3.10-stable patches

added patches:
	auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
	scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch

diff --git a/queue-3.10/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch b/queue-3.10/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
new file mode 100644 (file)
index 0000000..cab0878
--- /dev/null
+++ b/queue-3.10/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
@@ -0,0 +1,85 @@
+From a3c54931199565930d6d84f4c3456f6440aefd41 Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@amacapital.net>
+Date: Wed, 28 May 2014 23:09:58 -0400
+Subject: auditsc: audit_krule mask accesses need bounds checking
+
+From: Andy Lutomirski <luto@amacapital.net>
+
+commit a3c54931199565930d6d84f4c3456f6440aefd41 upstream.
+
+Fixes an easy DoS and possible information disclosure.
+
+This does nothing about the broken state of x32 auditing.
+
+eparis: If the admin has enabled auditd and has specifically loaded
+audit rules.  This bug has been around since before git.  Wow...
+
+Signed-off-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/auditsc.c |   27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -733,6 +733,22 @@ static enum audit_state audit_filter_tas
+       return AUDIT_BUILD_CONTEXT;
+ }
+ 
++static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
++{
++      int word, bit;
++
++      if (val > 0xffffffff)
++              return false;
++
++      word = AUDIT_WORD(val);
++      if (word >= AUDIT_BITMASK_SIZE)
++              return false;
++
++      bit = AUDIT_BIT(val);
++
++      return rule->mask[word] & bit;
++}
++
+ /* At syscall entry and exit time, this filter is called if the
+  * audit_state is not low enough that auditing cannot take place, but is
+  * also not high enough that we already know we have to write an audit
+@@ -750,11 +766,8 @@ static enum audit_state audit_filter_sys
+ 
+       rcu_read_lock();
+       if (!list_empty(list)) {
+-              int word = AUDIT_WORD(ctx->major);
+-              int bit  = AUDIT_BIT(ctx->major);
+-
+               list_for_each_entry_rcu(e, list, list) {
+-                      if ((e->rule.mask[word] & bit) == bit &&
++                      if (audit_in_mask(&e->rule, ctx->major) &&
+                           audit_filter_rules(tsk, &e->rule, ctx, NULL,
+                                              &state, false)) {
+                               rcu_read_unlock();
+@@ -774,20 +787,16 @@ static enum audit_state audit_filter_sys
+ static int audit_filter_inode_name(struct task_struct *tsk,
+                                  struct audit_names *n,
+                                  struct audit_context *ctx) {
+-      int word, bit;
+       int h = audit_hash_ino((u32)n->ino);
+       struct list_head *list = &audit_inode_hash[h];
+       struct audit_entry *e;
+       enum audit_state state;
+ 
+-      word = AUDIT_WORD(ctx->major);
+-      bit  = AUDIT_BIT(ctx->major);
+-
+       if (list_empty(list))
+               return 0;
+ 
+       list_for_each_entry_rcu(e, list, list) {
+-              if ((e->rule.mask[word] & bit) == bit &&
++              if (audit_in_mask(&e->rule, ctx->major) &&
+                   audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
+                       ctx->current_state = state;
+                       return 1;

diff --git a/queue-3.10/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch b/queue-3.10/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch
new file mode 100644 (file)
index 0000000..1c0ab83
--- /dev/null
+++ b/queue-3.10/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch
@@ -0,0 +1,60 @@
+From 11f8a7b31f2140b0dc164bb484281235ffbe51d3 Mon Sep 17 00:00:00 2001
+From: Ben Collins <ben.c@servergy.com>
+Date: Fri, 13 Sep 2013 12:46:44 -0400
+Subject: SCSI: megaraid: Use resource_size_t for PCI resources, not long
+
+From: Ben Collins <ben.c@servergy.com>
+
+commit 11f8a7b31f2140b0dc164bb484281235ffbe51d3 upstream.
+
+The assumption that sizeof(long) >= sizeof(resource_size_t) can lead to
+truncation of the PCI resource address, meaning this driver didn't work
+on 32-bit systems with 64-bit PCI adressing ranges.
+
+Signed-off-by: Ben Collins <ben.c@servergy.com>
+Acked-by: Sumit Saxena <sumit.saxena@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas.h      |    1 -
+ drivers/scsi/megaraid/megaraid_sas_base.c |    5 +++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas.h
++++ b/drivers/scsi/megaraid/megaraid_sas.h
+@@ -1295,7 +1295,6 @@ struct megasas_instance {
+       u32 *reply_queue;
+       dma_addr_t reply_queue_h;
+ 
+-      unsigned long base_addr;
+       struct megasas_register_set __iomem *reg_set;
+ 
+       struct megasas_pd_list          pd_list[MEGASAS_MAX_PD];
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3461,6 +3461,7 @@ static int megasas_init_fw(struct megasa
+       u32 max_sectors_1;
+       u32 max_sectors_2;
+       u32 tmp_sectors, msix_enable;
++      resource_size_t base_addr;
+       struct megasas_register_set __iomem *reg_set;
+       struct megasas_ctrl_info *ctrl_info;
+       unsigned long bar_list;
+@@ -3469,14 +3470,14 @@ static int megasas_init_fw(struct megasa
+       /* Find first memory bar */
+       bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
+       instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
+-      instance->base_addr = pci_resource_start(instance->pdev, instance->bar);
+       if (pci_request_selected_regions(instance->pdev, instance->bar,
+                                        "megasas: LSI")) {
+               printk(KERN_DEBUG "megasas: IO memory region busy!\n");
+               return -EBUSY;
+       }
+ 
+-      instance->reg_set = ioremap_nocache(instance->base_addr, 8192);
++      base_addr = pci_resource_start(instance->pdev, instance->bar);
++      instance->reg_set = ioremap_nocache(base_addr, 8192);
+ 
+       if (!instance->reg_set) {
+               printk(KERN_DEBUG "megasas: Failed to map IO mem\n");

diff --git a/queue-3.10/series b/queue-3.10/series
index 84562a45f347ed86b164071de319938cdf197dfc..5bc97f1bd2c9f3ddf1ce455d1805d2c51ee9237e 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -11,3 +11,5 @@ target-fix-alua_access_state-attribute-oops-for-un-configured-devices.patch
 mm-compaction-reset-cached-scanner-pfn-s-before-reading-them.patch
 mm-compaction-detect-when-scanners-meet-in-isolate_freepages.patch
 mm-compaction-make-isolate_freepages-start-at-pageblock-boundary.patch
+auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
+scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch