diff options
Diffstat (limited to 'main/linux-grsec')
4 files changed, 4 insertions, 224 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD index 24b4be00a2..5382bb04a1 100644 --- a/main/linux-grsec/APKBUILD +++ b/main/linux-grsec/APKBUILD @@ -2,7 +2,7 @@ _mainflavor=grsec pkgname=linux-$_mainflavor -pkgver=4.1.19 +pkgver=4.1.20 case $pkgver in *.*.*) _kernver=${pkgver%.*};; *.*) _kernver=${pkgver};; @@ -31,13 +31,10 @@ source="http://ftp.kernel.org/pub/linux/kernel/v4.x/linux-$_kernver.tar.xz xsa155-linux-xsa155-0003-xen-netback-use-RING_COPY_REQUEST-throughout.patch xsa155-linux-xsa155-0004-xen-blkback-only-read-request-operation-from-shared-.patch xsa155-linux-xsa155-0006-xen-scsiback-safely-copy-requests.patch - xsa155-linux-xsa155-0007-xen-pciback-Save-xen_pci_op-commands-before-processi.patch xsa155-linux43-0005-xen-blkback-read-from-indirect-descriptors-only-once.patch xsa157-0001-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msi-wh.patch - xsa157-0002-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msix-w.patch xsa157-0003-xen-pciback-Do-not-install-an-IRQ-handler-for-MSI-in.patch xsa157-0004-xen-pciback-For-XEN_PCI_OP_disable_msi-x-only-disabl.patch - xsa157-0005-xen-pciback-Don-t-allow-MSI-X-ops-if-PCI_COMMAND_MEM.patch config-grsec.x86 config-grsec.x86_64 @@ -220,7 +217,7 @@ dev() { } md5sums="fe9dc0f6729f36400ea81aa41d614c37 linux-4.1.tar.xz -efde85f5c01e3e8045149b5246e37c85 patch-4.1.19.xz +06faf67e8b926915b94970981c3645e3 patch-4.1.20.xz b6c95ca850d6e31fd15c6dbbff9ade38 grsec-4.1.18-3.1-201509201149-alpine.patch b0337a2a9abed17c37eae5db332522d2 fix-spi-nor-namespace-clash.patch 1a307fc1d63231bf01d22493a4f14378 imx6q-no-unclocked-sleep.patch @@ -234,20 +231,17 @@ b0337a2a9abed17c37eae5db332522d2 fix-spi-nor-namespace-clash.patch 0bf4e9b42ff4c7feb968ab0e5b4a8be0 xsa155-linux-xsa155-0003-xen-netback-use-RING_COPY_REQUEST-throughout.patch f57e383a744db7ea6eb64d6a9e6fd5b0 xsa155-linux-xsa155-0004-xen-blkback-only-read-request-operation-from-shared-.patch 6b41c3dbec8f4897bc9014d2a1ed9e66 xsa155-linux-xsa155-0006-xen-scsiback-safely-copy-requests.patch -170b688697ab5a854f01d9d64d71098e xsa155-linux-xsa155-0007-xen-pciback-Save-xen_pci_op-commands-before-processi.patch 70ae93ddef7c9832ecde037c81009099 xsa155-linux43-0005-xen-blkback-read-from-indirect-descriptors-only-once.patch 56607a45cf844386189a42ce432f0ce2 xsa157-0001-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msi-wh.patch -c6f723a9e896e63bcdc474e633fee041 xsa157-0002-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msix-w.patch 0d045adaa831dc6b56c8a2528a96de9b xsa157-0003-xen-pciback-Do-not-install-an-IRQ-handler-for-MSI-in.patch a4b81926f3c77b5466de2934f989dabf xsa157-0004-xen-pciback-For-XEN_PCI_OP_disable_msi-x-only-disabl.patch -fa7f1deead8a0a9fdc34033573bd2f3e xsa157-0005-xen-pciback-Don-t-allow-MSI-X-ops-if-PCI_COMMAND_MEM.patch 8592323596689e3ef967ff96d1190d1b config-grsec.x86 81aab21a18c16cf96d0fa719564281ec config-grsec.x86_64 c4c15b3ba79bb557a67cd9356b56d7c4 config-grsec.armhf 28754e558f94f3b3e0b0fcc27c1c955f config-virtgrsec.x86 ae802ba9bdf0dfa50e7506a08bbf929d config-virtgrsec.x86_64" sha256sums="caf51f085aac1e1cea4d00dbbf3093ead07b551fc07b31b2a989c05f8ea72d9f linux-4.1.tar.xz -be12d828fd185db6f51c261dd41b2bf30e866ee85d2e2c166c3035d8084f7b8e patch-4.1.19.xz +c9cb7370fe790df645a13967919628e5bcf1ff333f334fedac6a3c474714c45d patch-4.1.20.xz 2d24b3a6234feb5a2a02c14061a6b769b46e07907604d9b43c60cb5145609125 grsec-4.1.18-3.1-201509201149-alpine.patch 01279cfb93273d99670c56e2465957ecde3d03693beeb929a743f03afa0b7bdc fix-spi-nor-namespace-clash.patch 21179fbb22a5b74af0a609350ae1a170e232908572b201d02e791d2ce0a685d3 imx6q-no-unclocked-sleep.patch @@ -261,20 +255,17 @@ cecdeccb8e2551252c81fc5f164a8298005df714a574a7ba18b84e8ed5f2bb70 xsa155-linux-x 3916b847243047f0e1053233ade742c14a7f29243584e60bf5db4842a8068855 xsa155-linux-xsa155-0003-xen-netback-use-RING_COPY_REQUEST-throughout.patch 746c8eb0aeb200d76156c88dfbbd49db79f567b88b07eda70f7c7d095721f05a xsa155-linux-xsa155-0004-xen-blkback-only-read-request-operation-from-shared-.patch 2e6d556d25b1cc16e71afde665ae3908f4fa8eab7e0d96283fc78400301baf92 xsa155-linux-xsa155-0006-xen-scsiback-safely-copy-requests.patch -5e130d8b61906015c6a94f8edd3cce97b172f96a265d97ecf370e7b45125b73d xsa155-linux-xsa155-0007-xen-pciback-Save-xen_pci_op-commands-before-processi.patch 590656d83ad7b6052b54659eccb3469658b3942c0dc1366423a66f2f5ac643e1 xsa155-linux43-0005-xen-blkback-read-from-indirect-descriptors-only-once.patch 0cb2d1729f17e640e33f11945f2e12eba85071238fab2dcc42f81b5d942c159b xsa157-0001-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msi-wh.patch -9bcb240a49a5cd48428cc9c01ee480297999b93f6977fdddd79ec715648aa244 xsa157-0002-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msix-w.patch 7c39b33d0e2d751970bbe56f463661c50aa5e4addc8eee35b80e9e1378e97b02 xsa157-0003-xen-pciback-Do-not-install-an-IRQ-handler-for-MSI-in.patch 1acfd6f4ea13db6a146d547640f50d0ad40480b914b021760a518ac82e8e4c71 xsa157-0004-xen-pciback-For-XEN_PCI_OP_disable_msi-x-only-disabl.patch -b864620709e4b55a908dd6955a090ca03a9a07cfb31b66e2e5211ab8f0c77e68 xsa157-0005-xen-pciback-Don-t-allow-MSI-X-ops-if-PCI_COMMAND_MEM.patch fbc303521afbecbe2dccbe9955d108af53aaaa3388f2ca0962fc93f26a535a56 config-grsec.x86 0d770dbef70ec200e9f0341f7840847c228ac5e5061401614aaa27db59922614 config-grsec.x86_64 01b4f4e7eae350d40749f34e916e69c101f2fb5b3b7c2bd1917c29b8df3c2668 config-grsec.armhf fcfeedde29606b94f79f79ceb9351bd5d018aca6a76bba04459d85e4ad94939f config-virtgrsec.x86 91bb0c7e6ad7b438daba3be79117007ecd68afb89857381034467837247edd56 config-virtgrsec.x86_64" sha512sums="168ef84a4e67619f9f53f3574e438542a5747f9b43443363cb83597fcdac9f40d201625c66e375a23226745eaada9176eb006ca023613cec089349e91751f3c0 linux-4.1.tar.xz -24617e34a5947b183b2203ecb24fb9002b5da4bd957df783c312bc9d109a406ce577e9fa9cddb1f1e165ef9e7db8a8979172886c5d5516e37c6ce9bcfd151fac patch-4.1.19.xz +5c919982d33270c75b49e1deda32a9704ac8c68c4f07595471357c6b98694a4429dbd85bb31f662e63150294c031205b2d31426e117d0197ce7afdfd45f1c313 patch-4.1.20.xz 21bb5c3b4d92852652bc2cc75c85c312f183f221b5c116404f0cde570f48ffc592cc9c4b251f8e5ad74a8c9f3990915bbdcd9795b6e1e273492e7f500631301d grsec-4.1.18-3.1-201509201149-alpine.patch 4e3aeb70712f9838afea75fe9e6c1389414d833a89286ea55441d6a8d54ce74b0e39b565721e3153443af0a614bff57c767251b7e5b81faa5e0784eddfcd2164 fix-spi-nor-namespace-clash.patch 87d1ad59732f265a5b0db54490dc1762c14ea4b868e7eb1aedc3ce57b48046de7bbc08cf5cfcf6f1380fa84063b0edb16ba3d5e3c5670be9bbb229275c88b221 imx6q-no-unclocked-sleep.patch @@ -288,13 +279,10 @@ e85369cec62f0b249362930bf32e03f277cfc7d9844e5250b5fd73a22dcc09720f1920bb5c5f1063 8814d694c2196ee4c8bcf52522622c56a166e6b77b414e9298190f23ed86c1e205410d3ba257a323d008c59df25496e2161d828bc99a34d445430115769495a8 xsa155-linux-xsa155-0003-xen-netback-use-RING_COPY_REQUEST-throughout.patch a79f354c4e82c0eefc9b346215a2e993508f139095a197565aa5c56b1e0981f06c66c4796d0fd97800ac25f1ff21f6921cb25a7dd455254fb446cf6845d8e0a3 xsa155-linux-xsa155-0004-xen-blkback-only-read-request-operation-from-shared-.patch 7640585542d6970d2d35d728091c770daab7ea24c4a5d61e268d27b4b4bc9742d5fa04a11cbff9ac890376397f0b39f693e433639325470f6e39cea7a283810e xsa155-linux-xsa155-0006-xen-scsiback-safely-copy-requests.patch -bf6c3c00e3b3b0030ba88dff96aead617e8b81a8add23811d029c1226f8a9cdacd348ccd109acafa536bcf553e0e0689e8cb4f2ccdf3dcb51e380ea07e197e0d xsa155-linux-xsa155-0007-xen-pciback-Save-xen_pci_op-commands-before-processi.patch 2c5246a7c0a8fb19b8adf70162501f0af111ad3d1816e6719ae61b28c2b11565b1bd7a82c04ab50dce1ed88ec2259de0903222976d8cdf4b17ad1e5002e101bd xsa155-linux43-0005-xen-blkback-read-from-indirect-descriptors-only-once.patch 672508160104509406ea2a0a9a605224366876d256e6b6e8312e3f166672524cdaaa60905aa475980f55b9fa6c7c88656219f651afabfa68e38ba22375788176 xsa157-0001-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msi-wh.patch -99d84812c8afb90cac4bd8df1b3f24ec3e915df7b738f78ccebac08b0efcdcf336c755f34566a3fac55622b5813008a3e3f4d3109d33af9ff1801b20694154c7 xsa157-0002-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msix-w.patch 09b8a301e326f97f2e6de6e98f0bf835aeaa631272224ba006ce312576e510e260807f0149855630b3449ec7d6728129f3170f8e05b9b815ca7d9a6f1cf6a75d xsa157-0003-xen-pciback-Do-not-install-an-IRQ-handler-for-MSI-in.patch 95abf6b5d92c322fbb318d40249f8bd0303b4848f70ad42250cac0768fe86129aaf2864031febd78a0b7171a54885e0fa44e6a28994b35b8f6f04e5b5198fb6f xsa157-0004-xen-pciback-For-XEN_PCI_OP_disable_msi-x-only-disabl.patch -7e80ef45487fde63b75d0cbcb75b76c902483a15d671c6422b13ae5b1c8798190859b861bf2413ff4330095f2cf15bb279e1c04ff6972af8245dbae5ba66f69d xsa157-0005-xen-pciback-Don-t-allow-MSI-X-ops-if-PCI_COMMAND_MEM.patch 819ff2d16b5c15399de9b3c254d4ed6b7ef580a5b7cdacb209d90d35d178e93e34a5d6159b0edfab4afec9decf404901a7504f7b106c62c3dba0cdb4f0951a61 config-grsec.x86 61b2f6b1264e51548c657b337a23592d7bdf0fe730f71e9039af098dd9ebd1b2bd7dbff1811ccb36c7c50b4cfef4cf19534a1f25ef05048a404fd6a6c3120a59 config-grsec.x86_64 3be2587ca157eff3910ad1cd4dd9013c699e08d6f8fdde22458caa423f17591a7b386aad5f592f79baac4da6b32f5965483c3080c1cf2bc906fdffbe33a16bf7 config-grsec.armhf diff --git a/main/linux-grsec/xsa155-linux-xsa155-0007-xen-pciback-Save-xen_pci_op-commands-before-processi.patch b/main/linux-grsec/xsa155-linux-xsa155-0007-xen-pciback-Save-xen_pci_op-commands-before-processi.patch deleted file mode 100644 index 2448b94bcf..0000000000 --- a/main/linux-grsec/xsa155-linux-xsa155-0007-xen-pciback-Save-xen_pci_op-commands-before-processi.patch +++ /dev/null @@ -1,81 +0,0 @@ -From f6f4388c917ce96b075a239a4535b8efc6064d14 Mon Sep 17 00:00:00 2001 -From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Date: Mon, 16 Nov 2015 12:40:48 -0500 -Subject: [PATCH 7/7] xen/pciback: Save xen_pci_op commands before processing - it - -Double fetch vulnerabilities that happen when a variable is -fetched twice from shared memory but a security check is only -performed the first time. - -The xen_pcibk_do_op function performs a switch statements on the op->cmd -value which is stored in shared memory. Interestingly this can result -in a double fetch vulnerability depending on the performed compiler -optimization. - -This patch fixes it by saving the xen_pci_op command before -processing it. We also use 'barrier' to make sure that the -compiler does not perform any optimization. - -This is part of XSA155. - -CC: stable@vger.kernel.org -Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Signed-off-by: Jan Beulich <JBeulich@suse.com> -Signed-off-by: David Vrabel <david.vrabel@citrix.com> -Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> ---- - drivers/xen/xen-pciback/pciback.h | 1 + - drivers/xen/xen-pciback/pciback_ops.c | 15 ++++++++++++++- - 2 files changed, 15 insertions(+), 1 deletion(-) - -diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h -index 58e38d5..4d529f3 100644 ---- a/drivers/xen/xen-pciback/pciback.h -+++ b/drivers/xen/xen-pciback/pciback.h -@@ -37,6 +37,7 @@ struct xen_pcibk_device { - struct xen_pci_sharedinfo *sh_info; - unsigned long flags; - struct work_struct op_work; -+ struct xen_pci_op op; - }; - - struct xen_pcibk_dev_data { -diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c -index c4a0666..a0e0e3e 100644 ---- a/drivers/xen/xen-pciback/pciback_ops.c -+++ b/drivers/xen/xen-pciback/pciback_ops.c -@@ -298,9 +298,11 @@ void xen_pcibk_do_op(struct work_struct *data) - container_of(data, struct xen_pcibk_device, op_work); - struct pci_dev *dev; - struct xen_pcibk_dev_data *dev_data = NULL; -- struct xen_pci_op *op = &pdev->sh_info->op; -+ struct xen_pci_op *op = &pdev->op; - int test_intx = 0; - -+ *op = pdev->sh_info->op; -+ barrier(); - dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn); - - if (dev == NULL) -@@ -342,6 +344,17 @@ void xen_pcibk_do_op(struct work_struct *data) - if ((dev_data->enable_intx != test_intx)) - xen_pcibk_control_isr(dev, 0 /* no reset */); - } -+ pdev->sh_info->op.err = op->err; -+ pdev->sh_info->op.value = op->value; -+#ifdef CONFIG_PCI_MSI -+ if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) { -+ unsigned int i; -+ -+ for (i = 0; i < op->value; i++) -+ pdev->sh_info->op.msix_entries[i].vector = -+ op->msix_entries[i].vector; -+ } -+#endif - /* Tell the driver domain that we're done. */ - wmb(); - clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags); --- -2.1.0 - diff --git a/main/linux-grsec/xsa157-0002-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msix-w.patch b/main/linux-grsec/xsa157-0002-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msix-w.patch deleted file mode 100644 index c35629d2f8..0000000000 --- a/main/linux-grsec/xsa157-0002-xen-pciback-Return-error-on-XEN_PCI_OP_enable_msix-w.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 19b33b70d423ddfea1daf7615eb7f605371a1841 Mon Sep 17 00:00:00 2001 -From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Date: Mon, 2 Nov 2015 18:07:44 -0500 -Subject: [PATCH v2 XSA157 2/5] xen/pciback: Return error on - XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled - -The guest sequence of: - - a) XEN_PCI_OP_enable_msix - b) XEN_PCI_OP_enable_msix - -results in hitting an NULL pointer due to using freed pointers. - -The device passed in the guest MUST have MSI-X capability. - -The a) constructs and SysFS representation of MSI and MSI groups. -The b) adds a second set of them but adding in to SysFS fails (duplicate entry). -'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that -in a) pdev->msi_irq_groups is still set) and also free's ALL of the -MSI-X entries of the device (the ones allocated in step a) and b)). - -The unwind code: 'free_msi_irqs' deletes all the entries and tries to -delete the pdev->msi_irq_groups (which hasn't been set to NULL). -However the pointers in the SysFS are already freed and we hit an -NULL pointer further on when 'strlen' is attempted on a freed pointer. - -The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard -against that. The check for msi_enabled is not stricly neccessary. - -This is part of XSA-157 - -CC: stable@vger.kernel.org -Reviewed-by: David Vrabel <david.vrabel@citrix.com> -Reviewed-by: Jan Beulich <jbeulich@suse.com> -Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> ---- - drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c -index 5ce573a..a107928 100644 ---- a/drivers/xen/xen-pciback/pciback_ops.c -+++ b/drivers/xen/xen-pciback/pciback_ops.c -@@ -206,9 +206,16 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev, - if (unlikely(verbose_request)) - printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n", - pci_name(dev)); -+ - if (op->value > SH_INFO_MAX_VEC) - return -EINVAL; - -+ if (dev->msix_enabled) -+ return -EALREADY; -+ -+ if (dev->msi_enabled) -+ return -ENXIO; -+ - entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL); - if (entries == NULL) - return -ENOMEM; --- -2.1.0 - diff --git a/main/linux-grsec/xsa157-0005-xen-pciback-Don-t-allow-MSI-X-ops-if-PCI_COMMAND_MEM.patch b/main/linux-grsec/xsa157-0005-xen-pciback-Don-t-allow-MSI-X-ops-if-PCI_COMMAND_MEM.patch deleted file mode 100644 index 85f06546c7..0000000000 --- a/main/linux-grsec/xsa157-0005-xen-pciback-Don-t-allow-MSI-X-ops-if-PCI_COMMAND_MEM.patch +++ /dev/null @@ -1,64 +0,0 @@ -From e9ab9e04ed76ef06b4ba9a30b3724ca563fdf1fa Mon Sep 17 00:00:00 2001 -From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> -Date: Mon, 2 Nov 2015 18:13:27 -0500 -Subject: [PATCH v2 XSA157 5/5] xen/pciback: Don't allow MSI-X ops if - PCI_COMMAND_MEMORY is not set. - -commit f598282f51 ("PCI: Fix the NIU MSI-X problem in a better way") -teaches us that dealing with MSI-X can be troublesome. - -Further checks in the MSI-X architecture shows that if the -PCI_COMMAND_MEMORY bit is turned of in the PCI_COMMAND we -may not be able to access the BAR (since they are memory regions). - -Since the MSI-X tables are located in there.. that can lead -to us causing PCIe errors. Inhibit us performing any -operation on the MSI-X unless the MEMORY bit is set. - -Note that Xen hypervisor with: -"x86/MSI-X: access MSI-X table only after having enabled MSI-X" -will return: -xen_pciback: 0000:0a:00.1: error -6 enabling MSI-X for guest 3! - -When the generic MSI code tries to setup the PIRQ without -MEMORY bit set. Which means with later versions of Xen -(4.6) this patch is not neccessary. - -This is part of XSA-157 - -CC: stable@vger.kernel.org -Reviewed-by: Jan Beulich <jbeulich@suse.com> -Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> ---- - drivers/xen/xen-pciback/pciback_ops.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c -index 648c09c..edb9357 100644 ---- a/drivers/xen/xen-pciback/pciback_ops.c -+++ b/drivers/xen/xen-pciback/pciback_ops.c -@@ -212,6 +212,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev, - struct xen_pcibk_dev_data *dev_data; - int i, result; - struct msix_entry *entries; -+ u16 cmd; - - if (unlikely(verbose_request)) - printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n", -@@ -223,7 +224,12 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev, - if (dev->msix_enabled) - return -EALREADY; - -- if (dev->msi_enabled) -+ /* -+ * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able -+ * to access the BARs where the MSI-X entries reside. -+ */ -+ pci_read_config_word(dev, PCI_COMMAND, &cmd); -+ if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY)) - return -ENXIO; - - entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL); --- -2.1.0 - |