From e276d0591065bb8f4a4ff9e918b37724c219f38d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 6 Jan 2015 15:53:05 -0800 Subject: [PATCH] 3.17-stable patches added patches: keys-fix-stale-key-registration-at-error-path.patch mac80211-fix-multicast-led-blinking-and-counter.patch mac80211-free-management-frame-keys-when-removing-station.patch mnt-fix-a-memory-stomp-in-umount.patch thermal-fix-error-path-in-thermal_init.patch userns-unbreak-the-unprivileged-remount-tests.patch --- ...stale-key-registration-at-error-path.patch | 45 +++++++++ ...x-multicast-led-blinking-and-counter.patch | 63 +++++++++++++ ...ent-frame-keys-when-removing-station.patch | 35 +++++++ .../mnt-fix-a-memory-stomp-in-umount.patch | 50 ++++++++++ queue-3.17/series | 6 ++ ...ermal-fix-error-path-in-thermal_init.patch | 36 ++++++++ ...break-the-unprivileged-remount-tests.patch | 92 +++++++++++++++++++ 7 files changed, 327 insertions(+) create mode 100644 queue-3.17/keys-fix-stale-key-registration-at-error-path.patch create mode 100644 queue-3.17/mac80211-fix-multicast-led-blinking-and-counter.patch create mode 100644 queue-3.17/mac80211-free-management-frame-keys-when-removing-station.patch create mode 100644 queue-3.17/mnt-fix-a-memory-stomp-in-umount.patch create mode 100644 queue-3.17/thermal-fix-error-path-in-thermal_init.patch create mode 100644 queue-3.17/userns-unbreak-the-unprivileged-remount-tests.patch diff --git a/queue-3.17/keys-fix-stale-key-registration-at-error-path.patch b/queue-3.17/keys-fix-stale-key-registration-at-error-path.patch new file mode 100644 index 00000000000..a9ac3f39c32 --- /dev/null +++ b/queue-3.17/keys-fix-stale-key-registration-at-error-path.patch @@ -0,0 +1,45 @@ +From b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 4 Dec 2014 18:25:19 +0100 +Subject: KEYS: Fix stale key registration at error path + +From: Takashi Iwai + +commit b26bdde5bb27f3f900e25a95e33a0c476c8c2c48 upstream. + +When loading encrypted-keys module, if the last check of +aes_get_sizes() in init_encrypted() fails, the driver just returns an +error without unregistering its key type. This results in the stale +entry in the list. In addition to memory leaks, this leads to a kernel +crash when registering a new key type later. + +This patch fixes the problem by swapping the calls of aes_get_sizes() +and register_key_type(), and releasing resources properly at the error +paths. + +Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=908163 +Signed-off-by: Takashi Iwai +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/encrypted-keys/encrypted.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -1018,10 +1018,13 @@ static int __init init_encrypted(void) + ret = encrypted_shash_alloc(); + if (ret < 0) + return ret; ++ ret = aes_get_sizes(); ++ if (ret < 0) ++ goto out; + ret = register_key_type(&key_type_encrypted); + if (ret < 0) + goto out; +- return aes_get_sizes(); ++ return 0; + out: + encrypted_shash_release(); + return ret; diff --git a/queue-3.17/mac80211-fix-multicast-led-blinking-and-counter.patch b/queue-3.17/mac80211-fix-multicast-led-blinking-and-counter.patch new file mode 100644 index 00000000000..0b9e2602a75 --- /dev/null +++ b/queue-3.17/mac80211-fix-multicast-led-blinking-and-counter.patch @@ -0,0 +1,63 @@ +From d025933e29872cb1fe19fc54d80e4dfa4ee5779c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andreas=20M=C3=BCller?= +Date: Fri, 12 Dec 2014 12:11:11 +0100 +Subject: mac80211: fix multicast LED blinking and counter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Andreas=20M=C3=BCller?= + +commit d025933e29872cb1fe19fc54d80e4dfa4ee5779c upstream. + +As multicast-frames can't be fragmented, "dot11MulticastReceivedFrameCount" +stopped being incremented after the use-after-free fix. Furthermore, the +RX-LED will be triggered by every multicast frame (which wouldn't happen +before) which wouldn't allow the LED to rest at all. + +Fixes https://bugzilla.kernel.org/show_bug.cgi?id=89431 which also had the +patch. + +Fixes: b8fff407a180 ("mac80211: fix use-after-free in defragmentation") +Signed-off-by: Andreas Müller +[rewrite commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1667,14 +1667,14 @@ ieee80211_rx_h_defragment(struct ieee802 + sc = le16_to_cpu(hdr->seq_ctrl); + frag = sc & IEEE80211_SCTL_FRAG; + +- if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) +- goto out; +- + if (is_multicast_ether_addr(hdr->addr1)) { + rx->local->dot11MulticastReceivedFrameCount++; +- goto out; ++ goto out_no_led; + } + ++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) ++ goto out; ++ + I802_DEBUG_INC(rx->local->rx_handlers_fragments); + + if (skb_linearize(rx->skb)) +@@ -1765,9 +1765,10 @@ ieee80211_rx_h_defragment(struct ieee802 + status->rx_flags |= IEEE80211_RX_FRAGMENTED; + + out: ++ ieee80211_led_rx(rx->local); ++ out_no_led: + if (rx->sta) + rx->sta->rx_packets++; +- ieee80211_led_rx(rx->local); + return RX_CONTINUE; + } + diff --git a/queue-3.17/mac80211-free-management-frame-keys-when-removing-station.patch b/queue-3.17/mac80211-free-management-frame-keys-when-removing-station.patch new file mode 100644 index 00000000000..88582110361 --- /dev/null +++ b/queue-3.17/mac80211-free-management-frame-keys-when-removing-station.patch @@ -0,0 +1,35 @@ +From 28a9bc68124c319b2b3dc861e80828a8865fd1ba Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 17 Dec 2014 13:55:49 +0100 +Subject: mac80211: free management frame keys when removing station + +From: Johannes Berg + +commit 28a9bc68124c319b2b3dc861e80828a8865fd1ba upstream. + +When writing the code to allow per-station GTKs, I neglected to +take into account the management frame keys (index 4 and 5) when +freeing the station and only added code to free the first four +data frame keys. + +Fix this by iterating the array of keys over the right length. + +Fixes: e31b82136d1a ("cfg80211/mac80211: allow per-station GTKs") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/key.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -650,7 +650,7 @@ void ieee80211_free_sta_keys(struct ieee + int i; + + mutex_lock(&local->key_mtx); +- for (i = 0; i < NUM_DEFAULT_KEYS; i++) { ++ for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) { + key = key_mtx_dereference(local, sta->gtk[i]); + if (!key) + continue; diff --git a/queue-3.17/mnt-fix-a-memory-stomp-in-umount.patch b/queue-3.17/mnt-fix-a-memory-stomp-in-umount.patch new file mode 100644 index 00000000000..a4a67e3ca8a --- /dev/null +++ b/queue-3.17/mnt-fix-a-memory-stomp-in-umount.patch @@ -0,0 +1,50 @@ +From c297abfdf15b4480704d6b566ca5ca9438b12456 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Thu, 18 Dec 2014 10:57:19 -0600 +Subject: mnt: Fix a memory stomp in umount + +From: "Eric W. Biederman" + +commit c297abfdf15b4480704d6b566ca5ca9438b12456 upstream. + +While reviewing the code of umount_tree I realized that when we append +to a preexisting unmounted list we do not change pprev of the former +first item in the list. + +Which means later in namespace_unlock hlist_del_init(&mnt->mnt_hash) on +the former first item of the list will stomp unmounted.first leaving +it set to some random mount point which we are likely to free soon. + +This isn't likely to hit, but if it does I don't know how anyone could +track it down. + +[ This happened because we don't have all the same operations for + hlist's as we do for normal doubly-linked lists. In particular, + list_splice() is easy on our standard doubly-linked lists, while + hlist_splice() doesn't exist and needs both start/end entries of the + hlist. And commit 38129a13e6e7 incorrectly open-coded that missing + hlist_splice(). + + We should think about making these kinds of "mindless" conversions + easier to get right by adding the missing hlist helpers - Linus ] + +Fixes: 38129a13e6e71f666e0468e99fdd932a687b4d7e switch mnt_hash to hlist +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/namespace.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1286,6 +1286,8 @@ void umount_tree(struct mount *mnt, int + } + if (last) { + last->mnt_hash.next = unmounted.first; ++ if (unmounted.first) ++ unmounted.first->pprev = &last->mnt_hash.next; + unmounted.first = tmp_list.first; + unmounted.first->pprev = &unmounted.first; + } diff --git a/queue-3.17/series b/queue-3.17/series index f1e2cc8259c..c970d57bc44 100644 --- a/queue-3.17/series +++ b/queue-3.17/series @@ -35,3 +35,9 @@ arm-mvebu-fix-ordering-in-armada-370-.dtsi.patch x86-asm-traps-disable-tracing-and-kprobes-in-fixup_bad_iret-and-sync_regs.patch x86-tls-don-t-validate-lm-in-set_thread_area-after-all.patch isofs-fix-unchecked-printing-of-er-records.patch +keys-fix-stale-key-registration-at-error-path.patch +mac80211-fix-multicast-led-blinking-and-counter.patch +mac80211-free-management-frame-keys-when-removing-station.patch +mnt-fix-a-memory-stomp-in-umount.patch +thermal-fix-error-path-in-thermal_init.patch +userns-unbreak-the-unprivileged-remount-tests.patch diff --git a/queue-3.17/thermal-fix-error-path-in-thermal_init.patch b/queue-3.17/thermal-fix-error-path-in-thermal_init.patch new file mode 100644 index 00000000000..452a9dfa2e0 --- /dev/null +++ b/queue-3.17/thermal-fix-error-path-in-thermal_init.patch @@ -0,0 +1,36 @@ +From 9d367e5e7b05c71a8c1ac4e9b6e00ba45a79f2fc Mon Sep 17 00:00:00 2001 +From: Luis Henriques +Date: Wed, 3 Dec 2014 21:20:21 +0000 +Subject: thermal: Fix error path in thermal_init() + +From: Luis Henriques + +commit 9d367e5e7b05c71a8c1ac4e9b6e00ba45a79f2fc upstream. + +thermal_unregister_governors() and class_unregister() were being called in +the wrong order. + +Fixes: 80a26a5c22b9 ("Thermal: build thermal governors into thermal_sys module") +Signed-off-by: Luis Henriques +Signed-off-by: Zhang Rui +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/thermal/thermal_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -1824,10 +1824,10 @@ static int __init thermal_init(void) + + exit_netlink: + genetlink_exit(); +-unregister_governors: +- thermal_unregister_governors(); + unregister_class: + class_unregister(&thermal_class); ++unregister_governors: ++ thermal_unregister_governors(); + error: + idr_destroy(&thermal_tz_idr); + idr_destroy(&thermal_cdev_idr); diff --git a/queue-3.17/userns-unbreak-the-unprivileged-remount-tests.patch b/queue-3.17/userns-unbreak-the-unprivileged-remount-tests.patch new file mode 100644 index 00000000000..d2738d3a041 --- /dev/null +++ b/queue-3.17/userns-unbreak-the-unprivileged-remount-tests.patch @@ -0,0 +1,92 @@ +From db86da7cb76f797a1a8b445166a15cb922c6ff85 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Tue, 2 Dec 2014 13:56:30 -0600 +Subject: userns: Unbreak the unprivileged remount tests + +From: "Eric W. Biederman" + +commit db86da7cb76f797a1a8b445166a15cb922c6ff85 upstream. + +A security fix in caused the way the unprivileged remount tests were +using user namespaces to break. Tweak the way user namespaces are +being used so the test works again. + +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/mount/unprivileged-remount-test.c | 32 ++++++++++---- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/tools/testing/selftests/mount/unprivileged-remount-test.c ++++ b/tools/testing/selftests/mount/unprivileged-remount-test.c +@@ -48,17 +48,14 @@ static void die(char *fmt, ...) + exit(EXIT_FAILURE); + } + +-static void write_file(char *filename, char *fmt, ...) ++static void vmaybe_write_file(bool enoent_ok, char *filename, char *fmt, va_list ap) + { + char buf[4096]; + int fd; + ssize_t written; + int buf_len; +- va_list ap; + +- va_start(ap, fmt); + buf_len = vsnprintf(buf, sizeof(buf), fmt, ap); +- va_end(ap); + if (buf_len < 0) { + die("vsnprintf failed: %s\n", + strerror(errno)); +@@ -69,6 +66,8 @@ static void write_file(char *filename, c + + fd = open(filename, O_WRONLY); + if (fd < 0) { ++ if ((errno == ENOENT) && enoent_ok) ++ return; + die("open of %s failed: %s\n", + filename, strerror(errno)); + } +@@ -87,6 +86,26 @@ static void write_file(char *filename, c + } + } + ++static void maybe_write_file(char *filename, char *fmt, ...) ++{ ++ va_list ap; ++ ++ va_start(ap, fmt); ++ vmaybe_write_file(true, filename, fmt, ap); ++ va_end(ap); ++ ++} ++ ++static void write_file(char *filename, char *fmt, ...) ++{ ++ va_list ap; ++ ++ va_start(ap, fmt); ++ vmaybe_write_file(false, filename, fmt, ap); ++ va_end(ap); ++ ++} ++ + static void create_and_enter_userns(void) + { + uid_t uid; +@@ -100,13 +119,10 @@ static void create_and_enter_userns(void + strerror(errno)); + } + ++ maybe_write_file("/proc/self/setgroups", "deny"); + write_file("/proc/self/uid_map", "0 %d 1", uid); + write_file("/proc/self/gid_map", "0 %d 1", gid); + +- if (setgroups(0, NULL) != 0) { +- die("setgroups failed: %s\n", +- strerror(errno)); +- } + if (setgid(0) != 0) { + die ("setgid(0) failed %s\n", + strerror(errno)); -- 2.47.3