diff options
| -rw-r--r-- | 0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch | 61 | ||||
| -rw-r--r-- | 0001-mpi-Fix-NULL-ptr-dereference-in-mpi_powm-ver-3.patch | 100 | ||||
| -rw-r--r-- | ARM-Drop-fixed-200-Hz-timer-requirement-from-Samsung-platforms.patch | 88 | ||||
| -rw-r--r-- | crash-driver.patch | 120 | ||||
| -rw-r--r-- | kernel.spec | 20 | ||||
| -rw-r--r-- | sources | 2 |
6 files changed, 325 insertions, 66 deletions
diff --git a/0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch b/0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch deleted file mode 100644 index 6e38648ac..000000000 --- a/0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 1aab956c7b8872fb6976328316bfad62c6e67cf8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> -Date: Fri, 21 Oct 2016 16:44:38 +0300 -Subject: [PATCH] drm/i915: Refresh that status of MST capable connectors in - ->detect() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Once we've determined that the sink is MST capable we never end up -running through the full detect cycle again, despite getting HPDs. -Fix tht by ripping out the incorrect piece of code responsible. - -This got broken when I moved the long HPD handling to the ->detect() -hook, but failed to remove the leftover code. - -Cc: Ander Conselvan de Oliveira <conselvan2@gmail.com> -Cc: drm-intel-fixes@lists.freedesktop.org -Cc: Rui Tiago Matos <tiagomatos@gmail.com> -Tested-by: Rui Tiago Matos <tiagomatos@gmail.com> -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98323 -Cc: Kirill A. Shutemov <kirill@shutemov.name> -Tested-by: Kirill A. Shutemov <kirill@shutemov.name> -References: https://bugs.freedesktop.org/show_bug.cgi?id=98306 -Fixes: 27d4efc5591a ("drm/i915: Move long hpd handling into the hotplug work") -Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> -Link: http://patchwork.freedesktop.org/patch/msgid/1477057478-29328-1-git-send-email-ville.syrjala@linux.intel.com -Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> ---- - drivers/gpu/drm/i915/intel_dp.c | 10 ---------- - 1 file changed, 10 deletions(-) - -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index f30db8f..80db8a3 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -4492,21 +4492,11 @@ static enum drm_connector_status - intel_dp_detect(struct drm_connector *connector, bool force) - { - struct intel_dp *intel_dp = intel_attached_dp(connector); -- struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp); -- struct intel_encoder *intel_encoder = &intel_dig_port->base; - enum drm_connector_status status = connector->status; - - DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", - connector->base.id, connector->name); - -- if (intel_dp->is_mst) { -- /* MST devices are disconnected from a monitor POV */ -- intel_dp_unset_edid(intel_dp); -- if (intel_encoder->type != INTEL_OUTPUT_EDP) -- intel_encoder->type = INTEL_OUTPUT_DP; -- return connector_status_disconnected; -- } -- - /* If full detect is not performed yet, do a full detect */ - if (!intel_dp->detect_done) - status = intel_dp_long_pulse(intel_dp->attached_connector); --- -2.7.4 - diff --git a/0001-mpi-Fix-NULL-ptr-dereference-in-mpi_powm-ver-3.patch b/0001-mpi-Fix-NULL-ptr-dereference-in-mpi_powm-ver-3.patch new file mode 100644 index 000000000..f5cc8a6b5 --- /dev/null +++ b/0001-mpi-Fix-NULL-ptr-dereference-in-mpi_powm-ver-3.patch @@ -0,0 +1,100 @@ +From f5527fffff3f002b0a6b376163613b82f69de073 Mon Sep 17 00:00:00 2001 +From: Andrey Ryabinin <aryabinin@virtuozzo.com> +Date: Thu, 24 Nov 2016 13:23:10 +0000 +Subject: [PATCH] mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] + +This fixes CVE-2016-8650. + +If mpi_powm() is given a zero exponent, it wants to immediately return +either 1 or 0, depending on the modulus. However, if the result was +initalised with zero limb space, no limbs space is allocated and a +NULL-pointer exception ensues. + +Fix this by allocating a minimal amount of limb space for the result when +the 0-exponent case when the result is 1 and not touching the limb space +when the result is 0. + +This affects the use of RSA keys and X.509 certificates that carry them. + +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 +PGD 0 +Oops: 0002 [#1] SMP +Modules linked in: +CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278 +Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 +task: ffff8804011944c0 task.stack: ffff880401294000 +RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 +RSP: 0018:ffff880401297ad8 EFLAGS: 00010212 +RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0 +RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0 +RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000 +R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50 +FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0 +Stack: + ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4 + 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30 + ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8 +Call Trace: + [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66 + [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d + [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd + [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146 + [<ffffffff8132a95c>] rsa_verify+0x9d/0xee + [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb + [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1 + [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228 + [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4 + [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1 + [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1 + [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61 + [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399 + [<ffffffff812fe227>] SyS_add_key+0x154/0x19e + [<ffffffff81001c2b>] do_syscall_64+0x80/0x191 + [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25 +Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f +RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 + RSP <ffff880401297ad8> +CR2: 0000000000000000 +---[ end trace d82015255d4a5d8d ]--- + +Basically, this is a backport of a libgcrypt patch: + + http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526 + +Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)") +Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> +Signed-off-by: David Howells <dhowells@redhat.com> +cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> +cc: linux-ima-devel@lists.sourceforge.net +cc: stable@vger.kernel.org +Signed-off-by: James Morris <james.l.morris@oracle.com> +--- + lib/mpi/mpi-pow.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c +index 5464c87..e24388a 100644 +--- a/lib/mpi/mpi-pow.c ++++ b/lib/mpi/mpi-pow.c +@@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) + if (!esize) { + /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0 + * depending on if MOD equals 1. */ +- rp[0] = 1; + res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1; ++ if (res->nlimbs) { ++ if (mpi_resize(res, 1) < 0) ++ goto enomem; ++ rp = res->d; ++ rp[0] = 1; ++ } + res->sign = 0; + goto leave; + } +-- +2.9.3 + diff --git a/ARM-Drop-fixed-200-Hz-timer-requirement-from-Samsung-platforms.patch b/ARM-Drop-fixed-200-Hz-timer-requirement-from-Samsung-platforms.patch new file mode 100644 index 000000000..bf389545b --- /dev/null +++ b/ARM-Drop-fixed-200-Hz-timer-requirement-from-Samsung-platforms.patch @@ -0,0 +1,88 @@ +From patchwork Fri Nov 18 11:15:12 2016 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +Subject: [v3] ARM: Drop fixed 200 Hz timer requirement from Samsung platforms +From: Krzysztof Kozlowski <krzk@kernel.org> +X-Patchwork-Id: 9436225 +Message-Id: <1479467712-5218-1-git-send-email-krzk@kernel.org> +To: Russell King <linux@armlinux.org.uk>, Kukjin Kim <kgene@kernel.org>, + Krzysztof Kozlowski <krzk@kernel.org>, + Javier Martinez Canillas <javier@osg.samsung.com>, + linux-arm-kernel@lists.infradead.org, linux-samsung-soc@vger.kernel.org, + linux-kernel@vger.kernel.org +Cc: Arnd Bergmann <arnd@arndb.de>, + Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>, + Tomasz Figa <tomasz.figa@gmail.com>, + Ben Dooks <ben.dooks@codethink.co.uk>, + Sylwester Nawrocki <s.nawrocki@samsung.com>, + Lee Jones <lee.jones@linaro.org>, + Marek Szyprowski <m.szyprowski@samsung.com> +Date: Fri, 18 Nov 2016 13:15:12 +0200 + +All Samsung platforms, including the Exynos, are selecting HZ_FIXED with +200 Hz. Unfortunately in case of multiplatform image this affects also +other platforms when Exynos is enabled. + +This looks like an very old legacy code, dating back to initial +upstreaming of S3C24xx. Probably it was required for s3c24xx timer +driver, which was removed in commit ad38bdd15d5b ("ARM: SAMSUNG: Remove +unused plat-samsung/time.c"). + +Since then, this fixed 200 Hz spread everywhere, including out-of-tree +Samsung kernels (SoC vendor's and Tizen's). I believe this choice +was rather an effect of coincidence instead of conscious choice. + +On S3C24xx, the PWM counter is only 16 bit wide, and with the +typical 12MHz input clock that overflows every 5.5ms. This works +with HZ=200 or higher but not with HZ=100 which needs a 10ms +interval between ticks. On Later chips (S3C64xx, S5P and EXYNOS), +the counter is 32 bits and does not have this problem. + +The new samsung_pwm_timer driver solves the problem by scaling the input +clock by a factor of 50 on S3C24xx, which makes it less accurate but +allows HZ=100 as well as CONFIG_NO_HZ with fewer wakeups. + +Few perf mem and sched tests on Odroid XU3 board (Exynos5422, 4x Cortex +A7, 4x Cortex A15) show no regressions when switching from 200 Hz to +other values. + +Reported-by: Lee Jones <lee.jones@linaro.org> +[Dropping of 200_HZ from S3C/S5P was suggested by Arnd] +Reported-by: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> +Cc: Kukjin Kim <kgene@kernel.org> +[Tested on Exynos5800] +Tested-by: Javier Martinez Canillas <javier@osg.samsung.com> +Acked-by: Kukjin Kim <kgene@kernel.org> +[Tested on S3C2440] +Tested-by: Sylwester Nawrocki <s.nawrocki@samsung.com> +--- + +Changes since v2: +1. Extend message. +2. Add Kukjin's ack. +3. Add Sylwester's tested-by. + +Changes since v1: +1. Add Javier's tested-by. +2. Drop HZ_FIXED also from ARCH_S5PV210 and ARCH_S3C24XX after Arnd + suggestions and analysis. +--- + arch/arm/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index b5d529fdffab..ced2e08a9d08 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -1496,8 +1496,7 @@ source kernel/Kconfig.preempt + + config HZ_FIXED + int +- default 200 if ARCH_EBSA110 || ARCH_S3C24XX || \ +- ARCH_S5PV210 || ARCH_EXYNOS4 ++ default 200 if ARCH_EBSA110 + default 128 if SOC_AT91RM9200 + default 0 + diff --git a/crash-driver.patch b/crash-driver.patch index 2b05554b7..97ec4c4ec 100644 --- a/crash-driver.patch +++ b/crash-driver.patch @@ -603,3 +603,123 @@ index 085378a..0258bf8 100644 -- 2.9.3 +From: Dave Anderson <anderson@redhat.com> +Date: Fri, 18 Nov 2016 11:52:35 -0500 +Cc: onestero@redhat.com +Subject: [PATCH v2] Restore live system crash analysis for ARM64 + +This v2 version simplifies the copy out of the kimage_voffset value +to user-space per Oleg's suggestion. + +Upstream status: N/A + +Test: v2 version tested successfully with a modified crash utility + +The following Linux 4.6 commit breaks support for live system +crash analysis on ARM64: + + commit a7f8de168ace487fa7b88cb154e413cf40e87fc6 + Author: Ard Biesheuvel <ard.biesheuvel@linaro.org> + arm64: allow kernel Image to be loaded anywhere in physical memory + +The patchset drastically modified the kernel's virtual memory layout, +where notably the static kernel text and data image was moved from the +unity mapped region into the vmalloc region. Prior to Linux 4.6, +the kernel's __virt_to_phys() function was this: + + #define __virt_to_phys(x) (((phys_addr_t)(x) - PAGE_OFFSET + PHYS_OFFSET)) + +When running on a live system, the crash utility could determine PAGE_OFFSET +by looking at the virtual addresses compiled into the vmlinux file, and +PHYS_OFFSET can be determined by looking at /proc/iomem. + +As of Linux 4.6, it is done differently: + + #define __virt_to_phys(x) ({ \ + phys_addr_t __x = (phys_addr_t)(x); \ + __x & BIT(VA_BITS - 1) ? (__x & ~PAGE_OFFSET) + PHYS_OFFSET : \ + (__x - kimage_voffset); }) + +The PAGE_OFFSET/PHYS_OFFSET section of the conditional expression is for +traditional unity-mapped virtual addresses, but kernel text and static +data requires the new "kimage_voffset" variable. Unfortunately, the +contents of the new "kimage_voffset" variable is not available or +calculatable from a user-space perspective, even with root privileges. + +At least the ARM64 developers made its contents available to modules +with an EXPORT_SYMBOL(kimage_voffset) declaration. Accordingly, with +a modification to the /dev/crash driver to return its contents, the +crash utility can run on a live system. + +The patch allows for architecture-specific DEV_CRASH_ARCH_DATA ioctls +to be created, where this is the first instance of one. + + +--- + arch/arm64/include/asm/crash-driver.h | 16 ++++++++++++++++ + drivers/char/crash.c | 13 ++++++++++++- + 2 files changed, 28 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/include/asm/crash-driver.h b/arch/arm64/include/asm/crash-driver.h +index 43b26da..fe68e7c 100644 +--- a/arch/arm64/include/asm/crash-driver.h ++++ b/arch/arm64/include/asm/crash-driver.h +@@ -3,4 +3,20 @@ + + #include <asm-generic/crash-driver.h> + ++#define DEV_CRASH_ARCH_DATA _IOR('c', 1, long) ++ ++static long ++crash_arch_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++ extern u64 kimage_voffset; ++ ++ switch (cmd) ++ { ++ case DEV_CRASH_ARCH_DATA: ++ return put_user(kimage_voffset, (unsigned long __user *)arg); ++ default: ++ return -EINVAL; ++ } ++} ++ + #endif /* _ARM64_CRASH_H */ +diff --git a/drivers/char/crash.c b/drivers/char/crash.c +index 0258bf8..dfb767c 100644 +--- a/drivers/char/crash.c ++++ b/drivers/char/crash.c +@@ -32,7 +32,7 @@ + #include <asm/types.h> + #include <asm/crash-driver.h> + +-#define CRASH_VERSION "1.2" ++#define CRASH_VERSION "1.3" + + /* + * These are the file operation functions that allow crash utility +@@ -111,10 +111,21 @@ crash_release(struct inode *inode, struct file *filp) + return 0; + } + ++static long ++crash_ioctl(struct file *file, unsigned int cmd, unsigned long arg) ++{ ++#ifdef DEV_CRASH_ARCH_DATA ++ return crash_arch_ioctl(file, cmd, arg); ++#else ++ return -EINVAL; ++#endif ++} ++ + static struct file_operations crash_fops = { + .owner = THIS_MODULE, + .llseek = crash_llseek, + .read = crash_read, ++ .unlocked_ioctl = crash_ioctl, + .open = crash_open, + .release = crash_release, + }; +-- +1.8.3.1 + diff --git a/kernel.spec b/kernel.spec index 2c3e437ea..b76b5ae13 100644 --- a/kernel.spec +++ b/kernel.spec @@ -59,7 +59,7 @@ Summary: The Linux kernel # Do we have a -stable update to apply? -%define stable_update 10 +%define stable_update 11 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -543,6 +543,8 @@ Patch432: bcm283x-vc4-fixes.patch Patch433: AllWinner-net-emac.patch +Patch434: ARM-Drop-fixed-200-Hz-timer-requirement-from-Samsung-platforms.patch + Patch460: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch Patch466: input-kill-stupid-messages.patch @@ -647,15 +649,15 @@ Patch850: v3-vfio-pci-Fix-integer-overflows-bitmask-check.patch #rhbz 1325354 Patch852: 0001-HID-input-ignore-System-Control-application-usages-i.patch -#rhbz 1392885 -Patch853: 0001-drm-i915-Refresh-that-status-of-MST-capable-connecto.patch - #rhbz 1390308 Patch854: nouveau-add-maxwell-to-backlight-init.patch #rhbz 1385823 Patch855: 0001-platform-x86-ideapad-laptop-Add-Lenovo-Yoga-910-13IK.patch +# CVE-2016-8650 rhbz 1395187 1398463 +Patch856: 0001-mpi-Fix-NULL-ptr-dereference-in-mpi_powm-ver-3.patch + # END OF PATCH DEFINITIONS %endif @@ -2186,6 +2188,16 @@ fi # # %changelog +* Mon Nov 28 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.11-200 +- Linux v4.8.11 +- CVE-2016-8650 Fix NULL ptr dereference in mpi_powm() (rhbz 1395187 1398463) + +* Mon Nov 28 2016 Peter Robinson <pbrobinson@fedoraproject.org> +- Add upstream patch to fix all ARMv7 devices set to initial 200Mhz + +* Tue Nov 22 2016 Josh Boyer <jwboyer@fedoraproject.org> +- Add patch from Dave Anderson to fix live system crash analysis on Aarch64 + * Mon Nov 21 2016 Justin M. Forbes <jforbes@fedoraproject.org> - 4.8.10-200 - Linux v4.8.10 @@ -1,3 +1,3 @@ c1af0afbd3df35c1ccdc7a5118cd2d07 linux-4.8.tar.xz 0dad03f586e835d538d3e0d2cbdb9a28 perf-man-4.8.tar.gz -37eadcdaefae51ced736747cb817aa58 patch-4.8.10.xz +d999d6d294818491221f6d9789a667e8 patch-4.8.11.xz |