From 59c170500608f333d3336fb99513362ad148d871 Mon Sep 17 00:00:00 2001
From: Laura Abbott labbott@fedoraproject.org Date: Thu, 30 Apr 2015 13:21:39 -0700 Subject: Linux v3.19.6
diff --git a/fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-.patch b/fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-.patch deleted file mode 100644 index 0ca900d..0000000 --- a/fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-.patch +++ /dev/null @@ -1,116 +0,0 @@ -From: Jann Horn jann@thejh.net -Date: Sun, 19 Apr 2015 02:48:39 +0200 -Subject: [PATCH] fs: take i_mutex during prepare_binprm for set[ug]id - executables - -This prevents a race between chown() and execve(), where chowning a -setuid-user binary to root would momentarily make the binary setuid -root. - -This patch was mostly written by Linus Torvalds. - -Signed-off-by: Jann Horn jann@thejh.net -Signed-off-by: Linus Torvalds torvalds@linux-foundation.org ---- - fs/exec.c | 76 ++++++++++++++++++++++++++++++++++++++++----------------------- - 1 file changed, 48 insertions(+), 28 deletions(-) - -diff --git a/fs/exec.c b/fs/exec.c -index ad8798e26be9..4617a4ec52e3 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1259,6 +1259,53 @@ static void check_unsafe_exec(struct linux_binprm *bprm) - spin_unlock(&p->fs->lock); - } - -+static void bprm_fill_uid(struct linux_binprm *bprm) -+{ -+ struct inode *inode; -+ unsigned int mode; -+ kuid_t uid; -+ kgid_t gid; -+ -+ /* clear any previous set[ug]id data from a previous binary */ -+ bprm->cred->euid = current_euid(); -+ bprm->cred->egid = current_egid(); -+ -+ if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) -+ return; -+ -+ if (task_no_new_privs(current)) -+ return; -+ -+ inode = file_inode(bprm->file); -+ mode = READ_ONCE(inode->i_mode); -+ if (!(mode & (S_ISUID|S_ISGID))) -+ return; -+ -+ /* Be careful if suid/sgid is set */ -+ mutex_lock(&inode->i_mutex); -+ -+ /* reload atomically mode/uid/gid now that lock held */ -+ mode = inode->i_mode; -+ uid = inode->i_uid; -+ gid = inode->i_gid; -+ mutex_unlock(&inode->i_mutex); -+ -+ /* We ignore suid/sgid if there are no mappings for them in the ns */ -+ if (!kuid_has_mapping(bprm->cred->user_ns, uid) || -+ !kgid_has_mapping(bprm->cred->user_ns, gid)) -+ return; -+ -+ if (mode & S_ISUID) { -+ bprm->per_clear |= PER_CLEAR_ON_SETID; -+ bprm->cred->euid = uid; -+ } -+ -+ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { -+ bprm->per_clear |= PER_CLEAR_ON_SETID; -+ bprm->cred->egid = gid; -+ } -+} -+ - /* - * Fill the binprm structure from the inode. - * Check permissions, then read the first 128 (BINPRM_BUF_SIZE) bytes -@@ -1267,36 +1314,9 @@ static void check_unsafe_exec(struct linux_binprm *bprm) - */ - int prepare_binprm(struct linux_binprm *bprm) - { -- struct inode *inode = file_inode(bprm->file); -- umode_t mode = inode->i_mode; - int retval; - -- -- /* clear any previous set[ug]id data from a previous binary */ -- bprm->cred->euid = current_euid(); -- bprm->cred->egid = current_egid(); -- -- if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) && -- !task_no_new_privs(current) && -- kuid_has_mapping(bprm->cred->user_ns, inode->i_uid) && -- kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) { -- /* Set-uid? */ -- if (mode & S_ISUID) { -- bprm->per_clear |= PER_CLEAR_ON_SETID; -- bprm->cred->euid = inode->i_uid; -- } -- -- /* Set-gid? */ -- /* -- * If setgid is set but no group execute bit then this -- * is a candidate for mandatory locking, not a setgid -- * executable. -- */ -- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { -- bprm->per_clear |= PER_CLEAR_ON_SETID; -- bprm->cred->egid = inode->i_gid; -- } -- } -+ bprm_fill_uid(bprm); - - /* fill in binprm security blob */ - retval = security_bprm_set_creds(bprm); --- -2.1.0 - diff --git a/ipv6-Don-t-reduce-hop-limit-for-an-interface.patch b/ipv6-Don-t-reduce-hop-limit-for-an-interface.patch deleted file mode 100644 index 60f2490..0000000 --- a/ipv6-Don-t-reduce-hop-limit-for-an-interface.patch +++ /dev/null @@ -1,46 +0,0 @@ -From: "D.S. Ljungmark" ljungmark@modio.se -Date: Wed, 25 Mar 2015 09:28:15 +0100 -Subject: [PATCH] ipv6: Don't reduce hop limit for an interface - -A local route may have a lower hop_limit set than global routes do. - -RFC 3756, Section 4.2.7, "Parameter Spoofing" - -> 1. The attacker includes a Current Hop Limit of one or another small -> number which the attacker knows will cause legitimate packets to -> be dropped before they reach their destination. - -> As an example, one possible approach to mitigate this threat is to -> ignore very small hop limits. The nodes could implement a -> configurable minimum hop limit, and ignore attempts to set it below -> said limit. - -Signed-off-by: D.S. Ljungmark ljungmark@modio.se -Acked-by: Hannes Frederic Sowa hannes@stressinduktion.org ---- - net/ipv6/ndisc.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c -index 682866777d53..d375ce60463e 100644 ---- a/net/ipv6/ndisc.c -+++ b/net/ipv6/ndisc.c -@@ -1216,7 +1216,14 @@ static void ndisc_router_discovery(struct sk_buff *skb) - if (rt) - rt6_set_expires(rt, jiffies + (HZ * lifetime)); - if (ra_msg->icmph.icmp6_hop_limit) { -- in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; -+ /* Only set hop_limit on the interface if it is higher than -+ * the current hop_limit. -+ */ -+ if (in6_dev->cnf.hop_limit < ra_msg->icmph.icmp6_hop_limit) { -+ in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit; -+ } else { -+ ND_PRINTK(2, warn, "RA: Got route advertisement with lower hop_limit than current\n"); -+ } - if (rt) - dst_metric_set(&rt->dst, RTAX_HOPLIMIT, - ra_msg->icmph.icmp6_hop_limit); --- -2.1.0 - diff --git a/kernel.spec b/kernel.spec index 02e6dee..508df00 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel}
# Do we have a -stable update to apply? -%define stable_update 5 +%define stable_update 6 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -643,18 +643,9 @@ Patch26172: x86-microcode-intel-Guard-against-stack-overflow-in-.patch # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch
-#rhbz 1204512 -Patch26174: tun-return-proper-error-code-from-tun_do_read.patch - #CVE-2015-2150 rhbz 1196266 1200397 Patch26175: xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch
-#rhbz 1207789 -Patch26177: tg3-Hold-tp-lock-before-calling-tg3_halt-from-tg3_in.patch - -#CVE-2015-XXXX rhbz 1203712 1208491 -Patch26178: ipv6-Don-t-reduce-hop-limit-for-an-interface.patch - #rhbz 1208953 Patch26179: pty-Fix-input-race-when-closing.patch
@@ -667,9 +658,6 @@ Patch26181: 0001-iwlwifi-mvm-remove-WARN_ON-for-invalid-BA-notificati.patch #rhbz 1208999 Patch26182: SCSI-add-1024-max-sectors-black-list-flag.patch
-#CVE-2015-3330 rbhz 1214030 -Patch26188: fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-.patch - #rhbz 1204390 Patch26189: 0001-cx18-add-missing-caps-for-the-PCM-video-device.patch
@@ -1427,18 +1415,9 @@ ApplyPatch kernel-arm64.patch -R %endif %endif
-#rhbz 1204512 -ApplyPatch tun-return-proper-error-code-from-tun_do_read.patch - #CVE-2015-2150 rhbz 1196266 1200397 ApplyPatch xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch
-#rhbz 1207789 -ApplyPatch tg3-Hold-tp-lock-before-calling-tg3_halt-from-tg3_in.patch - -#CVE-2015-XXXX rhbz 1203712 1208491 -ApplyPatch ipv6-Don-t-reduce-hop-limit-for-an-interface.patch - #rhbz 1208953 ApplyPatch pty-Fix-input-race-when-closing.patch
@@ -1451,9 +1430,6 @@ ApplyPatch 0001-iwlwifi-mvm-remove-WARN_ON-for-invalid-BA-notificati.patch #rhbz 1208999 ApplyPatch SCSI-add-1024-max-sectors-black-list-flag.patch
-#CVE-2015-3330 rbhz 1214030 -ApplyPatch fs-take-i_mutex-during-prepare_binprm-for-set-ug-id-.patch - #rhbz 1204390 ApplyPatch 0001-cx18-add-missing-caps-for-the-PCM-video-device.patch
@@ -2320,6 +2296,9 @@ fi # ||----w | # || || %changelog +* Thu Apr 30 2015 Laura Abbott labbott@fedoraproject.org - 3.19.6-200 +- Linux v3.19.6 + * Thu Apr 30 2015 Josh Boyer jwboyer@fedoraproject.org - Fix backlight on various Toshiba machines (rhbz 1206036 1215989)
diff --git a/sources b/sources index c987edf..1fd2874 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ d3fc8316d4d4d04b65cbc2d70799e763 linux-3.19.tar.xz 15d8d2f97ce056488451a5bfb2944603 perf-man-3.19.tar.gz -f0f457204a1b286cc2ff04e470b01d64 patch-3.19.5.xz +8e92e0a77b8311bb89000e8e672dbd63 patch-3.19.6.xz diff --git a/tg3-Hold-tp-lock-before-calling-tg3_halt-from-tg3_in.patch b/tg3-Hold-tp-lock-before-calling-tg3_halt-from-tg3_in.patch deleted file mode 100644 index b65d0a0..0000000 --- a/tg3-Hold-tp-lock-before-calling-tg3_halt-from-tg3_in.patch +++ /dev/null @@ -1,44 +0,0 @@ -From: "Jun'ichi Nomura \(NEC\)" j-nomura@ce.jp.nec.com -Date: Thu, 12 Feb 2015 01:26:24 +0000 -Subject: [PATCH] tg3: Hold tp->lock before calling tg3_halt() from - tg3_init_one() - -tg3_init_one() calls tg3_halt() without tp->lock despite its assumption -and causes deadlock. -If lockdep is enabled, a warning like this shows up before the stall: - - [ BUG: bad unlock balance detected! ] - 3.19.0test #3 Tainted: G E - ------------------------------------- - insmod/369 is trying to release lock (&(&tp->lock)->rlock) at: - [<ffffffffa02d5a1d>] tg3_chip_reset+0x14d/0x780 [tg3] - but there are no more locks to release! - -tg3_init_one() doesn't call tg3_halt() under normal situation but -during kexec kdump I hit this problem. - -Fixes: 932f19de ("tg3: Release tp->lock before invoking synchronize_irq()") -Signed-off-by: Jun'ichi Nomura j-nomura@ce.jp.nec.com -Signed-off-by: David S. Miller davem@davemloft.net ---- - drivers/net/ethernet/broadcom/tg3.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 96bf01ba32dd..05ae12690117 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -17868,8 +17868,10 @@ static int tg3_init_one(struct pci_dev *pdev, - */ - if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) || - (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) { -+ tg3_full_lock(tp, 0); - tw32(MEMARB_MODE, MEMARB_MODE_ENABLE); - tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); -+ tg3_full_unlock(tp); - } - - err = tg3_test_dma(tp); --- -2.1.0 - diff --git a/tun-return-proper-error-code-from-tun_do_read.patch b/tun-return-proper-error-code-from-tun_do_read.patch deleted file mode 100644 index 5f65f32..0000000 --- a/tun-return-proper-error-code-from-tun_do_read.patch +++ /dev/null @@ -1,29 +0,0 @@ -From: Alex Gartrell agartrell@fb.com -Date: Thu, 25 Dec 2014 23:22:49 -0800 -Subject: [PATCH] tun: return proper error code from tun_do_read - -Instead of -1 with EAGAIN, read on a O_NONBLOCK tun fd will return 0. This -fixes this by properly returning the error code from __skb_recv_datagram. - -Signed-off-by: Alex Gartrell agartrell@fb.com -Signed-off-by: David S. Miller davem@davemloft.net ---- - drivers/net/tun.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 10f9e4021b5a..9a409a8f3b19 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1368,7 +1368,7 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile, - skb = __skb_recv_datagram(tfile->socket.sk, noblock ? MSG_DONTWAIT : 0, - &peeked, &off, &err); - if (!skb) -- return 0; -+ return err; - - ret = tun_put_user(tun, tfile, skb, to); - if (unlikely(ret < 0)) --- -2.1.0 -
scm-commits@lists.fedoraproject.org