Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1675567 > unrolled thread

[PATCH 3.16 0/7] 3.16.45-rc1 review

Started byBen Hutchings <ben@decadent.org.uk>
First post2017-06-27 13:20 +0200
Last post2017-06-27 19:20 +0200
Articles 6 — 2 participants

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.16 0/7] 3.16.45-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-06-27 13:20 +0200
    [PATCH 3.16 2/7] mm: fix new crash in unmapped_area_topdown() Ben Hutchings <ben@decadent.org.uk> - 2017-06-27 13:20 +0200
    [PATCH 3.16 6/7] rxrpc: Fix several cases where a padded len  isn't checked in ticket decode Ben Hutchings <ben@decadent.org.uk> - 2017-06-27 13:20 +0200
    [PATCH 3.16 3/7] Allow stack to grow up to address space limit Ben Hutchings <ben@decadent.org.uk> - 2017-06-27 13:20 +0200
    Re: [PATCH 3.16 0/7] 3.16.45-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-06-27 15:40 +0200
      Re: [PATCH 3.16 0/7] 3.16.45-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-06-27 19:20 +0200

#1675567 — [PATCH 3.16 0/7] 3.16.45-rc1 review

FromBen Hutchings <ben@decadent.org.uk>
Date2017-06-27 13:20 +0200
Subject[PATCH 3.16 0/7] 3.16.45-rc1 review
Message-ID<tWWHf-8aL-3@gated-at.bofh.it>
This is the start of the stable review cycle for the 3.16.45 release.
There are 7 patches in this series, which will be posted as responses
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu Jun 29 11:10:33 UTC 2017.
Anything received after that time might be too late.

A combined patch relative to 3.16.44 will be posted as an additional
response to this.  A shortlog and diffstat can be found below.

Ben.

-------------

David Howells (1):
      rxrpc: Fix several cases where a padded len isn't checked in ticket decode
         [5f2f97656ada8d811d3c1bef503ced266fcd53a0]

Helge Deller (1):
      Allow stack to grow up to address space limit
         [bd726c90b6b8ce87602208701b208a208e6d5600]

Hugh Dickins (2):
      mm: fix new crash in unmapped_area_topdown()
         [f4cb767d76cf7ee72f97dd76f6cfa6c76a5edc89]
      mm: larger stack guard gap, between vmas
         [1be7107fbe18eed3e319a6c3e83c78254b693acb]

Paolo Bonzini (1):
      KVM: x86: fix singlestepping over syscall
         [c8401dda2f0a00cd25c0af6a95ed50e478d25de4]

Seung-Woo Kim (1):
      regulator: core: Fix regualtor_ena_gpio_free not to access pin after freeing
         [60a2362f769cf549dc466134efe71c8bf9fbaaba]

Vladis Dronov (1):
      drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
         [ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf]

 Documentation/kernel-parameters.txt     |   7 ++
 Makefile                                |   4 +-
 arch/arc/mm/mmap.c                      |   2 +-
 arch/arm/mm/mmap.c                      |   4 +-
 arch/frv/mm/elf-fdpic.c                 |   2 +-
 arch/mips/mm/mmap.c                     |   2 +-
 arch/parisc/kernel/sys_parisc.c         |  15 +--
 arch/powerpc/mm/slice.c                 |   2 +-
 arch/sh/mm/mmap.c                       |   4 +-
 arch/sparc/kernel/sys_sparc_64.c        |   4 +-
 arch/sparc/mm/hugetlbpage.c             |   2 +-
 arch/tile/mm/hugetlbpage.c              |   2 +-
 arch/x86/include/asm/kvm_emulate.h      |   1 +
 arch/x86/kernel/sys_x86_64.c            |   4 +-
 arch/x86/kvm/emulate.c                  |   1 +
 arch/x86/kvm/x86.c                      |  53 +++++------
 arch/x86/mm/hugetlbpage.c               |   2 +-
 arch/xtensa/kernel/syscall.c            |   2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c |   3 +
 drivers/regulator/core.c                |   2 +
 fs/hugetlbfs/inode.c                    |   2 +-
 fs/proc/task_mmu.c                      |   4 -
 include/linux/mm.h                      |  53 +++++------
 mm/gup.c                                |   5 -
 mm/memory.c                             |  38 --------
 mm/mmap.c                               | 160 +++++++++++++++++++-------------
 net/rxrpc/ar-key.c                      |  64 +++++++------
 27 files changed, 220 insertions(+), 224 deletions(-)

-- 
Ben Hutchings
Absolutum obsoletum. (If it works, it's out of date.) - Stafford Beer

[toc] | [next] | [standalone]

#1675569 — [PATCH 3.16 2/7] mm: fix new crash in unmapped_area_topdown()

FromBen Hutchings <ben@decadent.org.uk>
Date2017-06-27 13:20 +0200
Subject[PATCH 3.16 2/7] mm: fix new crash in unmapped_area_topdown()
Message-ID<tWWHg-8aL-37@gated-at.bofh.it>
In reply to#1675567
3.16.45-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Hugh Dickins <hughd@google.com>

commit f4cb767d76cf7ee72f97dd76f6cfa6c76a5edc89 upstream.

Trinity gets kernel BUG at mm/mmap.c:1963! in about 3 minutes of
mmap testing.  That's the VM_BUG_ON(gap_end < gap_start) at the
end of unmapped_area_topdown().  Linus points out how MAP_FIXED
(which does not have to respect our stack guard gap intentions)
could result in gap_end below gap_start there.  Fix that, and
the similar case in its alternative, unmapped_area().

Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas")
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Debugged-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 mm/mmap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1732,7 +1732,8 @@ check_current:
 		/* Check if current node has a suitable gap */
 		if (gap_start > high_limit)
 			return -ENOMEM;
-		if (gap_end >= low_limit && gap_end - gap_start >= length)
+		if (gap_end >= low_limit &&
+		    gap_end > gap_start && gap_end - gap_start >= length)
 			goto found;
 
 		/* Visit right subtree if it looks promising */
@@ -1835,7 +1836,8 @@ check_current:
 		gap_end = vm_start_gap(vma);
 		if (gap_end < low_limit)
 			return -ENOMEM;
-		if (gap_start <= high_limit && gap_end - gap_start >= length)
+		if (gap_start <= high_limit &&
+		    gap_end > gap_start && gap_end - gap_start >= length)
 			goto found;
 
 		/* Visit left subtree if it looks promising */

[toc] | [prev] | [next] | [standalone]

#1675571 — [PATCH 3.16 6/7] rxrpc: Fix several cases where a padded len isn't checked in ticket decode

FromBen Hutchings <ben@decadent.org.uk>
Date2017-06-27 13:20 +0200
Subject[PATCH 3.16 6/7] rxrpc: Fix several cases where a padded len isn't checked in ticket decode
Message-ID<tWWHg-8aL-39@gated-at.bofh.it>
In reply to#1675567
3.16.45-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

commit 5f2f97656ada8d811d3c1bef503ced266fcd53a0 upstream.

This fixes CVE-2017-7482.

When a kerberos 5 ticket is being decoded so that it can be loaded into an
rxrpc-type key, there are several places in which the length of a
variable-length field is checked to make sure that it's not going to
overrun the available data - but the data is padded to the nearest
four-byte boundary and the code doesn't check for this extra.  This could
lead to the size-remaining variable wrapping and the data pointer going
over the end of the buffer.

Fix this by making the various variable-length data checks use the padded
length.

Reported-by: 石磊 <shilei-c@360.cn>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.c.dionne@auristor.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/rxrpc/ar-key.c | 64 ++++++++++++++++++++++++++++++---------------------------
 1 file changed, 34 insertions(+), 30 deletions(-)

--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -213,7 +213,7 @@ static int rxrpc_krb5_decode_principal(s
 				       unsigned int *_toklen)
 {
 	const __be32 *xdr = *_xdr;
-	unsigned int toklen = *_toklen, n_parts, loop, tmp;
+	unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen;
 
 	/* there must be at least one name, and at least #names+1 length
 	 * words */
@@ -243,16 +243,16 @@ static int rxrpc_krb5_decode_principal(s
 		toklen -= 4;
 		if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX)
 			return -EINVAL;
-		if (tmp > toklen)
+		paddedlen = (tmp + 3) & ~3;
+		if (paddedlen > toklen)
 			return -EINVAL;
 		princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL);
 		if (!princ->name_parts[loop])
 			return -ENOMEM;
 		memcpy(princ->name_parts[loop], xdr, tmp);
 		princ->name_parts[loop][tmp] = 0;
-		tmp = (tmp + 3) & ~3;
-		toklen -= tmp;
-		xdr += tmp >> 2;
+		toklen -= paddedlen;
+		xdr += paddedlen >> 2;
 	}
 
 	if (toklen < 4)
@@ -261,16 +261,16 @@ static int rxrpc_krb5_decode_principal(s
 	toklen -= 4;
 	if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX)
 		return -EINVAL;
-	if (tmp > toklen)
+	paddedlen = (tmp + 3) & ~3;
+	if (paddedlen > toklen)
 		return -EINVAL;
 	princ->realm = kmalloc(tmp + 1, GFP_KERNEL);
 	if (!princ->realm)
 		return -ENOMEM;
 	memcpy(princ->realm, xdr, tmp);
 	princ->realm[tmp] = 0;
-	tmp = (tmp + 3) & ~3;
-	toklen -= tmp;
-	xdr += tmp >> 2;
+	toklen -= paddedlen;
+	xdr += paddedlen >> 2;
 
 	_debug("%s/...@%s", princ->name_parts[0], princ->realm);
 
@@ -289,7 +289,7 @@ static int rxrpc_krb5_decode_tagged_data
 					 unsigned int *_toklen)
 {
 	const __be32 *xdr = *_xdr;
-	unsigned int toklen = *_toklen, len;
+	unsigned int toklen = *_toklen, len, paddedlen;
 
 	/* there must be at least one tag and one length word */
 	if (toklen <= 8)
@@ -303,15 +303,17 @@ static int rxrpc_krb5_decode_tagged_data
 	toklen -= 8;
 	if (len > max_data_size)
 		return -EINVAL;
+	paddedlen = (len + 3) & ~3;
+	if (paddedlen > toklen)
+		return -EINVAL;
 	td->data_len = len;
 
 	if (len > 0) {
 		td->data = kmemdup(xdr, len, GFP_KERNEL);
 		if (!td->data)
 			return -ENOMEM;
-		len = (len + 3) & ~3;
-		toklen -= len;
-		xdr += len >> 2;
+		toklen -= paddedlen;
+		xdr += paddedlen >> 2;
 	}
 
 	_debug("tag %x len %x", td->tag, td->data_len);
@@ -383,7 +385,7 @@ static int rxrpc_krb5_decode_ticket(u8 *
 				    const __be32 **_xdr, unsigned int *_toklen)
 {
 	const __be32 *xdr = *_xdr;
-	unsigned int toklen = *_toklen, len;
+	unsigned int toklen = *_toklen, len, paddedlen;
 
 	/* there must be at least one length word */
 	if (toklen <= 4)
@@ -395,6 +397,9 @@ static int rxrpc_krb5_decode_ticket(u8 *
 	toklen -= 4;
 	if (len > AFSTOKEN_K5_TIX_MAX)
 		return -EINVAL;
+	paddedlen = (len + 3) & ~3;
+	if (paddedlen > toklen)
+		return -EINVAL;
 	*_tktlen = len;
 
 	_debug("ticket len %u", len);
@@ -403,9 +408,8 @@ static int rxrpc_krb5_decode_ticket(u8 *
 		*_ticket = kmemdup(xdr, len, GFP_KERNEL);
 		if (!*_ticket)
 			return -ENOMEM;
-		len = (len + 3) & ~3;
-		toklen -= len;
-		xdr += len >> 2;
+		toklen -= paddedlen;
+		xdr += paddedlen >> 2;
 	}
 
 	*_xdr = xdr;
@@ -549,7 +553,7 @@ static int rxrpc_instantiate_xdr(struct
 {
 	const __be32 *xdr = data, *token;
 	const char *cp;
-	unsigned int len, tmp, loop, ntoken, toklen, sec_ix;
+	unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix;
 	int ret;
 
 	_enter(",{%x,%x,%x,%x},%zu",
@@ -574,22 +578,21 @@ static int rxrpc_instantiate_xdr(struct
 	if (len < 1 || len > AFSTOKEN_CELL_MAX)
 		goto not_xdr;
 	datalen -= 4;
-	tmp = (len + 3) & ~3;
-	if (tmp > datalen)
+	paddedlen = (len + 3) & ~3;
+	if (paddedlen > datalen)
 		goto not_xdr;
 
 	cp = (const char *) xdr;
 	for (loop = 0; loop < len; loop++)
 		if (!isprint(cp[loop]))
 			goto not_xdr;
-	if (len < tmp)
-		for (; loop < tmp; loop++)
-			if (cp[loop])
-				goto not_xdr;
+	for (; loop < paddedlen; loop++)
+		if (cp[loop])
+			goto not_xdr;
 	_debug("cellname: [%u/%u] '%*.*s'",
-	       len, tmp, len, len, (const char *) xdr);
-	datalen -= tmp;
-	xdr += tmp >> 2;
+	       len, paddedlen, len, len, (const char *) xdr);
+	datalen -= paddedlen;
+	xdr += paddedlen >> 2;
 
 	/* get the token count */
 	if (datalen < 12)
@@ -610,10 +613,11 @@ static int rxrpc_instantiate_xdr(struct
 		sec_ix = ntohl(*xdr);
 		datalen -= 4;
 		_debug("token: [%x/%zx] %x", toklen, datalen, sec_ix);
-		if (toklen < 20 || toklen > datalen)
+		paddedlen = (toklen + 3) & ~3;
+		if (toklen < 20 || toklen > datalen || paddedlen > datalen)
 			goto not_xdr;
-		datalen -= (toklen + 3) & ~3;
-		xdr += (toklen + 3) >> 2;
+		datalen -= paddedlen;
+		xdr += paddedlen >> 2;
 
 	} while (--loop > 0);

[toc] | [prev] | [next] | [standalone]

#1675572 — [PATCH 3.16 3/7] Allow stack to grow up to address space limit

FromBen Hutchings <ben@decadent.org.uk>
Date2017-06-27 13:20 +0200
Subject[PATCH 3.16 3/7] Allow stack to grow up to address space limit
Message-ID<tWWHg-8aL-41@gated-at.bofh.it>
In reply to#1675567
3.16.45-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Helge Deller <deller@gmx.de>

commit bd726c90b6b8ce87602208701b208a208e6d5600 upstream.

Fix expand_upwards() on architectures with an upward-growing stack (parisc,
metag and partly IA-64) to allow the stack to reliably grow exactly up to
the address space limit given by TASK_SIZE.

Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 mm/mmap.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2139,16 +2139,19 @@ int expand_upwards(struct vm_area_struct
 	if (!(vma->vm_flags & VM_GROWSUP))
 		return -EFAULT;
 
-	/* Guard against wrapping around to address 0. */
+	/* Guard against exceeding limits of the address space. */
 	address &= PAGE_MASK;
-	address += PAGE_SIZE;
-	if (!address)
+	if (address >= TASK_SIZE)
 		return -ENOMEM;
+	address += PAGE_SIZE;
 
 	/* Enforce stack_guard_gap */
 	gap_addr = address + stack_guard_gap;
-	if (gap_addr < address)
-		return -ENOMEM;
+
+	/* Guard against overflow */
+	if (gap_addr < address || gap_addr > TASK_SIZE)
+		gap_addr = TASK_SIZE;
+
 	next = vma->vm_next;
 	if (next && next->vm_start < gap_addr) {
 		if (!(next->vm_flags & VM_GROWSUP))

[toc] | [prev] | [next] | [standalone]

#1675698

FromGuenter Roeck <linux@roeck-us.net>
Date2017-06-27 15:40 +0200
Message-ID<tWYSK-18m-3@gated-at.bofh.it>
In reply to#1675567
On 06/27/2017 04:10 AM, Ben Hutchings wrote:
> This is the start of the stable review cycle for the 3.16.45 release.
> There are 7 patches in this series, which will be posted as responses
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Thu Jun 29 11:10:33 UTC 2017.
> Anything received after that time might be too late.
> 

Build results:
	total: 136 pass: 136 fail: 0
Qemu test results:
	total: 107 pass: 107 fail: 0

Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [next] | [standalone]

#1676012

FromBen Hutchings <ben@decadent.org.uk>
Date2017-06-27 19:20 +0200
Message-ID<tX2jD-3CN-1@gated-at.bofh.it>
In reply to#1675698

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2017-06-27 at 06:37 -0700, Guenter Roeck wrote:
> On 06/27/2017 04:10 AM, Ben Hutchings wrote:
> > This is the start of the stable review cycle for the 3.16.45 release.
> > There are 7 patches in this series, which will be posted as responses
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Thu Jun 29 11:10:33 UTC 2017.
> > Anything received after that time might be too late.
> > 
> 
> Build results:
> 	total: 136 pass: 136 fail: 0
> Qemu test results:
> 	total: 107 pass: 107 fail: 0
> 
> Details are available at http://kerneltests.org/builders.

Thanks for checking these.

Ben.

-- 
Ben Hutchings
Absolutum obsoletum. (If it works, it's out of date.) - Stafford Beer

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web