diff options
4 files changed, 113 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch b/recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch new file mode 100644 index 0000000..4181252 --- /dev/null +++ b/recipes-kernel/linux/linux-hierofalcon-3.19/keys-CVE-2015-1333.patch | |||
@@ -0,0 +1,57 @@ | |||
1 | From 66db51c9f7b2fe7ebdfa753b2aa9abbb9feddc87 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Ian King <colin.king@canonical.com> | ||
3 | Date: Mon, 27 Jul 2015 15:23:43 +0100 | ||
4 | Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid | ||
5 | |||
6 | [ Upstream commit HEAD ] | ||
7 | |||
8 | commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream. | ||
9 | |||
10 | __key_link_end is not freeing the associated array edit structure | ||
11 | and this leads to a 512 byte memory leak each time an identical | ||
12 | existing key is added with add_key(). | ||
13 | |||
14 | The reason the add_key() system call returns okay is that | ||
15 | key_create_or_update() calls __key_link_begin() before checking to see | ||
16 | whether it can update a key directly rather than adding/replacing - which | ||
17 | it turns out it can. Thus __key_link() is not called through | ||
18 | __key_instantiate_and_link() and __key_link_end() must cancel the edit. | ||
19 | |||
20 | CVE-2015-1333 | ||
21 | |||
22 | Upstream-Status: Backport | ||
23 | |||
24 | Signed-off-by: Colin Ian King <colin.king@canonical.com> | ||
25 | Signed-off-by: David Howells <dhowells@redhat.com> | ||
26 | Signed-off-by: James Morris <james.l.morris@oracle.com> | ||
27 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
28 | |||
29 | (cherry picked from commit c9cd9b18dac801040ada16562dc579d5ac366d75) | ||
30 | Signed-off-by: Sasha Levin <sasha.levin@oracle.com> | ||
31 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
32 | --- | ||
33 | security/keys/keyring.c | 8 +++++--- | ||
34 | 1 file changed, 5 insertions(+), 3 deletions(-) | ||
35 | |||
36 | diff --git a/security/keys/keyring.c b/security/keys/keyring.c | ||
37 | index e72548b..d334370 100644 | ||
38 | --- a/security/keys/keyring.c | ||
39 | +++ b/security/keys/keyring.c | ||
40 | @@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring, | ||
41 | if (index_key->type == &key_type_keyring) | ||
42 | up_write(&keyring_serialise_link_sem); | ||
43 | |||
44 | - if (edit && !edit->dead_leaf) { | ||
45 | - key_payload_reserve(keyring, | ||
46 | - keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
47 | + if (edit) { | ||
48 | + if (!edit->dead_leaf) { | ||
49 | + key_payload_reserve(keyring, | ||
50 | + keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
51 | + } | ||
52 | assoc_array_cancel_edit(edit); | ||
53 | } | ||
54 | up_write(&keyring->sem); | ||
55 | -- | ||
56 | 1.9.1 | ||
57 | |||
diff --git a/recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch b/recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch new file mode 100644 index 0000000..5927c50 --- /dev/null +++ b/recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch | |||
@@ -0,0 +1,52 @@ | |||
1 | From 4fd5dc9eece297f49f16f82422ead3a28b11ea70 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Ian King <colin.king@canonical.com> | ||
3 | Date: Mon, 27 Jul 2015 15:23:43 +0100 | ||
4 | Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid | ||
5 | |||
6 | commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream. | ||
7 | |||
8 | __key_link_end is not freeing the associated array edit structure | ||
9 | and this leads to a 512 byte memory leak each time an identical | ||
10 | existing key is added with add_key(). | ||
11 | |||
12 | The reason the add_key() system call returns okay is that | ||
13 | key_create_or_update() calls __key_link_begin() before checking to see | ||
14 | whether it can update a key directly rather than adding/replacing - which | ||
15 | it turns out it can. Thus __key_link() is not called through | ||
16 | __key_instantiate_and_link() and __key_link_end() must cancel the edit. | ||
17 | |||
18 | CVE-2015-1333 | ||
19 | |||
20 | Upstream-Status: Backport | ||
21 | |||
22 | Signed-off-by: Colin Ian King <colin.king@canonical.com> | ||
23 | Signed-off-by: David Howells <dhowells@redhat.com> | ||
24 | Signed-off-by: James Morris <james.l.morris@oracle.com> | ||
25 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
26 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
27 | --- | ||
28 | security/keys/keyring.c | 8 +++++--- | ||
29 | 1 file changed, 5 insertions(+), 3 deletions(-) | ||
30 | |||
31 | diff --git a/security/keys/keyring.c b/security/keys/keyring.c | ||
32 | index e72548b..d334370 100644 | ||
33 | --- a/security/keys/keyring.c | ||
34 | +++ b/security/keys/keyring.c | ||
35 | @@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring, | ||
36 | if (index_key->type == &key_type_keyring) | ||
37 | up_write(&keyring_serialise_link_sem); | ||
38 | |||
39 | - if (edit && !edit->dead_leaf) { | ||
40 | - key_payload_reserve(keyring, | ||
41 | - keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
42 | + if (edit) { | ||
43 | + if (!edit->dead_leaf) { | ||
44 | + key_payload_reserve(keyring, | ||
45 | + keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
46 | + } | ||
47 | assoc_array_cancel_edit(edit); | ||
48 | } | ||
49 | up_write(&keyring->sem); | ||
50 | -- | ||
51 | 1.9.1 | ||
52 | |||
diff --git a/recipes-kernel/linux/linux-hierofalcon_3.19.bb b/recipes-kernel/linux/linux-hierofalcon_3.19.bb index 25eb602..1a85f72 100644 --- a/recipes-kernel/linux/linux-hierofalcon_3.19.bb +++ b/recipes-kernel/linux/linux-hierofalcon_3.19.bb | |||
@@ -1,4 +1,5 @@ | |||
1 | DESCRIPTION = "Linux kernel for AMD Hierofalcon Cortex-A57" | 1 | DESCRIPTION = "Linux kernel for AMD Hierofalcon Cortex-A57" |
2 | FILESEXTRAPATHS_prepend := "${THISDIR}/linux-hierofalcon-3.19:" | ||
2 | 3 | ||
3 | COMPATIBLE_MACHINE = "hierofalcon*" | 4 | COMPATIBLE_MACHINE = "hierofalcon*" |
4 | 5 | ||
@@ -14,6 +15,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto-3.19;branch="standard/qemuarm6 | |||
14 | file://03-arm64-don-t-set-READ_IMPLIES_EXEC-for-EM_AARCH64-ELF.patch \ | 15 | file://03-arm64-don-t-set-READ_IMPLIES_EXEC-for-EM_AARCH64-ELF.patch \ |
15 | file://319-Hierofalcon-Update-xgbe-drivers-for-B0-board.patch \ | 16 | file://319-Hierofalcon-Update-xgbe-drivers-for-B0-board.patch \ |
16 | file://defconfig \ | 17 | file://defconfig \ |
18 | file://keys-CVE-2015-1333.patch \ | ||
17 | " | 19 | " |
18 | 20 | ||
19 | S = "${WORKDIR}/git" | 21 | S = "${WORKDIR}/git" |
diff --git a/recipes-kernel/linux/linux-hierofalcon_4.1.bb b/recipes-kernel/linux/linux-hierofalcon_4.1.bb index a9159b1..1140927 100644 --- a/recipes-kernel/linux/linux-hierofalcon_4.1.bb +++ b/recipes-kernel/linux/linux-hierofalcon_4.1.bb | |||
@@ -1,4 +1,5 @@ | |||
1 | DESCRIPTION = "Linux kernel for AMD Hierofalcon Cortex-A57" | 1 | DESCRIPTION = "Linux kernel for AMD Hierofalcon Cortex-A57" |
2 | FILESEXTRAPATHS_prepend := "${THISDIR}/linux-hierofalcon-4.1:" | ||
2 | 3 | ||
3 | COMPATIBLE_MACHINE = "hierofalcon*" | 4 | COMPATIBLE_MACHINE = "hierofalcon*" |
4 | 5 | ||
@@ -20,6 +21,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto-4.1;branch="standard/qemuarm64 | |||
20 | file://412-7-styx-linux-tracking.git-f9a9d954f23b967cd26338afda9a0a96afe62c25.patch \ | 21 | file://412-7-styx-linux-tracking.git-f9a9d954f23b967cd26338afda9a0a96afe62c25.patch \ |
21 | file://412-styx-Fix-build-issues-after-porting-PCI-patches-to-4.1.2-.patch \ | 22 | file://412-styx-Fix-build-issues-after-porting-PCI-patches-to-4.1.2-.patch \ |
22 | file://defconfig \ | 23 | file://defconfig \ |
24 | file://keys-CVE-2015-1333.patch \ | ||
23 | " | 25 | " |
24 | 26 | ||
25 | S = "${WORKDIR}/git" | 27 | S = "${WORKDIR}/git" |