3.4-stable patches

added patches:
	auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
	scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch

diff --git a/queue-3.4/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch b/queue-3.4/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
new file mode 100644 (file)
index 0000000..902078e
--- /dev/null
+++ b/queue-3.4/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
@@ -0,0 +1,85 @@
+From a3c54931199565930d6d84f4c3456f6440aefd41 Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@amacapital.net>
+Date: Wed, 28 May 2014 23:09:58 -0400
+Subject: auditsc: audit_krule mask accesses need bounds checking
+
+From: Andy Lutomirski <luto@amacapital.net>
+
+commit a3c54931199565930d6d84f4c3456f6440aefd41 upstream.
+
+Fixes an easy DoS and possible information disclosure.
+
+This does nothing about the broken state of x32 auditing.
+
+eparis: If the admin has enabled auditd and has specifically loaded
+audit rules.  This bug has been around since before git.  Wow...
+
+Signed-off-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/auditsc.c |   27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -868,6 +868,22 @@ static enum audit_state audit_filter_tas
+       return AUDIT_BUILD_CONTEXT;
+ }
+ 
++static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
++{
++      int word, bit;
++
++      if (val > 0xffffffff)
++              return false;
++
++      word = AUDIT_WORD(val);
++      if (word >= AUDIT_BITMASK_SIZE)
++              return false;
++
++      bit = AUDIT_BIT(val);
++
++      return rule->mask[word] & bit;
++}
++
+ /* At syscall entry and exit time, this filter is called if the
+  * audit_state is not low enough that auditing cannot take place, but is
+  * also not high enough that we already know we have to write an audit
+@@ -885,11 +901,8 @@ static enum audit_state audit_filter_sys
+ 
+       rcu_read_lock();
+       if (!list_empty(list)) {
+-              int word = AUDIT_WORD(ctx->major);
+-              int bit  = AUDIT_BIT(ctx->major);
+-
+               list_for_each_entry_rcu(e, list, list) {
+-                      if ((e->rule.mask[word] & bit) == bit &&
++                      if (audit_in_mask(&e->rule, ctx->major) &&
+                           audit_filter_rules(tsk, &e->rule, ctx, NULL,
+                                              &state, false)) {
+                               rcu_read_unlock();
+@@ -909,20 +922,16 @@ static enum audit_state audit_filter_sys
+ static int audit_filter_inode_name(struct task_struct *tsk,
+                                  struct audit_names *n,
+                                  struct audit_context *ctx) {
+-      int word, bit;
+       int h = audit_hash_ino((u32)n->ino);
+       struct list_head *list = &audit_inode_hash[h];
+       struct audit_entry *e;
+       enum audit_state state;
+ 
+-      word = AUDIT_WORD(ctx->major);
+-      bit  = AUDIT_BIT(ctx->major);
+-
+       if (list_empty(list))
+               return 0;
+ 
+       list_for_each_entry_rcu(e, list, list) {
+-              if ((e->rule.mask[word] & bit) == bit &&
++              if (audit_in_mask(&e->rule, ctx->major) &&
+                   audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
+                       ctx->current_state = state;
+                       return 1;

diff --git a/queue-3.4/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch b/queue-3.4/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch
new file mode 100644 (file)
index 0000000..2b8996f
--- /dev/null
+++ b/queue-3.4/scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch
@@ -0,0 +1,60 @@
+From 11f8a7b31f2140b0dc164bb484281235ffbe51d3 Mon Sep 17 00:00:00 2001
+From: Ben Collins <ben.c@servergy.com>
+Date: Fri, 13 Sep 2013 12:46:44 -0400
+Subject: SCSI: megaraid: Use resource_size_t for PCI resources, not long
+
+From: Ben Collins <ben.c@servergy.com>
+
+commit 11f8a7b31f2140b0dc164bb484281235ffbe51d3 upstream.
+
+The assumption that sizeof(long) >= sizeof(resource_size_t) can lead to
+truncation of the PCI resource address, meaning this driver didn't work
+on 32-bit systems with 64-bit PCI adressing ranges.
+
+Signed-off-by: Ben Collins <ben.c@servergy.com>
+Acked-by: Sumit Saxena <sumit.saxena@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas.h      |    1 -
+ drivers/scsi/megaraid/megaraid_sas_base.c |    5 +++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas.h
++++ b/drivers/scsi/megaraid/megaraid_sas.h
+@@ -1294,7 +1294,6 @@ struct megasas_instance {
+       u32 *reply_queue;
+       dma_addr_t reply_queue_h;
+ 
+-      unsigned long base_addr;
+       struct megasas_register_set __iomem *reg_set;
+ 
+       struct megasas_pd_list          pd_list[MEGASAS_MAX_PD];
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3445,6 +3445,7 @@ static int megasas_init_fw(struct megasa
+       u32 max_sectors_1;
+       u32 max_sectors_2;
+       u32 tmp_sectors, msix_enable;
++      resource_size_t base_addr;
+       struct megasas_register_set __iomem *reg_set;
+       struct megasas_ctrl_info *ctrl_info;
+       unsigned long bar_list;
+@@ -3453,14 +3454,14 @@ static int megasas_init_fw(struct megasa
+       /* Find first memory bar */
+       bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
+       instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
+-      instance->base_addr = pci_resource_start(instance->pdev, instance->bar);
+       if (pci_request_selected_regions(instance->pdev, instance->bar,
+                                        "megasas: LSI")) {
+               printk(KERN_DEBUG "megasas: IO memory region busy!\n");
+               return -EBUSY;
+       }
+ 
+-      instance->reg_set = ioremap_nocache(instance->base_addr, 8192);
++      base_addr = pci_resource_start(instance->pdev, instance->bar);
++      instance->reg_set = ioremap_nocache(base_addr, 8192);
+ 
+       if (!instance->reg_set) {
+               printk(KERN_DEBUG "megasas: Failed to map IO mem\n");

diff --git a/queue-3.4/series b/queue-3.4/series
index 3f8fe3d979738aff8e8f5c205103362526ef0bb5..490bf0dd4d5b2b90c4bc898966b6136f9339b6cf 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -3,3 +3,5 @@ netfilter-ipv4-defrag-set-local_df-flag-on-defragmented-skb.patch
 powerpc-fix-64-bit-builds-with-binutils-2.24.patch
 zram-protect-sysfs-handler-from-invalid-memory-access.patch
 staging-zram-fix-memory-leak-by-refcount-mismatch.patch
+auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
+scsi-megaraid-use-resource_size_t-for-pci-resources-not-long.patch