linux-intel-rt: Fix for CVE-2018-14734

References:
https://github.com/nluedtke/linux_kernel_cves/blob/master/4.14/4.14_security.txt
https://nvd.nist.gov/vuln/detail/CVE-2018-14734

Change-Id: I023781aa314f2713e6e3c134df8f87f23913c3f6
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>

2 files changed, 68 insertions, 1 deletions

diff --git a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend
index 32f3691..84ba58a 100644
--- a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend
+++ b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend
@@ -1,8 +1,13 @@
+# look for files in the layer first
+FILESEXTRAPATHS_prepend := "${THISDIR}/linux-intel:"
+
 require recipes-kernel/linux/linux-deploy-kconfig.inc
 
 SRCREV_metaenea = "7f34b40b0ba594d85ee8ccdf327d2a06f7ceaad4"
 KENEABRANCH = "intel-4.14"
-SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta"
+SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta \
+                   file://CVE-2018-14734.patch \
+                 "
 
 # Debug tools support
 KERNEL_FEATURES_append = " features/debug/debug_kernel_y.scc"
diff --git a/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch
new file mode 100644
index 0000000..4d58410
--- /dev/null
+++ b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch
@@ -0,0 +1,62 @@
+From e27dad1eb1ac7bedb5a033ac2e068543742c807b Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Fri, 1 Jun 2018 11:31:44 -0700
+Subject: [PATCH] infiniband: fix a possible use-after-free bug
+
+[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ]
+
+ucma_process_join() will free the new allocated "mc" struct,
+if there is any error after that, especially the copy_to_user().
+
+But in parallel, ucma_leave_multicast() could find this "mc"
+through idr_find() before ucma_process_join() frees it, since it
+is already published.
+
+So "mc" could be used in ucma_leave_multicast() after it is been
+allocated and freed in ucma_process_join(), since we don't refcnt
+it.
+
+Fix this by separating "publish" from ID allocation, so that we
+can get an ID first and publish it later after copy_to_user().
+
+CVE: CVE-2018-14734 
+Upstream-Status: Backport
+
+Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support")
+Reported-by: Noam Rathaus <noamr@beyondsecurity.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ drivers/infiniband/core/ucma.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index e47baf0..a22b992 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -218,7 +218,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx)
+                return NULL;
+ 
+        mutex_lock(&mut);
+-       mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL);
++       mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL);
+        mutex_unlock(&mut);
+        if (mc->id < 0)
+                goto error;
+@@ -1404,6 +1404,10 @@ static ssize_t ucma_process_join(struct ucma_file *file,
+                goto err3;
+        }
+ 
++       mutex_lock(&mut);
++       idr_replace(&multicast_idr, mc, mc->id);
++       mutex_unlock(&mut);
++
+        mutex_unlock(&file->mut);
+        ucma_put_ctx(ctx);
+        return 0;
+-- 
+2.7.4
+