From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 14 Mar 2019 17:13:31 +0000 (-0700)
Subject: 4.9-stable patches
X-Git-Tag: v5.0.3~23
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e8e0e55a5bce6a4b28a9ad6374521d9c9f8a3205;p=thirdparty%2Fkernel%2Fstable-queue.git

4.9-stable patches

added patches:
	acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
	keys-restrict-proc-keys-by-credentials-at-open-time.patch
---

diff --git a/queue-4.9/acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch b/queue-4.9/acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
new file mode 100644
index 00000000000..14131c0b94e
--- /dev/null
+++ b/queue-4.9/acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
@@ -0,0 +1,37 @@
+From 8b23570ab001c1982c8a068cde468ff067255314 Mon Sep 17 00:00:00 2001
+From: Erik Schmauss <erik.schmauss@intel.com>
+Date: Fri, 10 Aug 2018 14:43:02 -0700
+Subject: ACPICA: Reference Counts: increase max to 0x4000 for large servers
+
+From: Erik Schmauss <erik.schmauss@intel.com>
+
+commit 8b23570ab001c1982c8a068cde468ff067255314 upstream.
+
+Increase the reference count limit to 0x4000 as the current one is
+not sufficient for some large server systems.
+
+Reviewed-by: Dimitri Sivanich <dimitri.sivanich@hpe.com>
+Tested-by: Russ Anderson <russ.anderson@hpe.com>
+Reported-by: Mike Travis <mike.travis@hpe.com>
+Signed-off-by: Mike Travis <mike.travis@hpe.com>
+Signed-off-by: Erik Schmauss <erik.schmauss@intel.com>
+[ rjw: Changelog ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Frank van der Linden <fllinden@amazon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/acpi/acconfig.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/acpi/acconfig.h
++++ b/include/acpi/acconfig.h
+@@ -122,7 +122,7 @@
+ 
+ /* Maximum object reference count (detects object deletion issues) */
+ 
+-#define ACPI_MAX_REFERENCE_COUNT        0x1000
++#define ACPI_MAX_REFERENCE_COUNT        0x4000
+ 
+ /* Default page size for use in mapping memory for operation regions */
+ 
diff --git a/queue-4.9/keys-restrict-proc-keys-by-credentials-at-open-time.patch b/queue-4.9/keys-restrict-proc-keys-by-credentials-at-open-time.patch
new file mode 100644
index 00000000000..48b187fcd2b
--- /dev/null
+++ b/queue-4.9/keys-restrict-proc-keys-by-credentials-at-open-time.patch
@@ -0,0 +1,51 @@
+From 4aa68e07d845562561f5e73c04aa521376e95252 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 18 Sep 2017 11:38:29 -0700
+Subject: KEYS: restrict /proc/keys by credentials at open time
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 4aa68e07d845562561f5e73c04aa521376e95252 upstream.
+
+When checking for permission to view keys whilst reading from
+/proc/keys, we should use the credentials with which the /proc/keys file
+was opened.  This is because, in a classic type of exploit, it can be
+possible to bypass checks for the *current* credentials by passing the
+file descriptor to a suid program.
+
+Following commit 34dbbcdbf633 ("Make file credentials available to the
+seqfile interfaces") we can finally fix it.  So let's do it.
+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Zubin Mithra <zsm@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/proc.c |    8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_fil
+ 
+ 	struct keyring_search_context ctx = {
+ 		.index_key		= key->index_key,
+-		.cred			= current_cred(),
++		.cred			= m->file->f_cred,
+ 		.match_data.cmp		= lookup_user_key_possessed,
+ 		.match_data.raw_data	= key,
+ 		.match_data.lookup_type	= KEYRING_SEARCH_LOOKUP_DIRECT,
+@@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_fil
+ 		}
+ 	}
+ 
+-	/* check whether the current task is allowed to view the key (assuming
+-	 * non-possession)
+-	 * - the caller holds a spinlock, and thus the RCU read lock, making our
+-	 *   access to __current_cred() safe
+-	 */
++	/* check whether the current task is allowed to view the key */
+ 	rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
+ 	if (rc < 0)
+ 		return 0;
diff --git a/queue-4.9/series b/queue-4.9/series
new file mode 100644
index 00000000000..8412ef33007
--- /dev/null
+++ b/queue-4.9/series
@@ -0,0 +1,2 @@
+acpica-reference-counts-increase-max-to-0x4000-for-large-servers.patch
+keys-restrict-proc-keys-by-credentials-at-open-time.patch