diff options
author | Sona Sarmadi <sona.sarmadi@enea.com> | 2018-09-19 12:30:27 +0200 |
---|---|---|
committer | Sona Sarmadi <sona.sarmadi@enea.com> | 2018-09-21 08:28:44 +0200 |
commit | c89dc0a3e18de5a9f76fb04c3b2a6877e71036fb (patch) | |
tree | 28f6cacb6199d53e061b3d0959b98d48842eee31 /recipes-kernel/linux/linux-intel | |
parent | 98c89ad93200fbaba0ce1e2d155ccc1b67f4a8d8 (diff) | |
download | meta-enea-bsp-x86-c89dc0a3e18de5a9f76fb04c3b2a6877e71036fb.tar.gz |
linux-intel-rt: Fix for CVE-2018-14734
References:
https://github.com/nluedtke/linux_kernel_cves/blob/master/4.14/4.14_security.txt
https://nvd.nist.gov/vuln/detail/CVE-2018-14734
Change-Id: I023781aa314f2713e6e3c134df8f87f23913c3f6
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Diffstat (limited to 'recipes-kernel/linux/linux-intel')
-rw-r--r-- | recipes-kernel/linux/linux-intel/CVE-2018-14734.patch | 62 |
1 files changed, 62 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch new file mode 100644 index 0000000..4d58410 --- /dev/null +++ b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch | |||
@@ -0,0 +1,62 @@ | |||
1 | From e27dad1eb1ac7bedb5a033ac2e068543742c807b Mon Sep 17 00:00:00 2001 | ||
2 | From: Cong Wang <xiyou.wangcong@gmail.com> | ||
3 | Date: Fri, 1 Jun 2018 11:31:44 -0700 | ||
4 | Subject: [PATCH] infiniband: fix a possible use-after-free bug | ||
5 | |||
6 | [ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ] | ||
7 | |||
8 | ucma_process_join() will free the new allocated "mc" struct, | ||
9 | if there is any error after that, especially the copy_to_user(). | ||
10 | |||
11 | But in parallel, ucma_leave_multicast() could find this "mc" | ||
12 | through idr_find() before ucma_process_join() frees it, since it | ||
13 | is already published. | ||
14 | |||
15 | So "mc" could be used in ucma_leave_multicast() after it is been | ||
16 | allocated and freed in ucma_process_join(), since we don't refcnt | ||
17 | it. | ||
18 | |||
19 | Fix this by separating "publish" from ID allocation, so that we | ||
20 | can get an ID first and publish it later after copy_to_user(). | ||
21 | |||
22 | CVE: CVE-2018-14734 | ||
23 | Upstream-Status: Backport | ||
24 | |||
25 | Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support") | ||
26 | Reported-by: Noam Rathaus <noamr@beyondsecurity.com> | ||
27 | Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> | ||
28 | Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> | ||
29 | Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> | ||
30 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
31 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
32 | --- | ||
33 | drivers/infiniband/core/ucma.c | 6 +++++- | ||
34 | 1 file changed, 5 insertions(+), 1 deletion(-) | ||
35 | |||
36 | diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c | ||
37 | index e47baf0..a22b992 100644 | ||
38 | --- a/drivers/infiniband/core/ucma.c | ||
39 | +++ b/drivers/infiniband/core/ucma.c | ||
40 | @@ -218,7 +218,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) | ||
41 | return NULL; | ||
42 | |||
43 | mutex_lock(&mut); | ||
44 | - mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); | ||
45 | + mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); | ||
46 | mutex_unlock(&mut); | ||
47 | if (mc->id < 0) | ||
48 | goto error; | ||
49 | @@ -1404,6 +1404,10 @@ static ssize_t ucma_process_join(struct ucma_file *file, | ||
50 | goto err3; | ||
51 | } | ||
52 | |||
53 | + mutex_lock(&mut); | ||
54 | + idr_replace(&multicast_idr, mc, mc->id); | ||
55 | + mutex_unlock(&mut); | ||
56 | + | ||
57 | mutex_unlock(&file->mut); | ||
58 | ucma_put_ctx(ctx); | ||
59 | return 0; | ||
60 | -- | ||
61 | 2.7.4 | ||
62 | |||