diff options
author | Josh Boyer <jwboyer@fedoraproject.org> | 2016-04-15 11:23:42 -0400 |
---|---|---|
committer | Josh Boyer <jwboyer@fedoraproject.org> | 2016-04-15 11:27:30 -0400 |
commit | 0fb64a2ea0de74f0e9619b257e3a0c0e90a4b632 (patch) | |
tree | 39247d33d484d269d7734d7dbe553614bd63fec7 | |
parent | 24a19dda7e285178056a6e32edc36b3598f8ded9 (diff) | |
download | kernel-0fb64a2ea0de74f0e9619b257e3a0c0e90a4b632.tar.gz kernel-0fb64a2ea0de74f0e9619b257e3a0c0e90a4b632.tar.xz kernel-0fb64a2ea0de74f0e9619b257e3a0c0e90a4b632.zip |
CVE-2016-3961 xen: hugetlbfs use may crash PV guests (rhbz 1327219 1323956)
-rw-r--r-- | kernel.spec | 6 | ||||
-rw-r--r-- | x86-xen-suppress-hugetlbfs-in-PV-guests.patch | 70 |
2 files changed, 76 insertions, 0 deletions
diff --git a/kernel.spec b/kernel.spec index 88456013c..607160c14 100644 --- a/kernel.spec +++ b/kernel.spec @@ -614,6 +614,9 @@ Patch683: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch #CVE-2016-2187 rhbz 1317017 1317010 Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch +# CVE-2016-3961 rhbz 1327219 1323956 +Patch699: x86-xen-suppress-hugetlbfs-in-PV-guests.patch + # END OF PATCH DEFINITIONS %endif @@ -2139,6 +2142,9 @@ fi # # %changelog +* Fri Apr 15 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-3961 xen: hugetlbfs use may crash PV guests (rhbz 1327219 1323956) + * Fri Apr 15 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc3.git2.1 - Linux v4.6-rc3-99-g806fdcce017d diff --git a/x86-xen-suppress-hugetlbfs-in-PV-guests.patch b/x86-xen-suppress-hugetlbfs-in-PV-guests.patch new file mode 100644 index 000000000..1b7c8f24a --- /dev/null +++ b/x86-xen-suppress-hugetlbfs-in-PV-guests.patch @@ -0,0 +1,70 @@ +From 72c339e0c6d9969e664c2cf63e162753d7d859ae Mon Sep 17 00:00:00 2001 +From: Jan Beulich <jbeulich@suse.com> +Date: Thu, 14 Apr 2016 13:03:47 +0000 +Subject: [PATCH] x86/xen: suppress hugetlbfs in PV guests + +Huge pages are not normally available to PV guests. Not suppressing +hugetlbfs use results in an endless loop of page faults when user mode +code tries to access a hugetlbfs mapped area (since the hypervisor +denies such PTEs to be created, but error indications can't be +propagated out of xen_set_pte_at(), just like for various of its +siblings), and - once killed in an oops like this: + +kernel BUG at .../fs/hugetlbfs/inode.c:428! +invalid opcode: 0000 [#1] SMP +Modules linked in: ... +Supported: Yes +CPU: 2 PID: 6088 Comm: hugetlbfs Tainted: G W 4.4.0-2016-01-20-pv #2 +Hardware name: ... +task: ffff8808059205c0 ti: ffff880803c84000 task.ti: ffff880803c84000 +RIP: e030:[<ffffffff811c333b>] [<ffffffff811c333b>] remove_inode_hugepages+0x25b/0x320 +RSP: e02b:ffff880803c879a8 EFLAGS: 00010202 +RAX: 000000000077a4db RBX: ffffea001acff000 RCX: 0000000078417d38 +RDX: 0000000000000000 RSI: 000000007e154fa7 RDI: ffff880805d70960 +RBP: 0000000000000960 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 +R13: ffff880807486018 R14: 0000000000000000 R15: ffff880803c87af0 +FS: 00007f85fa8b8700(0000) GS:ffff88080b640000(0000) knlGS:0000000000000000 +CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b +CR2: 00007f85fa000000 CR3: 0000000001a0a000 CR4: 0000000000040660 +Stack: + ffff880000000fb0 ffff880803c87a18 ffff880803c87ae8 ffff8808059205c0 + ffff880803c87af0 ffff880803c87ae8 ffff880807486018 0000000000000000 + ffffffff81bf6e60 ffff880807486168 000003ffffffffff 0000000003c87758 +Call Trace: + [<ffffffff811c3415>] hugetlbfs_evict_inode+0x15/0x40 + [<ffffffff81167b3d>] evict+0xbd/0x1b0 + [<ffffffff8116514a>] __dentry_kill+0x19a/0x1f0 + [<ffffffff81165b0e>] dput+0x1fe/0x220 + [<ffffffff81150535>] __fput+0x155/0x200 + [<ffffffff81079fc0>] task_work_run+0x60/0xa0 + [<ffffffff81063510>] do_exit+0x160/0x400 + [<ffffffff810637eb>] do_group_exit+0x3b/0xa0 + [<ffffffff8106e8bd>] get_signal+0x1ed/0x470 + [<ffffffff8100f854>] do_signal+0x14/0x110 + [<ffffffff810030e9>] prepare_exit_to_usermode+0xe9/0xf0 + [<ffffffff814178a5>] retint_user+0x8/0x13 + +This is XSA-174. + +Signed-off-by: Jan Beulich <jbeulich@suse.com> +Cc: stable@vger.kernel.org +--- + arch/x86/include/asm/hugetlb.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h +index f8a29d2c97b0..e6a8613fbfb0 100644 +--- a/arch/x86/include/asm/hugetlb.h ++++ b/arch/x86/include/asm/hugetlb.h +@@ -4,6 +4,7 @@ + #include <asm/page.h> + #include <asm-generic/hugetlb.h> + ++#define hugepages_supported() cpu_has_pse + + static inline int is_hugepage_only_range(struct mm_struct *mm, + unsigned long addr, +-- +2.5.5 + |