diff options
| -rw-r--r-- | 0001-ipmi_si-Fix-error-handling-of-platform-device.patch | 54 | ||||
| -rw-r--r-- | 0001-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch | 85 | ||||
| -rw-r--r-- | kernel.spec | 11 | ||||
| -rw-r--r-- | sources | 2 |
4 files changed, 5 insertions, 147 deletions
diff --git a/0001-ipmi_si-Fix-error-handling-of-platform-device.patch b/0001-ipmi_si-Fix-error-handling-of-platform-device.patch deleted file mode 100644 index 9a3619684..000000000 --- a/0001-ipmi_si-Fix-error-handling-of-platform-device.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 174134ac760275457bb0d1560a0dbe6cf8a12ad6 Mon Sep 17 00:00:00 2001 -From: Corey Minyard <cminyard@mvista.com> -Date: Mon, 27 Nov 2017 08:18:33 -0600 -Subject: [PATCH] ipmi_si: Fix error handling of platform device - -Cleanup of platform devices created by the IPMI driver was not -being done correctly and could result in a memory leak. So -create a local boolean to know how to clean up those platform -devices. - -Reported-by: David Binderman <dcb314@hotmail.com> -Signed-off-by: Corey Minyard <cminyard@mvista.com> ---- - drivers/char/ipmi/ipmi_si_intf.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c -index 71fad747c0c7..7499b0cd8326 100644 ---- a/drivers/char/ipmi/ipmi_si_intf.c -+++ b/drivers/char/ipmi/ipmi_si_intf.c -@@ -2045,6 +2045,7 @@ static int try_smi_init(struct smi_info *new_smi) - int rv = 0; - int i; - char *init_name = NULL; -+ bool platform_device_registered = false; - - pr_info(PFX "Trying %s-specified %s state machine at %s address 0x%lx, slave address 0x%x, irq %d\n", - ipmi_addr_src_to_str(new_smi->io.addr_source), -@@ -2173,6 +2174,7 @@ static int try_smi_init(struct smi_info *new_smi) - rv); - goto out_err; - } -+ platform_device_registered = true; - } - - dev_set_drvdata(new_smi->io.dev, new_smi); -@@ -2279,10 +2281,11 @@ static int try_smi_init(struct smi_info *new_smi) - } - - if (new_smi->pdev) { -- platform_device_unregister(new_smi->pdev); -+ if (platform_device_registered) -+ platform_device_unregister(new_smi->pdev); -+ else -+ platform_device_put(new_smi->pdev); - new_smi->pdev = NULL; -- } else if (new_smi->pdev) { -- platform_device_put(new_smi->pdev); - } - - kfree(init_name); --- -2.14.3 - diff --git a/0001-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch b/0001-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch deleted file mode 100644 index 761bf9918..000000000 --- a/0001-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 07f2c7ab6f8d0a7e7c5764c4e6cc9c52951b9d9c Mon Sep 17 00:00:00 2001 -From: Alexey Kodanev <alexey.kodanev@oracle.com> -Date: Fri, 9 Feb 2018 17:35:23 +0300 -Subject: [PATCH] sctp: verify size of a new chunk in _sctp_make_chunk() - -When SCTP makes INIT or INIT_ACK packet the total chunk length -can exceed SCTP_MAX_CHUNK_LEN which leads to kernel panic when -transmitting these packets, e.g. the crash on sending INIT_ACK: - -[ 597.804948] skbuff: skb_over_panic: text:00000000ffae06e4 len:120168 - put:120156 head:000000007aa47635 data:00000000d991c2de - tail:0x1d640 end:0xfec0 dev:<NULL> -... -[ 597.976970] ------------[ cut here ]------------ -[ 598.033408] kernel BUG at net/core/skbuff.c:104! -[ 600.314841] Call Trace: -[ 600.345829] <IRQ> -[ 600.371639] ? sctp_packet_transmit+0x2095/0x26d0 [sctp] -[ 600.436934] skb_put+0x16c/0x200 -[ 600.477295] sctp_packet_transmit+0x2095/0x26d0 [sctp] -[ 600.540630] ? sctp_packet_config+0x890/0x890 [sctp] -[ 600.601781] ? __sctp_packet_append_chunk+0x3b4/0xd00 [sctp] -[ 600.671356] ? sctp_cmp_addr_exact+0x3f/0x90 [sctp] -[ 600.731482] sctp_outq_flush+0x663/0x30d0 [sctp] -[ 600.788565] ? sctp_make_init+0xbf0/0xbf0 [sctp] -[ 600.845555] ? sctp_check_transmitted+0x18f0/0x18f0 [sctp] -[ 600.912945] ? sctp_outq_tail+0x631/0x9d0 [sctp] -[ 600.969936] sctp_cmd_interpreter.isra.22+0x3be1/0x5cb0 [sctp] -[ 601.041593] ? sctp_sf_do_5_1B_init+0x85f/0xc30 [sctp] -[ 601.104837] ? sctp_generate_t1_cookie_event+0x20/0x20 [sctp] -[ 601.175436] ? sctp_eat_data+0x1710/0x1710 [sctp] -[ 601.233575] sctp_do_sm+0x182/0x560 [sctp] -[ 601.284328] ? sctp_has_association+0x70/0x70 [sctp] -[ 601.345586] ? sctp_rcv+0xef4/0x32f0 [sctp] -[ 601.397478] ? sctp6_rcv+0xa/0x20 [sctp] -... - -Here the chunk size for INIT_ACK packet becomes too big, mostly -because of the state cookie (INIT packet has large size with -many address parameters), plus additional server parameters. - -Later this chunk causes the panic in skb_put_data(): - - skb_packet_transmit() - sctp_packet_pack() - skb_put_data(nskb, chunk->skb->data, chunk->skb->len); - -'nskb' (head skb) was previously allocated with packet->size -from u16 'chunk->chunk_hdr->length'. - -As suggested by Marcelo we should check the chunk's length in -_sctp_make_chunk() before trying to allocate skb for it and -discard a chunk if its size bigger than SCTP_MAX_CHUNK_LEN. - -Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> -Acked-by: Marcelo Ricardo Leitner <marcelo.leinter@gmail.com> -Acked-by: Neil Horman <nhorman@tuxdriver.com> -Signed-off-by: David S. Miller <davem@davemloft.net> ---- - net/sctp/sm_make_chunk.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index 793b05ec692b..d01475f5f710 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -1380,9 +1380,14 @@ static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc, - struct sctp_chunk *retval; - struct sk_buff *skb; - struct sock *sk; -+ int chunklen; -+ -+ chunklen = SCTP_PAD4(sizeof(*chunk_hdr) + paylen); -+ if (chunklen > SCTP_MAX_CHUNK_LEN) -+ goto nodata; - - /* No need to allocate LL here, as this is only a chunk. */ -- skb = alloc_skb(SCTP_PAD4(sizeof(*chunk_hdr) + paylen), gfp); -+ skb = alloc_skb(chunklen, gfp); - if (!skb) - goto nodata; - --- -2.14.3 - diff --git a/kernel.spec b/kernel.spec index 4a33335ea..97cec3219 100644 --- a/kernel.spec +++ b/kernel.spec @@ -58,7 +58,7 @@ Summary: The Linux kernel %define stable_rc 0 # Do we have a -stable update to apply? -%define stable_update 7 +%define stable_update 8 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -670,15 +670,9 @@ Patch652: iwlwifi-mvn.patch # CVE-2018-1000026 rhbz 1541846 1546744 Patch653: CVE-2018-1000026.patch -# rhbz 1549316 -Patch654: 0001-ipmi_si-Fix-error-handling-of-platform-device.patch - # CVE-2018-1065 rhbz 1547824 1547831 Patch655: 0001-netfilter-add-back-stackpointer-size-checks.patch -# CVE-2018-5803 rhbz 1551051 1551053 -Patch656: 0001-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch - # rhbz 1549316 Patch657: ipmi-fixes.patch @@ -1966,6 +1960,9 @@ fi # # %changelog +* Fri Mar 09 2018 Laura Abbott <labbott@redhat.com> - 4.15.8-300 +- Linux v4.15.8 + * Thu Mar 08 2018 Justin M. Forbes <jforbes@fedoraproject.org> - Fix CVE-2018-7757 (rhbz 1553361 1553363) @@ -1,2 +1,2 @@ SHA512 (linux-4.15.tar.xz) = c00d92659df815a53dcac7dde145b742b1f20867d380c07cb09ddb3295d6ff10f8931b21ef0b09d7156923a3957b39d74d87c883300173b2e20690d2b4ec35ea -SHA512 (patch-4.15.7.xz) = 4215a356a61c3af20352fd60f3ec4e4a74a3d4d6223c7bd5c1b8283bc4d786a5e1c29a770518cb6a136f42841c637648835a54a46f11e552d1aa7b867999ef1a +SHA512 (patch-4.15.8.xz) = 0e070a05b2caccfa8dc41ae0c826b50cf6e9e02894213972745f609e5cda9aeb04c6ebf480d34c12bb649ad0f4b8a07b3c67e562ce1cae7a086d1e30da280458 |