Merge remote-tracking branch 'origin/f26' into f26-user-thl-vanilla-fedora

5 files changed, 97 insertions, 335 deletions

diff --git a/KEYS-prevent-KEYCTL_READ-on-negative-key.patch b/KEYS-prevent-KEYCTL_READ-on-negative-key.patch
new file mode 100644
index 000000000..d80176e66
--- /dev/null
+++ b/KEYS-prevent-KEYCTL_READ-on-negative-key.patch
@@ -0,0 +1,88 @@
+From patchwork Mon Sep 18 18:37:23 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: KEYS: prevent KEYCTL_READ on negative key
+From: Eric Biggers <ebiggers3@gmail.com>
+X-Patchwork-Id: 9957387
+Message-Id: <20170918183723.114253-1-ebiggers3@gmail.com>
+To: keyrings@vger.kernel.org
+Cc: David Howells <dhowells@redhat.com>, Michael Halcrow <mhalcrow@google.com>,
+ linux-security-module@vger.kernel.org,
+ linux-kernel@vger.kernel.org, Eric Biggers <ebiggers@google.com>,
+ stable@vger.kernel.org
+Date: Mon, 18 Sep 2017 11:37:23 -0700
+
+From: Eric Biggers <ebiggers@google.com>
+
+Because keyctl_read_key() looks up the key with no permissions
+requested, it may find a negatively instantiated key.  If the key is
+also possessed, we went ahead and called ->read() on the key.  But the
+key payload will actually contain the ->reject_error rather than the
+normal payload.  Thus, the kernel oopses trying to read the
+user_key_payload from memory address (int)-ENOKEY = 0x00000000ffffff82.
+
+Fortunately the payload data is stored inline, so it shouldn't be
+possible to abuse this as an arbitrary memory read primitive...
+
+Reproducer:
+    keyctl new_session
+    keyctl request2 user desc '' @s
+    keyctl read $(keyctl show | awk '/user: desc/ {print $1}')
+
+It causes a crash like the following:
+     BUG: unable to handle kernel paging request at 00000000ffffff92
+     IP: user_read+0x33/0xa0
+     PGD 36a54067 P4D 36a54067 PUD 0
+     Oops: 0000 [#1] SMP
+     CPU: 0 PID: 211 Comm: keyctl Not tainted 4.14.0-rc1 #337
+     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014
+     task: ffff90aa3b74c3c0 task.stack: ffff9878c0478000
+     RIP: 0010:user_read+0x33/0xa0
+     RSP: 0018:ffff9878c047bee8 EFLAGS: 00010246
+     RAX: 0000000000000001 RBX: ffff90aa3d7da340 RCX: 0000000000000017
+     RDX: 0000000000000000 RSI: 00000000ffffff82 RDI: ffff90aa3d7da340
+     RBP: ffff9878c047bf00 R08: 00000024f95da94f R09: 0000000000000000
+     R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
+     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+     FS:  00007f58ece69740(0000) GS:ffff90aa3e200000(0000) knlGS:0000000000000000
+     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+     CR2: 00000000ffffff92 CR3: 0000000036adc001 CR4: 00000000003606f0
+     Call Trace:
+      keyctl_read_key+0xac/0xe0
+      SyS_keyctl+0x99/0x120
+      entry_SYSCALL_64_fastpath+0x1f/0xbe
+     RIP: 0033:0x7f58ec787bb9
+     RSP: 002b:00007ffc8d401678 EFLAGS: 00000206 ORIG_RAX: 00000000000000fa
+     RAX: ffffffffffffffda RBX: 00007ffc8d402800 RCX: 00007f58ec787bb9
+     RDX: 0000000000000000 RSI: 00000000174a63ac RDI: 000000000000000b
+     RBP: 0000000000000004 R08: 00007ffc8d402809 R09: 0000000000000020
+     R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc8d402800
+     R13: 00007ffc8d4016e0 R14: 0000000000000000 R15: 0000000000000000
+     Code: e5 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb e8 a4 b4 ad ff 85 c0 74 09 80 3d b9 4c 96 00 00 74 43 48 8b b3 20 01 00 00 4d 85 ed <0f> b7 5e 10 74 29 4d 85 e4 74 24 4c 39 e3 4c 89 e2 4c 89 ef 48
+     RIP: user_read+0x33/0xa0 RSP: ffff9878c047bee8
+     CR2: 00000000ffffff92
+
+Fixes: 61ea0c0ba904 ("KEYS: Skip key state checks when checking for possession")
+Cc: <stable@vger.kernel.org>	[v3.13+]
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+---
+ security/keys/keyctl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index ab0b337c84b4..6a82090c7fc1 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -766,6 +766,11 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+ 
+ 	key = key_ref_to_ptr(key_ref);
+ 
++	if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
++		ret = -ENOKEY;
++		goto error2;
++	}
++
+ 	/* see if we can read it directly */
+ 	ret = key_permission(key_ref, KEY_NEED_READ);
+ 	if (ret == 0)
diff --git a/kernel.spec b/kernel.spec
index 4d5a12365..8d7fa4035 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -689,9 +689,6 @@ Patch706: Fix-for-module-sig-verification.patch
 # rhbz 1485086
 Patch710: pci-mark-amd-stoney-gpu-ats-as-broken.patch
 
-# CVE-2017-7558 rhbz 1480266 1484810
-Patch712: net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
-
 # CVE-2017-13693 rhbz 1485346 1485356
 Patch713: acpi-acpica-fix-acpi-operand-cache-leak-in-dsutils.c.patch
 
@@ -701,9 +698,6 @@ Patch714: V4-acpi-acpica-fix-acpi-parse-and-parseext-cache-leaks.patch
 # CVE-2017-13695 rhbz 1485349
 Patch715: acpi-acpica-fix-acpi-operand-cache-leak-in-nseval.c.patch
 
-# rhbz 1484587
-Patch716: md-raid-reset-bio-allocated-from-mempool.patch
-
 # CVE-2017-14051 rhbz 1487126 1487127
 Patch717: v2-scsi-qla2xxx-Fix-an-integer-overflow-in-sysfs-code.patch
 
@@ -719,6 +713,9 @@ Patch720: kvm-nVMX-Don-t-allow-L2-to-access-the-hardware-CR8.patch
 # CVE-2017-12153 rhbz 1491046 1491057
 Patch721: nl80211-check-for-the-required-netlink-attributes-presence.patch
 
+# rhbz 1493435 1493436
+Patch722: KEYS-prevent-KEYCTL_READ-on-negative-key.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2296,6 +2293,11 @@ fi
 #
 #
 %changelog
+* Wed Sep 20 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.12.14-300
+- Linux v4.12.14
+- Fixes 1493435 1493436
+- Fixes CVE-2017-14497 (rhbz 1492593 1492594)
+
 * Mon Sep 18 2017 Justin M. Forbes <jforbes@redhat.com>
 - Fixes for QXL (rhbz 1462381)
 
diff --git a/md-raid-reset-bio-allocated-from-mempool.patch b/md-raid-reset-bio-allocated-from-mempool.patch
deleted file mode 100644
index b3a73354f..000000000
--- a/md-raid-reset-bio-allocated-from-mempool.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From:       Shaohua Li <shli@kernel.org>
-Date:       2017-08-25 2:41:16
-Subject:    [PATCH] md/raid1/10: reset bio allocated from mempool
-
-From: Shaohua Li <shli@fb.com>
-
-Data allocated from mempool doesn't always get initialized, this happens when
-the data is reused instead of fresh allocation. In the raid1/10 case, we must
-reinitialize the bios.
-
-Reported-by: Jonathan G. Underwood <jonathan.underwood@gmail.com>
-Fixes: f0250618361d(md: raid10: don't use bio's vec table to manage resync pages)
-Fixes: 98d30c5812c3(md: raid1: don't use bio's vec table to manage resync pages)
-Cc: stable@vger.kernel.org (4.12+)
-Cc: Ming Lei <ming.lei@redhat.com>
-Signed-off-by: Shaohua Li <shli@fb.com>
----
- drivers/md/raid1.c  | 19 ++++++++++++++++++-
- drivers/md/raid10.c | 35 ++++++++++++++++++++++++++++++++---
- 2 files changed, 50 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index f50958ded9f0..79474f47eeef 100644
---- a/drivers/md/raid1.c
-+++ b/drivers/md/raid1.c
-@@ -2564,6 +2564,23 @@ static int init_resync(struct r1conf *conf)
- 	return 0;
- }
- 
-+static struct r1bio *raid1_alloc_init_r1buf(struct r1conf *conf)
-+{
-+	struct r1bio *r1bio = mempool_alloc(conf->r1buf_pool, GFP_NOIO);
-+	struct resync_pages *rps;
-+	struct bio *bio;
-+	int i;
-+
-+	for (i = conf->poolinfo->raid_disks; i--; ) {
-+		bio = r1bio->bios[i];
-+		rps = bio->bi_private;
-+		bio_reset(bio);
-+		bio->bi_private = rps;
-+	}
-+	r1bio->master_bio = NULL;
-+	return r1bio;
-+}
-+
- /*
-  * perform a "sync" on one "block"
-  *
-@@ -2649,7 +2666,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
- 
- 	bitmap_cond_end_sync(mddev->bitmap, sector_nr,
- 		mddev_is_clustered(mddev) && (sector_nr + 2 * RESYNC_SECTORS > conf->cluster_sync_high));
--	r1_bio = mempool_alloc(conf->r1buf_pool, GFP_NOIO);
-+	r1_bio = raid1_alloc_init_r1buf(conf);
- 
- 	raise_barrier(conf, sector_nr);
- 
-diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index f55d4cc085f6..d51ac02e98ef 100644
---- a/drivers/md/raid10.c
-+++ b/drivers/md/raid10.c
-@@ -2798,6 +2798,35 @@ static int init_resync(struct r10conf *conf)
- 	return 0;
- }
- 
-+static struct r10bio *raid10_alloc_init_r10buf(struct r10conf *conf)
-+{
-+	struct r10bio *r10bio = mempool_alloc(conf->r10buf_pool, GFP_NOIO);
-+	struct rsync_pages *rp;
-+	struct bio *bio;
-+	int nalloc;
-+	int i;
-+
-+	if (test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery) ||
-+	    test_bit(MD_RECOVERY_RESHAPE, &conf->mddev->recovery))
-+		nalloc = conf->copies; /* resync */
-+	else
-+		nalloc = 2; /* recovery */
-+
-+	for (i = 0; i < nalloc; i++) {
-+		bio = r10bio->devs[i].bio;
-+		rp = bio->bi_private;
-+		bio_reset(bio);
-+		bio->bi_private = rp;
-+		bio = r10bio->devs[i].repl_bio;
-+		if (bio) {
-+			rp = bio->bi_private;
-+			bio_reset(bio);
-+			bio->bi_private = rp;
-+		}
-+	}
-+	return r10bio;
-+}
-+
- /*
-  * perform a "sync" on one "block"
-  *
-@@ -3027,7 +3056,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
- 				atomic_inc(&mreplace->nr_pending);
- 			rcu_read_unlock();
- 
--			r10_bio = mempool_alloc(conf->r10buf_pool, GFP_NOIO);
-+			r10_bio = raid10_alloc_init_r10buf(conf);
- 			r10_bio->state = 0;
- 			raise_barrier(conf, rb2 != NULL);
- 			atomic_set(&r10_bio->remaining, 0);
-@@ -3236,7 +3265,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
- 		}
- 		if (sync_blocks < max_sync)
- 			max_sync = sync_blocks;
--		r10_bio = mempool_alloc(conf->r10buf_pool, GFP_NOIO);
-+		r10_bio = raid10_alloc_init_r10buf(conf);
- 		r10_bio->state = 0;
- 
- 		r10_bio->mddev = mddev;
-@@ -4360,7 +4389,7 @@ static sector_t reshape_request(struct mddev *mddev, sector_t sector_nr,
- 
- read_more:
- 	/* Now schedule reads for blocks from sector_nr to last */
--	r10_bio = mempool_alloc(conf->r10buf_pool, GFP_NOIO);
-+	r10_bio = raid10_alloc_init_r10buf(conf);
- 	r10_bio->state = 0;
- 	raise_barrier(conf, sectors_done != 0);
- 	atomic_set(&r10_bio->remaining, 0);
--- 
-2.11.0
-
---
-To unsubscribe from this list: send the line "unsubscribe linux-raid" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff --git a/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch b/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
deleted file mode 100644
index 84968f03f..000000000
--- a/net-sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
+++ /dev/null
@@ -1,196 +0,0 @@
-From patchwork Wed Aug 23 11:27:13 2017
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: [net] sctp: Avoid out-of-bounds reads from address storage
-From: Stefano Brivio <sbrivio@redhat.com>
-X-Patchwork-Id: 9917151
-Message-Id: <7763d91bcf14744e49f09fc4bec0fb22c097774f.1502384055.git.sbrivio@redhat.com>
-To: "David S . Miller" <davem@davemloft.net>, netdev@vger.kernel.org,
- linux-kernel@vger.kernel.org, stable@vger.kernel.org
-Cc: Xin Long <lucien.xin@gmail.com>, Vlad Yasevich <vyasevich@gmail.com>,
- Neil Horman <nhorman@tuxdriver.com>, linux-sctp@vger.kernel.org
-Date: Wed, 23 Aug 2017 13:27:13 +0200
-
-inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() copy
-sizeof(sockaddr_storage) bytes to fill in sockaddr structs used
-to export diagnostic information to userspace.
-
-However, the memory allocated to store sockaddr information is
-smaller than that and depends on the address family, so we leak
-up to 100 uninitialized bytes to userspace. Just use the size of
-the source structs instead, in all the three cases this is what
-userspace expects. Zero out the remaining memory.
-
-Unused bytes (i.e. when IPv4 addresses are used) in source
-structs sctp_sockaddr_entry and sctp_transport are already
-cleared by sctp_add_bind_addr() and sctp_transport_new(),
-respectively.
-
-Noticed while testing KASAN-enabled kernel with 'ss':
-
-[ 2326.885243] BUG: KASAN: slab-out-of-bounds in inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag] at addr ffff881be8779800
-[ 2326.896800] Read of size 128 by task ss/9527
-[ 2326.901564] CPU: 0 PID: 9527 Comm: ss Not tainted 4.11.0-22.el7a.x86_64 #1
-[ 2326.909236] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017
-[ 2326.917585] Call Trace:
-[ 2326.920312]  dump_stack+0x63/0x8d
-[ 2326.924014]  kasan_object_err+0x21/0x70
-[ 2326.928295]  kasan_report+0x288/0x540
-[ 2326.932380]  ? inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag]
-[ 2326.938500]  ? skb_put+0x8b/0xd0
-[ 2326.942098]  ? memset+0x31/0x40
-[ 2326.945599]  check_memory_region+0x13c/0x1a0
-[ 2326.950362]  memcpy+0x23/0x50
-[ 2326.953669]  inet_sctp_diag_fill+0x42c/0x6c0 [sctp_diag]
-[ 2326.959596]  ? inet_diag_msg_sctpasoc_fill+0x460/0x460 [sctp_diag]
-[ 2326.966495]  ? __lock_sock+0x102/0x150
-[ 2326.970671]  ? sock_def_wakeup+0x60/0x60
-[ 2326.975048]  ? remove_wait_queue+0xc0/0xc0
-[ 2326.979619]  sctp_diag_dump+0x44a/0x760 [sctp_diag]
-[ 2326.985063]  ? sctp_ep_dump+0x280/0x280 [sctp_diag]
-[ 2326.990504]  ? memset+0x31/0x40
-[ 2326.994007]  ? mutex_lock+0x12/0x40
-[ 2326.997900]  __inet_diag_dump+0x57/0xb0 [inet_diag]
-[ 2327.003340]  ? __sys_sendmsg+0x150/0x150
-[ 2327.007715]  inet_diag_dump+0x4d/0x80 [inet_diag]
-[ 2327.012979]  netlink_dump+0x1e6/0x490
-[ 2327.017064]  __netlink_dump_start+0x28e/0x2c0
-[ 2327.021924]  inet_diag_handler_cmd+0x189/0x1a0 [inet_diag]
-[ 2327.028045]  ? inet_diag_rcv_msg_compat+0x1b0/0x1b0 [inet_diag]
-[ 2327.034651]  ? inet_diag_dump_compat+0x190/0x190 [inet_diag]
-[ 2327.040965]  ? __netlink_lookup+0x1b9/0x260
-[ 2327.045631]  sock_diag_rcv_msg+0x18b/0x1e0
-[ 2327.050199]  netlink_rcv_skb+0x14b/0x180
-[ 2327.054574]  ? sock_diag_bind+0x60/0x60
-[ 2327.058850]  sock_diag_rcv+0x28/0x40
-[ 2327.062837]  netlink_unicast+0x2e7/0x3b0
-[ 2327.067212]  ? netlink_attachskb+0x330/0x330
-[ 2327.071975]  ? kasan_check_write+0x14/0x20
-[ 2327.076544]  netlink_sendmsg+0x5be/0x730
-[ 2327.080918]  ? netlink_unicast+0x3b0/0x3b0
-[ 2327.085486]  ? kasan_check_write+0x14/0x20
-[ 2327.090057]  ? selinux_socket_sendmsg+0x24/0x30
-[ 2327.095109]  ? netlink_unicast+0x3b0/0x3b0
-[ 2327.099678]  sock_sendmsg+0x74/0x80
-[ 2327.103567]  ___sys_sendmsg+0x520/0x530
-[ 2327.107844]  ? __get_locked_pte+0x178/0x200
-[ 2327.112510]  ? copy_msghdr_from_user+0x270/0x270
-[ 2327.117660]  ? vm_insert_page+0x360/0x360
-[ 2327.122133]  ? vm_insert_pfn_prot+0xb4/0x150
-[ 2327.126895]  ? vm_insert_pfn+0x32/0x40
-[ 2327.131077]  ? vvar_fault+0x71/0xd0
-[ 2327.134968]  ? special_mapping_fault+0x69/0x110
-[ 2327.140022]  ? __do_fault+0x42/0x120
-[ 2327.144008]  ? __handle_mm_fault+0x1062/0x17a0
-[ 2327.148965]  ? __fget_light+0xa7/0xc0
-[ 2327.153049]  __sys_sendmsg+0xcb/0x150
-[ 2327.157133]  ? __sys_sendmsg+0xcb/0x150
-[ 2327.161409]  ? SyS_shutdown+0x140/0x140
-[ 2327.165688]  ? exit_to_usermode_loop+0xd0/0xd0
-[ 2327.170646]  ? __do_page_fault+0x55d/0x620
-[ 2327.175216]  ? __sys_sendmsg+0x150/0x150
-[ 2327.179591]  SyS_sendmsg+0x12/0x20
-[ 2327.183384]  do_syscall_64+0xe3/0x230
-[ 2327.187471]  entry_SYSCALL64_slow_path+0x25/0x25
-[ 2327.192622] RIP: 0033:0x7f41d18fa3b0
-[ 2327.196608] RSP: 002b:00007ffc3b731218 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
-[ 2327.205055] RAX: ffffffffffffffda RBX: 00007ffc3b731380 RCX: 00007f41d18fa3b0
-[ 2327.213017] RDX: 0000000000000000 RSI: 00007ffc3b731340 RDI: 0000000000000003
-[ 2327.220978] RBP: 0000000000000002 R08: 0000000000000004 R09: 0000000000000040
-[ 2327.228939] R10: 00007ffc3b730f30 R11: 0000000000000246 R12: 0000000000000003
-[ 2327.236901] R13: 00007ffc3b731340 R14: 00007ffc3b7313d0 R15: 0000000000000084
-[ 2327.244865] Object at ffff881be87797e0, in cache kmalloc-64 size: 64
-[ 2327.251953] Allocated:
-[ 2327.254581] PID = 9484
-[ 2327.257215]  save_stack_trace+0x1b/0x20
-[ 2327.261485]  save_stack+0x46/0xd0
-[ 2327.265179]  kasan_kmalloc+0xad/0xe0
-[ 2327.269165]  kmem_cache_alloc_trace+0xe6/0x1d0
-[ 2327.274138]  sctp_add_bind_addr+0x58/0x180 [sctp]
-[ 2327.279400]  sctp_do_bind+0x208/0x310 [sctp]
-[ 2327.284176]  sctp_bind+0x61/0xa0 [sctp]
-[ 2327.288455]  inet_bind+0x5f/0x3a0
-[ 2327.292151]  SYSC_bind+0x1a4/0x1e0
-[ 2327.295944]  SyS_bind+0xe/0x10
-[ 2327.299349]  do_syscall_64+0xe3/0x230
-[ 2327.303433]  return_from_SYSCALL_64+0x0/0x6a
-[ 2327.308194] Freed:
-[ 2327.310434] PID = 4131
-[ 2327.313065]  save_stack_trace+0x1b/0x20
-[ 2327.317344]  save_stack+0x46/0xd0
-[ 2327.321040]  kasan_slab_free+0x73/0xc0
-[ 2327.325220]  kfree+0x96/0x1a0
-[ 2327.328530]  dynamic_kobj_release+0x15/0x40
-[ 2327.333195]  kobject_release+0x99/0x1e0
-[ 2327.337472]  kobject_put+0x38/0x70
-[ 2327.341266]  free_notes_attrs+0x66/0x80
-[ 2327.345545]  mod_sysfs_teardown+0x1a5/0x270
-[ 2327.350211]  free_module+0x20/0x2a0
-[ 2327.354099]  SyS_delete_module+0x2cb/0x2f0
-[ 2327.358667]  do_syscall_64+0xe3/0x230
-[ 2327.362750]  return_from_SYSCALL_64+0x0/0x6a
-[ 2327.367510] Memory state around the buggy address:
-[ 2327.372855]  ffff881be8779700: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc
-[ 2327.380914]  ffff881be8779780: fb fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00
-[ 2327.388972] >ffff881be8779800: 00 00 00 00 fc fc fc fc fb fb fb fb fb fb fb fb
-[ 2327.397031]                                ^
-[ 2327.401792]  ffff881be8779880: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
-[ 2327.409850]  ffff881be8779900: 00 00 00 00 00 04 fc fc fc fc fc fc 00 00 00 00
-[ 2327.417907] ==================================================================
-
-This fixes CVE-2017-7558.
-
-References: https://bugzilla.redhat.com/show_bug.cgi?id=1480266
-Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
-Cc: <stable@vger.kernel.org> # 4.7+
-Cc: Xin Long <lucien.xin@gmail.com>
-Cc: Vlad Yasevich <vyasevich@gmail.com>
-Cc: Neil Horman <nhorman@tuxdriver.com>
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
-Reviewed-by: Xin Long <lucien.xin@gmail.com>
----
- net/sctp/sctp_diag.c | 7 +++++--
- net/sctp/socket.c    | 3 +--
- 2 files changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
-index 9a647214a91e..e99518e79b52 100644
---- a/net/sctp/sctp_diag.c
-+++ b/net/sctp/sctp_diag.c
-@@ -70,7 +70,8 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
- 
- 	info = nla_data(attr);
- 	list_for_each_entry_rcu(laddr, address_list, list) {
--		memcpy(info, &laddr->a, addrlen);
-+		memcpy(info, &laddr->a, sizeof(laddr->a));
-+		memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
- 		info += addrlen;
- 	}
- 
-@@ -93,7 +94,9 @@ static int inet_diag_msg_sctpaddrs_fill(struct sk_buff *skb,
- 	info = nla_data(attr);
- 	list_for_each_entry(from, &asoc->peer.transport_addr_list,
- 			    transports) {
--		memcpy(info, &from->ipaddr, addrlen);
-+		memcpy(info, &from->ipaddr, sizeof(from->ipaddr));
-+		memset(info + sizeof(from->ipaddr), 0,
-+		       addrlen - sizeof(from->ipaddr));
- 		info += addrlen;
- 	}
- 
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 1db478e34520..8d760863bc41 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -4538,8 +4538,7 @@ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
- 	info->sctpi_ictrlchunks = asoc->stats.ictrlchunks;
- 
- 	prim = asoc->peer.primary_path;
--	memcpy(&info->sctpi_p_address, &prim->ipaddr,
--	       sizeof(struct sockaddr_storage));
-+	memcpy(&info->sctpi_p_address, &prim->ipaddr, sizeof(prim->ipaddr));
- 	info->sctpi_p_state = prim->state;
- 	info->sctpi_p_cwnd = prim->cwnd;
- 	info->sctpi_p_srtt = prim->srtt;
diff --git a/sources b/sources
index 03a00b9e0..fc1667589 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (perf-man-4.12.tar.gz) = 4d3bbda1f520dba0007c351af46f45085fe4842074eb2e01aee736fd369df595f8f72ed6c1192715f1120bf3353279777f9dca1178fe93bffe5be2de700d409c
 SHA512 (linux-4.12.tar.xz) = 8e81b41b253e63233e92948941f44c6482acb52aa3a3fd172f03a38a86f2c35b2ad4fd407acd1bc3964673eba344fe104d3a03e3ff4bf9cd1f22bd44263bd728
-SHA512 (patch-4.12.13.xz) = c7991705a0f76a09c22777159c93c0c4c0c60c5663432da41ebefdd93ed220abec5584a02c39f12ef46148b9cb23aa50723b3159ba3467effffcf3cf1bf4f6cd
+SHA512 (patch-4.12.14.xz) = 8bef19b2a87147b4ac7c5852d6cac0281c7df7deb84460c6462c981b9213d288061c19535bd9a4da03db73f8a9fd2fb76bf9c6d42b0b6ad1f30c97d5ee0964d1