From 9387a8738d69d8aa50bf2677af3567f1c0a64e2a Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Tue, 8 Oct 2019 08:23:27 -0500 Subject: Linux v5.2.20 --- enforce-CAP_NET_RAW-for-raw-sockets.patch | 171 --------------------- ...O_TX_POWER_LIMIT-command-to-FW-version-36.patch | 87 ----------- kernel.spec | 14 +- sources | 1 + 4 files changed, 6 insertions(+), 267 deletions(-) delete mode 100644 enforce-CAP_NET_RAW-for-raw-sockets.patch delete mode 100644 iwlwifi-fw-don-t-send-GEO_TX_POWER_LIMIT-command-to-FW-version-36.patch diff --git a/enforce-CAP_NET_RAW-for-raw-sockets.patch b/enforce-CAP_NET_RAW-for-raw-sockets.patch deleted file mode 100644 index f253a35af..000000000 --- a/enforce-CAP_NET_RAW-for-raw-sockets.patch +++ /dev/null @@ -1,171 +0,0 @@ -From b91ee4aa2a2199ba4d4650706c272985a5a32d80 Mon Sep 17 00:00:00 2001 -From: Ori Nimron -Date: Fri, 20 Sep 2019 09:35:45 +0200 -Subject: mISDN: enforce CAP_NET_RAW for raw sockets - -When creating a raw AF_ISDN socket, CAP_NET_RAW needs to be checked -first. - -Signed-off-by: Ori Nimron -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: David S. Miller ---- - drivers/isdn/mISDN/socket.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c -index c6ba37df4b9d..dff4132b3702 100644 ---- a/drivers/isdn/mISDN/socket.c -+++ b/drivers/isdn/mISDN/socket.c -@@ -754,6 +754,8 @@ base_sock_create(struct net *net, struct socket *sock, int protocol, int kern) - - if (sock->type != SOCK_RAW) - return -ESOCKTNOSUPPORT; -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - - sk = sk_alloc(net, PF_ISDN, GFP_KERNEL, &mISDN_proto, kern); - if (!sk) --- -cgit 1.2-0.3.lf.el7 - - -From 6cc03e8aa36c51f3b26a0d21a3c4ce2809c842ac Mon Sep 17 00:00:00 2001 -From: Ori Nimron -Date: Fri, 20 Sep 2019 09:35:46 +0200 -Subject: appletalk: enforce CAP_NET_RAW for raw sockets - -When creating a raw AF_APPLETALK socket, CAP_NET_RAW needs to be checked -first. - -Signed-off-by: Ori Nimron -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: David S. Miller ---- - net/appletalk/ddp.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c -index 4072e9d394d6..b41375d4d295 100644 ---- a/net/appletalk/ddp.c -+++ b/net/appletalk/ddp.c -@@ -1023,6 +1023,11 @@ static int atalk_create(struct net *net, struct socket *sock, int protocol, - */ - if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM) - goto out; -+ -+ rc = -EPERM; -+ if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) -+ goto out; -+ - rc = -ENOMEM; - sk = sk_alloc(net, PF_APPLETALK, GFP_KERNEL, &ddp_proto, kern); - if (!sk) --- -cgit 1.2-0.3.lf.el7 - - -From 0614e2b73768b502fc32a75349823356d98aae2c Mon Sep 17 00:00:00 2001 -From: Ori Nimron -Date: Fri, 20 Sep 2019 09:35:47 +0200 -Subject: ax25: enforce CAP_NET_RAW for raw sockets - -When creating a raw AF_AX25 socket, CAP_NET_RAW needs to be checked -first. - -Signed-off-by: Ori Nimron -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: David S. Miller ---- - net/ax25/af_ax25.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index ca5207767dc2..bb222b882b67 100644 ---- a/net/ax25/af_ax25.c -+++ b/net/ax25/af_ax25.c -@@ -855,6 +855,8 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol, - break; - - case SOCK_RAW: -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - break; - default: - return -ESOCKTNOSUPPORT; --- -cgit 1.2-0.3.lf.el7 - - -From e69dbd4619e7674c1679cba49afd9dd9ac347eef Mon Sep 17 00:00:00 2001 -From: Ori Nimron -Date: Fri, 20 Sep 2019 09:35:48 +0200 -Subject: ieee802154: enforce CAP_NET_RAW for raw sockets - -When creating a raw AF_IEEE802154 socket, CAP_NET_RAW needs to be -checked first. - -Signed-off-by: Ori Nimron -Signed-off-by: Greg Kroah-Hartman -Acked-by: Stefan Schmidt -Signed-off-by: David S. Miller ---- - net/ieee802154/socket.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c -index badc5cfe4dc6..d93d4531aa9b 100644 ---- a/net/ieee802154/socket.c -+++ b/net/ieee802154/socket.c -@@ -1008,6 +1008,9 @@ static int ieee802154_create(struct net *net, struct socket *sock, - - switch (sock->type) { - case SOCK_RAW: -+ rc = -EPERM; -+ if (!capable(CAP_NET_RAW)) -+ goto out; - proto = &ieee802154_raw_prot; - ops = &ieee802154_raw_ops; - break; --- -cgit 1.2-0.3.lf.el7 - - -From 3a359798b176183ef09efb7a3dc59abad1cc7104 Mon Sep 17 00:00:00 2001 -From: Ori Nimron -Date: Fri, 20 Sep 2019 09:35:49 +0200 -Subject: nfc: enforce CAP_NET_RAW for raw sockets - -When creating a raw AF_NFC socket, CAP_NET_RAW needs to be checked -first. - -Signed-off-by: Ori Nimron -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: David S. Miller ---- - net/nfc/llcp_sock.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c -index 9b8742947aff..8dfea26536c9 100644 ---- a/net/nfc/llcp_sock.c -+++ b/net/nfc/llcp_sock.c -@@ -1004,10 +1004,13 @@ static int llcp_sock_create(struct net *net, struct socket *sock, - sock->type != SOCK_RAW) - return -ESOCKTNOSUPPORT; - -- if (sock->type == SOCK_RAW) -+ if (sock->type == SOCK_RAW) { -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - sock->ops = &llcp_rawsock_ops; -- else -+ } else { - sock->ops = &llcp_sock_ops; -+ } - - sk = nfc_llcp_sock_alloc(sock, sock->type, GFP_ATOMIC, kern); - if (sk == NULL) --- -cgit 1.2-0.3.lf.el7 - diff --git a/iwlwifi-fw-don-t-send-GEO_TX_POWER_LIMIT-command-to-FW-version-36.patch b/iwlwifi-fw-don-t-send-GEO_TX_POWER_LIMIT-command-to-FW-version-36.patch deleted file mode 100644 index f583a5b2d..000000000 --- a/iwlwifi-fw-don-t-send-GEO_TX_POWER_LIMIT-command-to-FW-version-36.patch +++ /dev/null @@ -1,87 +0,0 @@ -From patchwork Tue Sep 24 10:30:57 2019 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -X-Patchwork-Submitter: Luca Coelho -X-Patchwork-Id: 11158395 -X-Patchwork-Delegate: kvalo@adurom.com -Return-Path: -Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org - [172.30.200.123]) - by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 62FF3112B - for ; - Tue, 24 Sep 2019 10:31:06 +0000 (UTC) -Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) - by mail.kernel.org (Postfix) with ESMTP id 4AA4E214D9 - for ; - Tue, 24 Sep 2019 10:31:06 +0000 (UTC) -Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand - id S2409468AbfIXKbF (ORCPT - ); - Tue, 24 Sep 2019 06:31:05 -0400 -Received: from paleale.coelho.fi ([176.9.41.70]:44742 "EHLO - farmhouse.coelho.fi" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org - with ESMTP id S2387644AbfIXKbF (ORCPT - ); - Tue, 24 Sep 2019 06:31:05 -0400 -Received: from [91.156.6.193] (helo=redipa.ger.corp.intel.com) - by farmhouse.coelho.fi with esmtpsa - (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) - (Exim 4.92) - (envelope-from ) - id 1iCi63-0005Je-8E; Tue, 24 Sep 2019 13:31:03 +0300 -From: Luca Coelho -To: kvalo@codeaurora.org -Cc: linux-wireless@vger.kernel.org -Date: Tue, 24 Sep 2019 13:30:57 +0300 -Message-Id: <20190924103057.17147-1-luca@coelho.fi> -X-Mailer: git-send-email 2.23.0 -MIME-Version: 1.0 -X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on farmhouse.coelho.fi -X-Spam-Level: -X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00, - URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 -Subject: [PATCH v5.4] iwlwifi: fw: don't send GEO_TX_POWER_LIMIT command to FW - version 36 -Sender: linux-wireless-owner@vger.kernel.org -Precedence: bulk -List-ID: -X-Mailing-List: linux-wireless@vger.kernel.org - -From: Luca Coelho - -The intention was to have the GEO_TX_POWER_LIMIT command in FW version -36 as well, but not all 8000 family got this feature enabled. The -8000 family is the only one using version 36, so skip this version -entirely. If we try to send this command to the firmwares that do not -support it, we get a BAD_COMMAND response from the firmware. - -This fixes https://bugzilla.kernel.org/show_bug.cgi?id=204151. - -Cc: stable@vger.kernel.org # 4.19+ -Signed-off-by: Luca Coelho ---- - drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -index 014eca6596e2..32a5e4e5461f 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -@@ -889,11 +889,13 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm) - * firmware versions. Unfortunately, we don't have a TLV API - * flag to rely on, so rely on the major version which is in - * the first byte of ucode_ver. This was implemented -- * initially on version 38 and then backported to 36, 29 and -- * 17. -+ * initially on version 38 and then backported to29 and 17. -+ * The intention was to have it in 36 as well, but not all -+ * 8000 family got this feature enabled. The 8000 family is -+ * the only one using version 36, so skip this version -+ * entirely. - */ - return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 || -- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 36 || - IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 || - IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17; - } diff --git a/kernel.spec b/kernel.spec index 20fc1d30d..20add357d 100644 --- a/kernel.spec +++ b/kernel.spec @@ -56,7 +56,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 18 +%define stable_update 20 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -586,13 +586,6 @@ Patch505: 0001-dma-direct-correct-the-physical-addr-in-dma_direct_s.patch # rhbz 1753099 Patch506: dwc3-fix.patch -# https://patchwork.kernel.org/patch/11158395/ -Patch507: iwlwifi-fw-don-t-send-GEO_TX_POWER_LIMIT-command-to-FW-version-36.patch - -# CVE-2019-17052 CVE-2019-17053 CVE-2019-17054 CVE-2019-17055 CVE-2019-17056 -# rhbz 1758239 1758240 1758242 1758243 1758245 1758246 1758248 1758249 1758256 1758257 -Patch508: enforce-CAP_NET_RAW-for-raw-sockets.patch - # END OF PATCH DEFINITIONS %endif @@ -1830,7 +1823,10 @@ fi # # %changelog -* Wed Oct 03 2019 Justin M. Forbes +* Tue Oct 08 2019 Justin M. Forbes - 5.2.20-100 +- Linux v5.2.20 + +* Wed Oct 02 2019 Justin M. Forbes - Fix CVE-2019-17052 CVE-2019-17053 CVE-2019-17054 CVE-2019-17055 CVE-2019-17056 (rhbz 1758239 1758240 1758242 1758243 1758245 1758246 1758248 1758249 1758256 1758257) diff --git a/sources b/sources index 13cda61eb..18188f634 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (linux-5.2.tar.xz) = 5a28f8a34c4e0470617f5638b7112e6252109b78f23b1eed484a228530970c7ef5c130d6e5a09cf25ea2f6a0329602dcc1ec66ce893182e15b27d99bd228789c SHA512 (patch-5.2.18.xz) = bdbc2ad5efdf5b28c7facd5c5385bc8e9f580aecf4724870fa9848093468c1fd4185f0f981dd2a196375b6c3303ca1158ae2a2cd4d7519e8b5fbf19339ff4731 +SHA512 (patch-5.2.20.xz) = a114d3c8cc477cb6b499e1ef32f8a90a7e14b3e8fe7f82980b0c97abc280d95d9aaabdb78debadc7c9b06077787ac54927c86413fb99a339b08616101a415940 -- cgit