Merge pull request #209 from ertugerata/kernel-4.4

add CVE patch..

kernel/kernel/files/patches/mageia/ata-libata-disable-forced-PORTS_IMPL-for-AHCI-1.3.patch

@@ -0,0 +1,42 @@
+From: Tejun Heo <tj@kernel.org>
+Subject: [PATCH v2] libata: disable forced PORTS_IMPL for >= AHCI 1.3
+Date: Fri, 15 Jan 2016 15:13:05 -0500
+
+Some early controllers incorrectly reported zero ports in PORTS_IMPL
+register and the ahci driver fabricates PORTS_IMPL from the number of
+ports in those cases.  This hasn't mattered but with the new nvme
+controllers there are cases where zero PORTS_IMPL is valid and should
+be honored.
+
+Disable the workaround for >= AHCI 1.3.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Andy Lutomirski <luto@amacapital.net>
+Link: http://lkml.kernel.org/g/CALCETrU7yMvXEDhjAUShoHEhDwifJGapdw--BKxsP0jmjKGmRw@mail.gmail.com
+---
+Hello, Andy.
+
+Can you please see whether this one works?
+
+Thanks.
+
+ drivers/ata/libahci.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index d61740e..a91432a 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -496,8 +496,9 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
+ 		}
+ 	}
+ 
+-	/* fabricate port_map from cap.nr_ports */
+-	if (!port_map) {
++	/* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
++	if (!port_map && (!(vers >> 16) ||
++			  ((vers >> 16) == 1 && (vers & 0xFFFF) < 0x300))) {
+ 		port_map = (1 << ahci_nr_ports(cap)) - 1;
+ 		dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);
+ 
+

kernel/kernel/files/patches/mageia/keys-fix-keyring-ref-leak-in-join_session_keyring.patch

@@ -0,0 +1,82 @@
+From 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 Mon Sep 17 00:00:00 2001
+From: Yevgeny Pats <yevgeny@perception-point.io>
+Date: Tue, 19 Jan 2016 22:09:04 +0000
+Subject: KEYS: Fix keyring ref leak in join_session_keyring()
+
+From: Yevgeny Pats <yevgeny@perception-point.io>
+
+commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 upstream.
+
+This fixes CVE-2016-0728.
+
+If a thread is asked to join as a session keyring the keyring that's already
+set as its session, we leak a keyring reference.
+
+This can be tested with the following program:
+
+	#include <stddef.h>
+	#include <stdio.h>
+	#include <sys/types.h>
+	#include <keyutils.h>
+
+	int main(int argc, const char *argv[])
+	{
+		int i = 0;
+		key_serial_t serial;
+
+		serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
+				"leaked-keyring");
+		if (serial < 0) {
+			perror("keyctl");
+			return -1;
+		}
+
+		if (keyctl(KEYCTL_SETPERM, serial,
+			   KEY_POS_ALL | KEY_USR_ALL) < 0) {
+			perror("keyctl");
+			return -1;
+		}
+
+		for (i = 0; i < 100; i++) {
+			serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
+					"leaked-keyring");
+			if (serial < 0) {
+				perror("keyctl");
+				return -1;
+			}
+		}
+
+		return 0;
+	}
+
+If, after the program has run, there something like the following line in
+/proc/keys:
+
+3f3d898f I--Q---   100 perm 3f3f0000     0     0 keyring   leaked-keyring: empty
+
+with a usage count of 100 * the number of times the program has been run,
+then the kernel is malfunctioning.  If leaked-keyring has zero usages or
+has been garbage collected, then the problem is fixed.
+
+Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Don Zickus <dzickus@redhat.com>
+Acked-by: Prarit Bhargava <prarit@redhat.com>
+Acked-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/process_keys.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -794,6 +794,7 @@ long join_session_keyring(const char *na
+ 		ret = PTR_ERR(keyring);
+ 		goto error2;
+ 	} else if (keyring == new->session_keyring) {
++		key_put(keyring);
+ 		ret = 0;
+ 		goto error2;
+ 	}

kernel/kernel/files/patches/mageia/series

@@ -122,6 +122,9 @@ block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch
 # ahci ids
 ahci-add-new-Intel-device-IDs.patch
 
+# ahci fix
+ata-libata-disable-forced-PORTS_IMPL-for-AHCI-1.3.patch
+
 ###
 ### File-system
 ###
@@ -346,6 +349,9 @@ video-mageia-logo.patch
 ### Security
 ###
 
+# CVE-2016-0728
+keys-fix-keyring-ref-leak-in-join_session_keyring.patch
+
 ###
 ### Smack fixes
 ###

kernel/kernel/pspec.xml

@@ -29,7 +29,7 @@
         <Patches>
             <!-- Linux patches -->
             <!--Patch level="1" compressionType="xz">patches/linux/patch-4.3.2.xz</Patch-->
-            <!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.4.0/1.mga6/PATCHES/patches/series-->
+            <!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.4.0/2.mga6/PATCHES/patches/series-->
             <!--stable patches-->
             <!--other patches-->
             <Patch level="1">patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch</Patch>
@@ -140,7 +140,9 @@
             <Patch level="1">patches/mageia/3rd-viahss-2.6.35-buildfix.patch</Patch>
             <Patch level="1">patches/mageia/3rd-viahss-3.0-buildfix.patch</Patch>
             <Patch level="1">patches/mageia/3rd-rtl8723bs.patch</Patch>
-            <Patch level="1">patches/mageia/ahci-add-new-Intel-device-IDs.patch</Patch>           
+            <Patch level="1">patches/mageia/ahci-add-new-Intel-device-IDs.patch</Patch>
+            <Patch level="1">patches/mageia/ata-libata-disable-forced-PORTS_IMPL-for-AHCI-1.3.patch</Patch>
+            <Patch level="1">patches/mageia/keys-fix-keyring-ref-leak-in-join_session_keyring.patch</Patch>
             <Patch level="1">patches/mageia/arm-0001-dt-bindings-Add-root-properties-for-Raspberry-Pi-2.patch</Patch>
             <Patch level="1">patches/mageia/arm-0002-ARM-bcm2835-Add-a-compat-string-for-bcm2836-machine-.patch</Patch>
             <Patch level="1">patches/mageia/arm-0003-ARM-bcm2835-Add-Kconfig-support-for-bcm2836.patch</Patch>
@@ -208,9 +210,9 @@
 
     <History>
           <Update release="69">
-            <Date>2016-01-11</Date>
+            <Date>2016-01-25</Date>
             <Version>4.4.0</Version>
-            <Comment>Version bump to 4.4.0</Comment>
+            <Comment>Version bump to 4.4.0,add CVE-2016-0728 patch.</Comment>
             <Type package="kernel">security</Type>
             <Requires>
                 <Action package="kernel">systemRestart</Action>