Browse code
kernels: fix CVE-2017-11473
Extras:
linux-esx: [feature] p9fs_dir_readdir() offset support
Change-Id: If8f19553d26daefd24e5bd15d68658d2837f373a
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3362
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Alexey Makhalov authored on 2017/07/29 08:27:32Showing 3 changed files
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
%global security_hardening none |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux-esx |
| 4 |
-Version: 4.4.77 |
|
| 4 |
+Version: 4.4.79 |
|
| 5 | 5 |
Release: 1%{?dist}
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| ... | ... |
@@ -9,7 +9,7 @@ Group: System Environment/Kernel |
| 9 | 9 |
Vendor: VMware, Inc. |
| 10 | 10 |
Distribution: Photon |
| 11 | 11 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz
|
| 12 |
-%define sha1 linux=19dc4c74fbf09f5fe5f88c32a9524bd94af0ec44 |
|
| 12 |
+%define sha1 linux=5b249aa3410b464515178df8f9a1ff0e3ba3f67e |
|
| 13 | 13 |
Source1: config-esx |
| 14 | 14 |
Patch0: double-tcp_mem-limits.patch |
| 15 | 15 |
Patch1: linux-4.4-sysctl-sched_weighted_cpuload_uses_rla.patch |
| ... | ... |
@@ -34,6 +34,7 @@ Patch19: serial-8250-do-not-probe-U6-16550A-fifo-size.patch |
| 34 | 34 |
Patch20: vmci-1.1.4.0-use-32bit-atomics-for-queue-headers.patch |
| 35 | 35 |
Patch21: vmci-1.1.5.0-doorbell-create-and-destroy-fixes.patch |
| 36 | 36 |
Patch22: net-9p-vsock.patch |
| 37 |
+Patch23: p9fs_dir_readdir-offset-support.patch |
|
| 37 | 38 |
BuildRequires: bc |
| 38 | 39 |
BuildRequires: kbd |
| 39 | 40 |
BuildRequires: kmod |
| ... | ... |
@@ -92,6 +93,7 @@ The Linux package contains the Linux kernel doc files |
| 92 | 92 |
%patch20 -p1 |
| 93 | 93 |
%patch21 -p1 |
| 94 | 94 |
%patch22 -p1 |
| 95 |
+%patch23 -p1 |
|
| 95 | 96 |
|
| 96 | 97 |
%build |
| 97 | 98 |
# patch vmw_balloon driver |
| ... | ... |
@@ -180,6 +182,9 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
|
| 180 | 180 |
/usr/src/linux-headers-%{uname_r}
|
| 181 | 181 |
|
| 182 | 182 |
%changelog |
| 183 |
+* Fri Jul 28 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.79-1 |
|
| 184 |
+- [feature] p9fs_dir_readdir() offset support |
|
| 185 |
+- Fix CVE-2017-11473 |
|
| 183 | 186 |
* Mon Jul 17 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.77-1 |
| 184 | 187 |
- [feature] IP tunneling support (CONFIG_NET_IPIP=m) |
| 185 | 188 |
- Fix CVE-2017-11176 |
| ... | ... |
@@ -1,15 +1,15 @@ |
| 1 | 1 |
%global security_hardening none |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux |
| 4 |
-Version: 4.4.77 |
|
| 5 |
-Release: 2%{?dist}
|
|
| 4 |
+Version: 4.4.79 |
|
| 5 |
+Release: 1%{?dist}
|
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| 8 | 8 |
Group: System Environment/Kernel |
| 9 | 9 |
Vendor: VMware, Inc. |
| 10 | 10 |
Distribution: Photon |
| 11 | 11 |
Source0: http://www.kernel.org/pub/linux/kernel/v4.x/%{name}-%{version}.tar.xz
|
| 12 |
-%define sha1 linux=19dc4c74fbf09f5fe5f88c32a9524bd94af0ec44 |
|
| 12 |
+%define sha1 linux=5b249aa3410b464515178df8f9a1ff0e3ba3f67e |
|
| 13 | 13 |
Source1: config |
| 14 | 14 |
%define ena_version 1.1.3 |
| 15 | 15 |
Source2: https://github.com/amzn/amzn-drivers/archive/ena_linux_1.1.3.tar.gz |
| ... | ... |
@@ -277,6 +277,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
|
| 277 | 277 |
/usr/share/perf-core |
| 278 | 278 |
|
| 279 | 279 |
%changelog |
| 280 |
+* Wed Aug 02 2017 Alexey Makhalov <amakhalov@vmware.com> 4.4.79-1 |
|
| 281 |
+- Fix CVE-2017-11473 |
|
| 280 | 282 |
* Tue Aug 01 2017 Anish Swaminathan <anishs@vmware.com> 4.4.77-2 |
| 281 | 283 |
- Allow some algorithms in FIPS mode |
| 282 | 284 |
- Reverts 284a0f6e87b0721e1be8bca419893902d9cf577a and backports |
| 283 | 285 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,69 @@ |
| 0 |
+From 83adb57ec7ca18b9c5d1290e88b1fe139b280f66 Mon Sep 17 00:00:00 2001 |
|
| 1 |
+From: Wenguang Wang <wenguangw@vmware.com> |
|
| 2 |
+Date: Fri, 28 Jul 2017 16:19:44 -0700 |
|
| 3 |
+Subject: [PATCH] p9fs_dir_readdir offset support |
|
| 4 |
+ |
|
| 5 |
+In the linux 9p client fs module, in readdir implementation, we do not check |
|
| 6 |
+for current offset position (which could have been changed by a seek call), and |
|
| 7 |
+keep returning (now incorrect) data from the already read and remaining buffer. |
|
| 8 |
+--- |
|
| 9 |
+ fs/9p/vfs_dir.c | 8 ++++++-- |
|
| 10 |
+ 1 file changed, 6 insertions(+), 2 deletions(-) |
|
| 11 |
+ |
|
| 12 |
+diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c |
|
| 13 |
+index 5cc00e56206e..a876cc9a473a 100644 |
|
| 14 |
+--- a/fs/9p/vfs_dir.c |
|
| 15 |
+@@ -45,6 +45,7 @@ |
|
| 16 |
+ * struct p9_rdir - readdir accounting |
|
| 17 |
+ * @head: start offset of current dirread buffer |
|
| 18 |
+ * @tail: end offset of current dirread buffer |
|
| 19 |
++ * @pos: expected dir offset to read the dirread buffer @head |
|
| 20 |
+ * @buf: dirread buffer |
|
| 21 |
+ * |
|
| 22 |
+ * private structure for keeping track of readdir |
|
| 23 |
+@@ -54,6 +55,7 @@ |
|
| 24 |
+ struct p9_rdir {
|
|
| 25 |
+ int head; |
|
| 26 |
+ int tail; |
|
| 27 |
++ off_t pos; |
|
| 28 |
+ uint8_t buf[]; |
|
| 29 |
+ }; |
|
| 30 |
+ |
|
| 31 |
+@@ -130,7 +132,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) |
|
| 32 |
+ kvec.iov_len = buflen; |
|
| 33 |
+ |
|
| 34 |
+ while (1) {
|
|
| 35 |
+- if (rdir->tail == rdir->head) {
|
|
| 36 |
++ if (rdir->tail == rdir->head || rdir->pos != ctx->pos) {
|
|
| 37 |
+ struct iov_iter to; |
|
| 38 |
+ int n; |
|
| 39 |
+ iov_iter_kvec(&to, READ | ITER_KVEC, &kvec, 1, buflen); |
|
| 40 |
+@@ -162,6 +164,7 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) |
|
| 41 |
+ return 0; |
|
| 42 |
+ |
|
| 43 |
+ rdir->head += reclen; |
|
| 44 |
++ rdir->pos += reclen; |
|
| 45 |
+ ctx->pos += reclen; |
|
| 46 |
+ } |
|
| 47 |
+ } |
|
| 48 |
+@@ -191,7 +194,7 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx) |
|
| 49 |
+ return -ENOMEM; |
|
| 50 |
+ |
|
| 51 |
+ while (1) {
|
|
| 52 |
+- if (rdir->tail == rdir->head) {
|
|
| 53 |
++ if (rdir->tail == rdir->head || rdir->pos != ctx->pos) {
|
|
| 54 |
+ err = p9_client_readdir(fid, rdir->buf, buflen, |
|
| 55 |
+ ctx->pos); |
|
| 56 |
+ if (err <= 0) |
|
| 57 |
+@@ -218,6 +221,7 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx) |
|
| 58 |
+ return 0; |
|
| 59 |
+ |
|
| 60 |
+ ctx->pos = curdirent.d_off; |
|
| 61 |
++ rdir->pos = curdirent.d_off; |
|
| 62 |
+ rdir->head += err; |
|
| 63 |
+ } |
|
| 64 |
+ } |
|
| 65 |
+-- |
|
| 66 |
+2.11.0 |
|
| 67 |
+ |