diff options
-rw-r--r-- | recipes-kernel/linux/linux-intel-rt_4.14.bbappend | 7 | ||||
-rw-r--r-- | recipes-kernel/linux/linux-intel/CVE-2018-14734.patch | 62 |
2 files changed, 68 insertions, 1 deletions
diff --git a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend index 32f3691..84ba58a 100644 --- a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend +++ b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend | |||
@@ -1,8 +1,13 @@ | |||
1 | # look for files in the layer first | ||
2 | FILESEXTRAPATHS_prepend := "${THISDIR}/linux-intel:" | ||
3 | |||
1 | require recipes-kernel/linux/linux-deploy-kconfig.inc | 4 | require recipes-kernel/linux/linux-deploy-kconfig.inc |
2 | 5 | ||
3 | SRCREV_metaenea = "7f34b40b0ba594d85ee8ccdf327d2a06f7ceaad4" | 6 | SRCREV_metaenea = "7f34b40b0ba594d85ee8ccdf327d2a06f7ceaad4" |
4 | KENEABRANCH = "intel-4.14" | 7 | KENEABRANCH = "intel-4.14" |
5 | SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta" | 8 | SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta \ |
9 | file://CVE-2018-14734.patch \ | ||
10 | " | ||
6 | 11 | ||
7 | # Debug tools support | 12 | # Debug tools support |
8 | KERNEL_FEATURES_append = " features/debug/debug_kernel_y.scc" | 13 | KERNEL_FEATURES_append = " features/debug/debug_kernel_y.scc" |
diff --git a/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch new file mode 100644 index 0000000..4d58410 --- /dev/null +++ b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch | |||
@@ -0,0 +1,62 @@ | |||
1 | From e27dad1eb1ac7bedb5a033ac2e068543742c807b Mon Sep 17 00:00:00 2001 | ||
2 | From: Cong Wang <xiyou.wangcong@gmail.com> | ||
3 | Date: Fri, 1 Jun 2018 11:31:44 -0700 | ||
4 | Subject: [PATCH] infiniband: fix a possible use-after-free bug | ||
5 | |||
6 | [ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ] | ||
7 | |||
8 | ucma_process_join() will free the new allocated "mc" struct, | ||
9 | if there is any error after that, especially the copy_to_user(). | ||
10 | |||
11 | But in parallel, ucma_leave_multicast() could find this "mc" | ||
12 | through idr_find() before ucma_process_join() frees it, since it | ||
13 | is already published. | ||
14 | |||
15 | So "mc" could be used in ucma_leave_multicast() after it is been | ||
16 | allocated and freed in ucma_process_join(), since we don't refcnt | ||
17 | it. | ||
18 | |||
19 | Fix this by separating "publish" from ID allocation, so that we | ||
20 | can get an ID first and publish it later after copy_to_user(). | ||
21 | |||
22 | CVE: CVE-2018-14734 | ||
23 | Upstream-Status: Backport | ||
24 | |||
25 | Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support") | ||
26 | Reported-by: Noam Rathaus <noamr@beyondsecurity.com> | ||
27 | Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> | ||
28 | Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> | ||
29 | Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> | ||
30 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
31 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
32 | --- | ||
33 | drivers/infiniband/core/ucma.c | 6 +++++- | ||
34 | 1 file changed, 5 insertions(+), 1 deletion(-) | ||
35 | |||
36 | diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c | ||
37 | index e47baf0..a22b992 100644 | ||
38 | --- a/drivers/infiniband/core/ucma.c | ||
39 | +++ b/drivers/infiniband/core/ucma.c | ||
40 | @@ -218,7 +218,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) | ||
41 | return NULL; | ||
42 | |||
43 | mutex_lock(&mut); | ||
44 | - mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); | ||
45 | + mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); | ||
46 | mutex_unlock(&mut); | ||
47 | if (mc->id < 0) | ||
48 | goto error; | ||
49 | @@ -1404,6 +1404,10 @@ static ssize_t ucma_process_join(struct ucma_file *file, | ||
50 | goto err3; | ||
51 | } | ||
52 | |||
53 | + mutex_lock(&mut); | ||
54 | + idr_replace(&multicast_idr, mc, mc->id); | ||
55 | + mutex_unlock(&mut); | ||
56 | + | ||
57 | mutex_unlock(&file->mut); | ||
58 | ucma_put_ctx(ctx); | ||
59 | return 0; | ||
60 | -- | ||
61 | 2.7.4 | ||
62 | |||