-32.patch libata-introduce-ata_host-n_tags-to-avoid-oops-on-sas-controllers.patch -s390-ptrace-fix-psw-mask-check.patch ahci-add-support-for-the-promise-fasttrak-tx8660-sata-hba-ahci-mode.patch x86_32-entry-store-badsys-error-code-in-eax.patch mm-hugetlb-fix-copy_hugetlb_page_range.patch