Ertuğrul Erata
+42
@@ -0,0 +1,42 @@
|
||||
From: Tejun Heo <tj@kernel.org>
|
||||
Subject: [PATCH v2] libata: disable forced PORTS_IMPL for >= AHCI 1.3
|
||||
Date: Fri, 15 Jan 2016 15:13:05 -0500
|
||||
|
||||
Some early controllers incorrectly reported zero ports in PORTS_IMPL
|
||||
register and the ahci driver fabricates PORTS_IMPL from the number of
|
||||
ports in those cases. This hasn't mattered but with the new nvme
|
||||
controllers there are cases where zero PORTS_IMPL is valid and should
|
||||
be honored.
|
||||
|
||||
Disable the workaround for >= AHCI 1.3.
|
||||
|
||||
Signed-off-by: Tejun Heo <tj@kernel.org>
|
||||
Reported-by: Andy Lutomirski <luto@amacapital.net>
|
||||
Link: http://lkml.kernel.org/g/CALCETrU7yMvXEDhjAUShoHEhDwifJGapdw--BKxsP0jmjKGmRw@mail.gmail.com
|
||||
---
|
||||
Hello, Andy.
|
||||
|
||||
Can you please see whether this one works?
|
||||
|
||||
Thanks.
|
||||
|
||||
drivers/ata/libahci.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
|
||||
index d61740e..a91432a 100644
|
||||
--- a/drivers/ata/libahci.c
|
||||
+++ b/drivers/ata/libahci.c
|
||||
@@ -496,8 +496,9 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
|
||||
}
|
||||
}
|
||||
|
||||
- /* fabricate port_map from cap.nr_ports */
|
||||
- if (!port_map) {
|
||||
+ /* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
|
||||
+ if (!port_map && (!(vers >> 16) ||
|
||||
+ ((vers >> 16) == 1 && (vers & 0xFFFF) < 0x300))) {
|
||||
port_map = (1 << ahci_nr_ports(cap)) - 1;
|
||||
dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);
|
||||
|
||||
|
||||
+82
@@ -0,0 +1,82 @@
|
||||
From 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 Mon Sep 17 00:00:00 2001
|
||||
From: Yevgeny Pats <yevgeny@perception-point.io>
|
||||
Date: Tue, 19 Jan 2016 22:09:04 +0000
|
||||
Subject: KEYS: Fix keyring ref leak in join_session_keyring()
|
||||
|
||||
From: Yevgeny Pats <yevgeny@perception-point.io>
|
||||
|
||||
commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 upstream.
|
||||
|
||||
This fixes CVE-2016-0728.
|
||||
|
||||
If a thread is asked to join as a session keyring the keyring that's already
|
||||
set as its session, we leak a keyring reference.
|
||||
|
||||
This can be tested with the following program:
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <keyutils.h>
|
||||
|
||||
int main(int argc, const char *argv[])
|
||||
{
|
||||
int i = 0;
|
||||
key_serial_t serial;
|
||||
|
||||
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
|
||||
"leaked-keyring");
|
||||
if (serial < 0) {
|
||||
perror("keyctl");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (keyctl(KEYCTL_SETPERM, serial,
|
||||
KEY_POS_ALL | KEY_USR_ALL) < 0) {
|
||||
perror("keyctl");
|
||||
return -1;
|
||||
}
|
||||
|
||||
for (i = 0; i < 100; i++) {
|
||||
serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
|
||||
"leaked-keyring");
|
||||
if (serial < 0) {
|
||||
perror("keyctl");
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
If, after the program has run, there something like the following line in
|
||||
/proc/keys:
|
||||
|
||||
3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty
|
||||
|
||||
with a usage count of 100 * the number of times the program has been run,
|
||||
then the kernel is malfunctioning. If leaked-keyring has zero usages or
|
||||
has been garbage collected, then the problem is fixed.
|
||||
|
||||
Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
|
||||
Signed-off-by: David Howells <dhowells@redhat.com>
|
||||
Acked-by: Don Zickus <dzickus@redhat.com>
|
||||
Acked-by: Prarit Bhargava <prarit@redhat.com>
|
||||
Acked-by: Jarod Wilson <jarod@redhat.com>
|
||||
Signed-off-by: James Morris <james.l.morris@oracle.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
---
|
||||
security/keys/process_keys.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
--- a/security/keys/process_keys.c
|
||||
+++ b/security/keys/process_keys.c
|
||||
@@ -794,6 +794,7 @@ long join_session_keyring(const char *na
|
||||
ret = PTR_ERR(keyring);
|
||||
goto error2;
|
||||
} else if (keyring == new->session_keyring) {
|
||||
+ key_put(keyring);
|
||||
ret = 0;
|
||||
goto error2;
|
||||
}
|
||||
@@ -122,6 +122,9 @@ block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch
|
||||
# ahci ids
|
||||
ahci-add-new-Intel-device-IDs.patch
|
||||
|
||||
# ahci fix
|
||||
ata-libata-disable-forced-PORTS_IMPL-for-AHCI-1.3.patch
|
||||
|
||||
###
|
||||
### File-system
|
||||
###
|
||||
@@ -346,6 +349,9 @@ video-mageia-logo.patch
|
||||
### Security
|
||||
###
|
||||
|
||||
# CVE-2016-0728
|
||||
keys-fix-keyring-ref-leak-in-join_session_keyring.patch
|
||||
|
||||
###
|
||||
### Smack fixes
|
||||
###
|
||||
|
||||
@@ -29,7 +29,7 @@
|
||||
<Patches>
|
||||
<!-- Linux patches -->
|
||||
<!--Patch level="1" compressionType="xz">patches/linux/patch-4.3.2.xz</Patch-->
|
||||
<!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.4.0/1.mga6/PATCHES/patches/series-->
|
||||
<!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.4.0/2.mga6/PATCHES/patches/series-->
|
||||
<!--stable patches-->
|
||||
<!--other patches-->
|
||||
<Patch level="1">patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch</Patch>
|
||||
@@ -140,7 +140,9 @@
|
||||
<Patch level="1">patches/mageia/3rd-viahss-2.6.35-buildfix.patch</Patch>
|
||||
<Patch level="1">patches/mageia/3rd-viahss-3.0-buildfix.patch</Patch>
|
||||
<Patch level="1">patches/mageia/3rd-rtl8723bs.patch</Patch>
|
||||
<Patch level="1">patches/mageia/ahci-add-new-Intel-device-IDs.patch</Patch>
|
||||
<Patch level="1">patches/mageia/ahci-add-new-Intel-device-IDs.patch</Patch>
|
||||
<Patch level="1">patches/mageia/ata-libata-disable-forced-PORTS_IMPL-for-AHCI-1.3.patch</Patch>
|
||||
<Patch level="1">patches/mageia/keys-fix-keyring-ref-leak-in-join_session_keyring.patch</Patch>
|
||||
<Patch level="1">patches/mageia/arm-0001-dt-bindings-Add-root-properties-for-Raspberry-Pi-2.patch</Patch>
|
||||
<Patch level="1">patches/mageia/arm-0002-ARM-bcm2835-Add-a-compat-string-for-bcm2836-machine-.patch</Patch>
|
||||
<Patch level="1">patches/mageia/arm-0003-ARM-bcm2835-Add-Kconfig-support-for-bcm2836.patch</Patch>
|
||||
@@ -208,9 +210,9 @@
|
||||
|
||||
<History>
|
||||
<Update release="69">
|
||||
<Date>2016-01-11</Date>
|
||||
<Date>2016-01-25</Date>
|
||||
<Version>4.4.0</Version>
|
||||
<Comment>Version bump to 4.4.0</Comment>
|
||||
<Comment>Version bump to 4.4.0,add CVE-2016-0728 patch.</Comment>
|
||||
<Type package="kernel">security</Type>
|
||||
<Requires>
|
||||
<Action package="kernel">systemRestart</Action>
|
||||
|
||||
Reference in New Issue
Block a user