From c89dc0a3e18de5a9f76fb04c3b2a6877e71036fb Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Wed, 19 Sep 2018 12:30:27 +0200 Subject: linux-intel-rt: Fix for CVE-2018-14734 References: https://github.com/nluedtke/linux_kernel_cves/blob/master/4.14/4.14_security.txt https://nvd.nist.gov/vuln/detail/CVE-2018-14734 Change-Id: I023781aa314f2713e6e3c134df8f87f23913c3f6 Signed-off-by: Sona Sarmadi --- recipes-kernel/linux/linux-intel-rt_4.14.bbappend | 7 ++- .../linux/linux-intel/CVE-2018-14734.patch | 62 ++++++++++++++++++++++ 2 files changed, 68 insertions(+), 1 deletion(-) create mode 100644 recipes-kernel/linux/linux-intel/CVE-2018-14734.patch diff --git a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend index 32f3691..84ba58a 100644 --- a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend +++ b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend @@ -1,8 +1,13 @@ +# look for files in the layer first +FILESEXTRAPATHS_prepend := "${THISDIR}/linux-intel:" + require recipes-kernel/linux/linux-deploy-kconfig.inc SRCREV_metaenea = "7f34b40b0ba594d85ee8ccdf327d2a06f7ceaad4" KENEABRANCH = "intel-4.14" -SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta" +SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta \ + file://CVE-2018-14734.patch \ + " # Debug tools support KERNEL_FEATURES_append = " features/debug/debug_kernel_y.scc" diff --git a/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch new file mode 100644 index 0000000..4d58410 --- /dev/null +++ b/recipes-kernel/linux/linux-intel/CVE-2018-14734.patch @@ -0,0 +1,62 @@ +From e27dad1eb1ac7bedb5a033ac2e068543742c807b Mon Sep 17 00:00:00 2001 +From: Cong Wang +Date: Fri, 1 Jun 2018 11:31:44 -0700 +Subject: [PATCH] infiniband: fix a possible use-after-free bug + +[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ] + +ucma_process_join() will free the new allocated "mc" struct, +if there is any error after that, especially the copy_to_user(). + +But in parallel, ucma_leave_multicast() could find this "mc" +through idr_find() before ucma_process_join() frees it, since it +is already published. + +So "mc" could be used in ucma_leave_multicast() after it is been +allocated and freed in ucma_process_join(), since we don't refcnt +it. + +Fix this by separating "publish" from ID allocation, so that we +can get an ID first and publish it later after copy_to_user(). + +CVE: CVE-2018-14734 +Upstream-Status: Backport + +Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support") +Reported-by: Noam Rathaus +Signed-off-by: Cong Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sona Sarmadi +--- + drivers/infiniband/core/ucma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index e47baf0..a22b992 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -218,7 +218,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) + return NULL; + + mutex_lock(&mut); +- mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); ++ mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); + mutex_unlock(&mut); + if (mc->id < 0) + goto error; +@@ -1404,6 +1404,10 @@ static ssize_t ucma_process_join(struct ucma_file *file, + goto err3; + } + ++ mutex_lock(&mut); ++ idr_replace(&multicast_idr, mc, mc->id); ++ mutex_unlock(&mut); ++ + mutex_unlock(&file->mut); + ucma_put_ctx(ctx); + return 0; +-- +2.7.4 + -- cgit v1.2.3-54-g00ecf