From: Greg Kroah-Hartman Date: Thu, 12 Jun 2014 22:57:32 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.94~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0708fdd7892d8fcd73fb30711fbb9e7e5941c080;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: auditsc-audit_krule-mask-accesses-need-bounds-checking.patch scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch --- diff --git a/queue-3.10/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch b/queue-3.10/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch new file mode 100644 index 00000000000..cab08789308 --- /dev/null +++ b/queue-3.10/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch @@ -0,0 +1,85 @@ +From a3c54931199565930d6d84f4c3456f6440aefd41 Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Wed, 28 May 2014 23:09:58 -0400 +Subject: auditsc: audit_krule mask accesses need bounds checking + +From: Andy Lutomirski + +commit a3c54931199565930d6d84f4c3456f6440aefd41 upstream. + +Fixes an easy DoS and possible information disclosure. + +This does nothing about the broken state of x32 auditing. + +eparis: If the admin has enabled auditd and has specifically loaded +audit rules. This bug has been around since before git. Wow... + +Signed-off-by: Andy Lutomirski +Signed-off-by: Eric Paris +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/auditsc.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -733,6 +733,22 @@ static enum audit_state audit_filter_tas + return AUDIT_BUILD_CONTEXT; + } + ++static int audit_in_mask(const struct audit_krule *rule, unsigned long val) ++{ ++ int word, bit; ++ ++ if (val > 0xffffffff) ++ return false; ++ ++ word = AUDIT_WORD(val); ++ if (word >= AUDIT_BITMASK_SIZE) ++ return false; ++ ++ bit = AUDIT_BIT(val); ++ ++ return rule->mask[word] & bit; ++} ++ + /* At syscall entry and exit time, this filter is called if the + * audit_state is not low enough that auditing cannot take place, but is + * also not high enough that we already know we have to write an audit +@@ -750,11 +766,8 @@ static enum audit_state audit_filter_sys + + rcu_read_lock(); + if (!list_empty(list)) { +- int word = AUDIT_WORD(ctx->major); +- int bit = AUDIT_BIT(ctx->major); +- + list_for_each_entry_rcu(e, list, list) { +- if ((e->rule.mask[word] & bit) == bit && ++ if (audit_in_mask(&e->rule, ctx->major) && + audit_filter_rules(tsk, &e->rule, ctx, NULL, + &state, false)) { + rcu_read_unlock(); +@@ -774,20 +787,16 @@ static enum audit_state audit_filter_sys + static int audit_filter_inode_name(struct task_struct *tsk, + struct audit_names *n, + struct audit_context *ctx) { +- int word, bit; + int h = audit_hash_ino((u32)n->ino); + struct list_head *list = &audit_inode_hash[h]; + struct audit_entry *e; + enum audit_state state; + +- word = AUDIT_WORD(ctx->major); +- bit = AUDIT_BIT(ctx->major); +- + if (list_empty(list)) + return 0; + + list_for_each_entry_rcu(e, list, list) { +- if ((e->rule.mask[word] & bit) == bit && ++ if (audit_in_mask(&e->rule, ctx->major) && + audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) { + ctx->current_state = state; + return 1; diff --git a/queue-3.10/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch b/queue-3.10/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch new file mode 100644 index 00000000000..1c0ab8309c0 --- /dev/null +++ b/queue-3.10/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch @@ -0,0 +1,60 @@ +From 11f8a7b31f2140b0dc164bb484281235ffbe51d3 Mon Sep 17 00:00:00 2001 +From: Ben Collins +Date: Fri, 13 Sep 2013 12:46:44 -0400 +Subject: SCSI: megaraid: Use resource_size_t for PCI resources, not long + +From: Ben Collins + +commit 11f8a7b31f2140b0dc164bb484281235ffbe51d3 upstream. + +The assumption that sizeof(long) >= sizeof(resource_size_t) can lead to +truncation of the PCI resource address, meaning this driver didn't work +on 32-bit systems with 64-bit PCI adressing ranges. + +Signed-off-by: Ben Collins +Acked-by: Sumit Saxena +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas.h | 1 - + drivers/scsi/megaraid/megaraid_sas_base.c | 5 +++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -1295,7 +1295,6 @@ struct megasas_instance { + u32 *reply_queue; + dma_addr_t reply_queue_h; + +- unsigned long base_addr; + struct megasas_register_set __iomem *reg_set; + + struct megasas_pd_list pd_list[MEGASAS_MAX_PD]; +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3461,6 +3461,7 @@ static int megasas_init_fw(struct megasa + u32 max_sectors_1; + u32 max_sectors_2; + u32 tmp_sectors, msix_enable; ++ resource_size_t base_addr; + struct megasas_register_set __iomem *reg_set; + struct megasas_ctrl_info *ctrl_info; + unsigned long bar_list; +@@ -3469,14 +3470,14 @@ static int megasas_init_fw(struct megasa + /* Find first memory bar */ + bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM); + instance->bar = find_first_bit(&bar_list, sizeof(unsigned long)); +- instance->base_addr = pci_resource_start(instance->pdev, instance->bar); + if (pci_request_selected_regions(instance->pdev, instance->bar, + "megasas: LSI")) { + printk(KERN_DEBUG "megasas: IO memory region busy!\n"); + return -EBUSY; + } + +- instance->reg_set = ioremap_nocache(instance->base_addr, 8192); ++ base_addr = pci_resource_start(instance->pdev, instance->bar); ++ instance->reg_set = ioremap_nocache(base_addr, 8192); + + if (!instance->reg_set) { + printk(KERN_DEBUG "megasas: Failed to map IO mem\n"); diff --git a/queue-3.10/series b/queue-3.10/series index 84562a45f34..5bc97f1bd2c 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -11,3 +11,5 @@ target-fix-alua_access_state-attribute-oops-for-un-configured-devices.patch mm-compaction-reset-cached-scanner-pfn-s-before-reading-them.patch mm-compaction-detect-when-scanners-meet-in-isolate_freepages.patch mm-compaction-make-isolate_freepages-start-at-pageblock-boundary.patch +auditsc-audit_krule-mask-accesses-need-bounds-checking.patch +scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch