1. photon
  2. Commit 09062db9e56bf7bdae68ed070a189bd6303b8f54
Browse code

kernels: Fix multiple CVEs

Fix CVE-2017-18216, CVE-2018-8043, CVE-2018-8087, CVE-2017-18241 and
CVE-2017-18224.
Also, disable floppy driver support (CONFIG_BLK_DEV_FD) in linux-aws.

Change-Id: Idde6a602dc8cad80941d46ecc56f4bb3bfdaeb37
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5126
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Bo Gan <ganb@vmware.com>

Srivatsa S. Bhat authored on 2018/05/05 09:46:05
Showing 10 changed files
SPECS/linux/0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
History View file @ 09062db
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,47 @@
0 
+From d4fdf8ba0e5808ba9ad6b44337783bd9935e0982 Mon Sep 17 00:00:00 2001
1 
+From: Yunlei He <heyunlei@huawei.com>
2 
+Date: Thu, 1 Jun 2017 16:43:51 +0800
3 
+Subject: [PATCH] f2fs: fix a panic caused by NULL flush_cmd_control
4 
+
5 
+Mount fs with option noflush_merge, boot failed for illegal address
6 
+fcc in function f2fs_issue_flush:
7 
+
8 
+        if (!test_opt(sbi, FLUSH_MERGE)) {
9 
+                ret = submit_flush_wait(sbi);
10 
+                atomic_inc(&fcc->issued_flush);   ->  Here, fcc illegal
11 
+                return ret;
12 
+        }
13 
+
14 
+Signed-off-by: Yunlei He <heyunlei@huawei.com>
15 
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
16 
+Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
17 
+---
18 
+ fs/f2fs/segment.c | 5 ++++-
19 
+ 1 file changed, 4 insertions(+), 1 deletion(-)
20 
+
21 
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
22 
+index e10f616..c94d5a9 100644
23 
+--- a/fs/f2fs/segment.c
24 
+@@ -488,6 +488,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
25 
+ 	init_waitqueue_head(&fcc->flush_wait_queue);
26 
+ 	init_llist_head(&fcc->issue_list);
27 
+ 	SM_I(sbi)->cmd_control_info = fcc;
28 
++	if (!test_opt(sbi, FLUSH_MERGE))
29 
++		return err;
30 
++
31 
+ 	fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
32 
+ 				"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
33 
+ 	if (IS_ERR(fcc->f2fs_issue_flush)) {
34 
+@@ -2534,7 +2537,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
35 
+
36 
+ 	INIT_LIST_HEAD(&sm_info->sit_entry_set);
37 
+
38 
+-	if (test_opt(sbi, FLUSH_MERGE) && !f2fs_readonly(sbi->sb)) {
39 
++	if (!f2fs_readonly(sbi->sb)) {
40 
+ 		err = create_flush_cmd_control(sbi);
41 
+ 		if (err)
42 
+ 			return err;
43 
+--
44 
+2.7.4
45 
+
SPECS/linux/0001-mac80211_hwsim-fix-possible-memory-leak-in-hwsim_new.patch
History View file @ 09062db
0 46 
new file mode 100644
... ... 
@@ -0,0 +1,38 @@
0 
+From 0ddcff49b672239dda94d70d0fcf50317a9f4b51 Mon Sep 17 00:00:00 2001
1 
+From: "weiyongjun (A)" <weiyongjun1@huawei.com>
2 
+Date: Thu, 18 Jan 2018 02:23:34 +0000
3 
+Subject: [PATCH] mac80211_hwsim: fix possible memory leak in
4 
+ hwsim_new_radio_nl()
5 
+
6 
+'hwname' is malloced in hwsim_new_radio_nl() and should be freed
7 
+before leaving from the error handling cases, otherwise it will cause
8 
+memory leak.
9 
+
10 
+Fixes: ff4dd73dd2b4 ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length")
11 
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
12 
+Reviewed-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
13 
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
14 
+Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
15 
+---
16 
+ drivers/net/wireless/mac80211_hwsim.c | 4 +++-
17 
+ 1 file changed, 3 insertions(+), 1 deletion(-)
18 
+
19 
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
20 
+index 2681b533..95e9641 100644
21 
+--- a/drivers/net/wireless/mac80211_hwsim.c
22 
+@@ -3084,8 +3084,10 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
23 
+ 	if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
24 
+ 		u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
25 
+
26 
+-		if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
27 
++		if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) {
28 
++			kfree(hwname);
29 
+ 			return -EINVAL;
30 
++		}
31 
+ 		param.regd = hwsim_world_regdom_custom[idx];
32 
+ 	}
33 
+
34 
+--
35 
+2.7.4
36 
+
SPECS/linux/0001-net-phy-mdio-bcm-unimac-fix-potential-NULL-dereferen.patch
History View file @ 09062db
0 37 
new file mode 100644
... ... 
@@ -0,0 +1,45 @@
0 
+From 297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5 Mon Sep 17 00:00:00 2001
1 
+From: Wei Yongjun <weiyongjun1@huawei.com>
2 
+Date: Thu, 11 Jan 2018 11:21:51 +0000
3 
+Subject: [PATCH] net: phy: mdio-bcm-unimac: fix potential NULL dereference in
4 
+ unimac_mdio_probe()
5 
+
6 
+platform_get_resource() may fail and return NULL, so we should
7 
+better check it's return value to avoid a NULL pointer dereference
8 
+a bit later in the code.
9 
+
10 
+This is detected by Coccinelle semantic patch.
11 
+
12 
+@@
13 
+expression pdev, res, n, t, e, e1, e2;
14 
+@@
15 
+
16 
+res = platform_get_resource(pdev, t, n);
17 
++ if (!res)
18 
++   return -EINVAL;
19 
+... when != res == NULL
20 
+e = devm_ioremap(e1, res->start, e2);
21 
+
22 
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
23 
+Signed-off-by: David S. Miller <davem@davemloft.net>
24 
+Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
25 
+---
26 
+ drivers/net/phy/mdio-bcm-unimac.c | 2 ++
27 
+ 1 file changed, 2 insertions(+)
28 
+
29 
+diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
30 
+index 8c73b2e..e6ff731 100644
31 
+--- a/drivers/net/phy/mdio-bcm-unimac.c
32 
+@@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev)
33 
+ 		return -ENOMEM;
34 
+
35 
+ 	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
36 
++	if (!r)
37 
++		return -EINVAL;
38 
+
39 
+ 	/* Just ioremap, as this MDIO block is usually integrated into an
40 
+ 	 * Ethernet MAC controller register range
41 
+--
42 
+2.7.4
43 
+
SPECS/linux/0001-ocfs2-ip_alloc_sem-should-be-taken-in-ocfs2_get_bloc.patch
History View file @ 09062db
0 44 
new file mode 100644
... ... 
@@ -0,0 +1,121 @@
0 
+From 3e4c56d41eef5595035872a2ec5a483f42e8917f Mon Sep 17 00:00:00 2001
1 
+From: alex chen <alex.chen@huawei.com>
2 
+Date: Wed, 15 Nov 2017 17:31:44 -0800
3 
+Subject: [PATCH] ocfs2: ip_alloc_sem should be taken in ocfs2_get_block()
4 
+
5 
+ip_alloc_sem should be taken in ocfs2_get_block() when reading file in
6 
+DIRECT mode to prevent concurrent access to extent tree with
7 
+ocfs2_dio_end_io_write(), which may cause BUGON in the following
8 
+situation:
9 
+
10 
+read file 'A'                                  end_io of writing file 'A'
11 
+vfs_read
12 
+ __vfs_read
13 
+  ocfs2_file_read_iter
14 
+   generic_file_read_iter
15 
+    ocfs2_direct_IO
16 
+     __blockdev_direct_IO
17 
+      do_blockdev_direct_IO
18 
+       do_direct_IO
19 
+        get_more_blocks
20 
+         ocfs2_get_block
21 
+          ocfs2_extent_map_get_blocks
22 
+           ocfs2_get_clusters
23 
+            ocfs2_get_clusters_nocache()
24 
+             ocfs2_search_extent_list
25 
+              return the index of record which
26 
+              contains the v_cluster, that is
27 
+              v_cluster > rec[i]->e_cpos.
28 
+                                                ocfs2_dio_end_io
29 
+                                                 ocfs2_dio_end_io_write
30 
+                                                  down_write(&oi->ip_alloc_sem);
31 
+                                                  ocfs2_mark_extent_written
32 
+                                                   ocfs2_change_extent_flag
33 
+                                                    ocfs2_split_extent
34 
+                                                     ...
35 
+                                                 --> modify the rec[i]->e_cpos, resulting
36 
+                                                     in v_cluster < rec[i]->e_cpos.
37 
+             BUG_ON(v_cluster < le32_to_cpu(rec->e_cpos))
38 
+
39 
+[alex.chen@huawei.com: v3]
40 
+  Link: http://lkml.kernel.org/r/59EF3614.6050008@huawei.com
41 
+Link: http://lkml.kernel.org/r/59EF3614.6050008@huawei.com
42 
+Fixes: c15471f79506 ("ocfs2: fix sparse file & data ordering issue in direct io")
43 
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
44 
+Reviewed-by: Jun Piao <piaojun@huawei.com>
45 
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
46 
+Reviewed-by: Gang He <ghe@suse.com>
47 
+Acked-by: Changwei Ge <ge.changwei@h3c.com>
48 
+Cc: Mark Fasheh <mfasheh@versity.com>
49 
+Cc: Joel Becker <jlbec@evilplan.org>
50 
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
51 
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
52 
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
53 
+Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
54 
+---
55 
+ fs/ocfs2/aops.c | 26 ++++++++++++++++++--------
56 
+ 1 file changed, 18 insertions(+), 8 deletions(-)
57 
+
58 
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
59 
+index f2961b1..c26d046 100644
60 
+--- a/fs/ocfs2/aops.c
61 
+@@ -134,6 +134,19 @@ static int ocfs2_symlink_get_block(struct inode *inode, sector_t iblock,
62 
+ 	return err;
63 
+ }
64 
+
65 
++static int ocfs2_lock_get_block(struct inode *inode, sector_t iblock,
66 
++		    struct buffer_head *bh_result, int create)
67 
++{
68 
++	int ret = 0;
69 
++	struct ocfs2_inode_info *oi = OCFS2_I(inode);
70 
++
71 
++	down_read(&oi->ip_alloc_sem);
72 
++	ret = ocfs2_get_block(inode, iblock, bh_result, create);
73 
++	up_read(&oi->ip_alloc_sem);
74 
++
75 
++	return ret;
76 
++}
77 
++
78 
+ int ocfs2_get_block(struct inode *inode, sector_t iblock,
79 
+ 		    struct buffer_head *bh_result, int create)
80 
+ {
81 
+@@ -2120,7 +2133,7 @@ static void ocfs2_dio_free_write_ctx(struct inode *inode,
82 
+  * called like this: dio->get_blocks(dio->inode, fs_startblk,
83 
+  * 					fs_count, map_bh, dio->rw == WRITE);
84 
+  */
85 
+-static int ocfs2_dio_get_block(struct inode *inode, sector_t iblock,
86 
++static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock,
87 
+ 			       struct buffer_head *bh_result, int create)
88 
+ {
89 
+ 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
90 
+@@ -2146,12 +2159,9 @@ static int ocfs2_dio_get_block(struct inode *inode, sector_t iblock,
91 
+ 	 * while file size will be changed.
92 
+ 	 */
93 
+ 	if (pos + total_len <= i_size_read(inode)) {
94 
+-		down_read(&oi->ip_alloc_sem);
95 
+-		/* This is the fast path for re-write. */
96 
+-		ret = ocfs2_get_block(inode, iblock, bh_result, create);
97 
+-
98 
+-		up_read(&oi->ip_alloc_sem);
99 
+
100 
++		/* This is the fast path for re-write. */
101 
++		ret = ocfs2_lock_get_block(inode, iblock, bh_result, create);
102 
+ 		if (buffer_mapped(bh_result) &&
103 
+ 		    !buffer_new(bh_result) &&
104 
+ 		    ret == 0)
105 
+@@ -2416,9 +2426,9 @@ static ssize_t ocfs2_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
106 
+ 		return 0;
107 
+
108 
+ 	if (iov_iter_rw(iter) == READ)
109 
+-		get_block = ocfs2_get_block;
110 
++		get_block = ocfs2_lock_get_block;
111 
+ 	else
112 
+-		get_block = ocfs2_dio_get_block;
113 
++		get_block = ocfs2_dio_wr_get_block;
114 
+
115 
+ 	return __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev,
116 
+ 				    iter, get_block,
117 
+--
118 
+2.7.4
119 
+
SPECS/linux/0001-ocfs2-subsystem.su_mutex-is-required-while-accessing.patch
History View file @ 09062db
0 120 
new file mode 100644
... ... 
@@ -0,0 +1,208 @@
0 
+From 853bc26a7ea39e354b9f8889ae7ad1492ffa28d2 Mon Sep 17 00:00:00 2001
1 
+From: alex chen <alex.chen@huawei.com>
2 
+Date: Wed, 15 Nov 2017 17:31:48 -0800
3 
+Subject: [PATCH] ocfs2: subsystem.su_mutex is required while accessing the
4 
+ item->ci_parent
5 
+
6 
+The subsystem.su_mutex is required while accessing the item->ci_parent,
7 
+otherwise, NULL pointer dereference to the item->ci_parent will be
8 
+triggered in the following situation:
9 
+
10 
+add node                     delete node
11 
+sys_write
12 
+ vfs_write
13 
+  configfs_write_file
14 
+   o2nm_node_store
15 
+    o2nm_node_local_write
16 
+                             do_rmdir
17 
+                              vfs_rmdir
18 
+                               configfs_rmdir
19 
+                                mutex_lock(&subsys->su_mutex);
20 
+                                unlink_obj
21 
+                                 item->ci_group = NULL;
22 
+                                 item->ci_parent = NULL;
23 
+	 to_o2nm_cluster_from_node
24 
+	  node->nd_item.ci_parent->ci_parent
25 
+	  BUG since of NULL pointer dereference to nd_item.ci_parent
26 
+
27 
+Moreover, the o2nm_cluster also should be protected by the
28 
+subsystem.su_mutex.
29 
+
30 
+[alex.chen@huawei.com: v2]
31 
+  Link: http://lkml.kernel.org/r/59EEAA69.9080703@huawei.com
32 
+Link: http://lkml.kernel.org/r/59E9B36A.10700@huawei.com
33 
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
34 
+Reviewed-by: Jun Piao <piaojun@huawei.com>
35 
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
36 
+Cc: Mark Fasheh <mfasheh@versity.com>
37 
+Cc: Joel Becker <jlbec@evilplan.org>
38 
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
39 
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
40 
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
41 
+Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
42 
+---
43 
+ fs/ocfs2/cluster/nodemanager.c | 63 ++++++++++++++++++++++++++++++++++++------
44 
+ 1 file changed, 55 insertions(+), 8 deletions(-)
45 
+
46 
+diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
47 
+index a51200e..da64c3a2 100644
48 
+--- a/fs/ocfs2/cluster/nodemanager.c
49 
+@@ -40,6 +40,9 @@ char *o2nm_fence_method_desc[O2NM_FENCE_METHODS] = {
50 
+ 		"panic",	/* O2NM_FENCE_PANIC */
51 
+ };
52 
+
53 
++static inline void o2nm_lock_subsystem(void);
54 
++static inline void o2nm_unlock_subsystem(void);
55 
++
56 
+ struct o2nm_node *o2nm_get_node_by_num(u8 node_num)
57 
+ {
58 
+ 	struct o2nm_node *node = NULL;
59 
+@@ -181,7 +184,10 @@ static struct o2nm_cluster *to_o2nm_cluster_from_node(struct o2nm_node *node)
60 
+ {
61 
+ 	/* through the first node_set .parent
62 
+ 	 * mycluster/nodes/mynode == o2nm_cluster->o2nm_node_group->o2nm_node */
63 
+-	return to_o2nm_cluster(node->nd_item.ci_parent->ci_parent);
64 
++	if (node->nd_item.ci_parent)
65 
++		return to_o2nm_cluster(node->nd_item.ci_parent->ci_parent);
66 
++	else
67 
++		return NULL;
68 
+ }
69 
+
70 
+ enum {
71 
+@@ -194,7 +200,7 @@ static ssize_t o2nm_node_num_store(struct config_item *item, const char *page,
72 
+ 				   size_t count)
73 
+ {
74 
+ 	struct o2nm_node *node = to_o2nm_node(item);
75 
+-	struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node);
76 
++	struct o2nm_cluster *cluster;
77 
+ 	unsigned long tmp;
78 
+ 	char *p = (char *)page;
79 
+ 	int ret = 0;
80 
+@@ -214,6 +220,13 @@ static ssize_t o2nm_node_num_store(struct config_item *item, const char *page,
81 
+ 	    !test_bit(O2NM_NODE_ATTR_PORT, &node->nd_set_attributes))
82 
+ 		return -EINVAL; /* XXX */
83 
+
84 
++	o2nm_lock_subsystem();
85 
++	cluster = to_o2nm_cluster_from_node(node);
86 
++	if (!cluster) {
87 
++		o2nm_unlock_subsystem();
88 
++		return -EINVAL;
89 
++	}
90 
++
91 
+ 	write_lock(&cluster->cl_nodes_lock);
92 
+ 	if (cluster->cl_nodes[tmp])
93 
+ 		ret = -EEXIST;
94 
+@@ -226,6 +239,8 @@ static ssize_t o2nm_node_num_store(struct config_item *item, const char *page,
95 
+ 		set_bit(tmp, cluster->cl_nodes_bitmap);
96 
+ 	}
97 
+ 	write_unlock(&cluster->cl_nodes_lock);
98 
++	o2nm_unlock_subsystem();
99 
++
100 
+ 	if (ret)
101 
+ 		return ret;
102 
+
103 
+@@ -269,7 +284,7 @@ static ssize_t o2nm_node_ipv4_address_store(struct config_item *item,
104 
+ 					    size_t count)
105 
+ {
106 
+ 	struct o2nm_node *node = to_o2nm_node(item);
107 
+-	struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node);
108 
++	struct o2nm_cluster *cluster;
109 
+ 	int ret, i;
110 
+ 	struct rb_node **p, *parent;
111 
+ 	unsigned int octets[4];
112 
+@@ -286,6 +301,13 @@ static ssize_t o2nm_node_ipv4_address_store(struct config_item *item,
113 
+ 		be32_add_cpu(&ipv4_addr, octets[i] << (i * 8));
114 
+ 	}
115 
+
116 
++	o2nm_lock_subsystem();
117 
++	cluster = to_o2nm_cluster_from_node(node);
118 
++	if (!cluster) {
119 
++		o2nm_unlock_subsystem();
120 
++		return -EINVAL;
121 
++	}
122 
++
123 
+ 	ret = 0;
124 
+ 	write_lock(&cluster->cl_nodes_lock);
125 
+ 	if (o2nm_node_ip_tree_lookup(cluster, ipv4_addr, &p, &parent))
126 
+@@ -298,6 +320,8 @@ static ssize_t o2nm_node_ipv4_address_store(struct config_item *item,
127 
+ 		rb_insert_color(&node->nd_ip_node, &cluster->cl_node_ip_tree);
128 
+ 	}
129 
+ 	write_unlock(&cluster->cl_nodes_lock);
130 
++	o2nm_unlock_subsystem();
131 
++
132 
+ 	if (ret)
133 
+ 		return ret;
134 
+
135 
+@@ -315,7 +339,7 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page,
136 
+ 				     size_t count)
137 
+ {
138 
+ 	struct o2nm_node *node = to_o2nm_node(item);
139 
+-	struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node);
140 
++	struct o2nm_cluster *cluster;
141 
+ 	unsigned long tmp;
142 
+ 	char *p = (char *)page;
143 
+ 	ssize_t ret;
144 
+@@ -333,17 +357,26 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page,
145 
+ 	    !test_bit(O2NM_NODE_ATTR_PORT, &node->nd_set_attributes))
146 
+ 		return -EINVAL; /* XXX */
147 
+
148 
++	o2nm_lock_subsystem();
149 
++	cluster = to_o2nm_cluster_from_node(node);
150 
++	if (!cluster) {
151 
++		ret = -EINVAL;
152 
++		goto out;
153 
++	}
154 
++
155 
+ 	/* the only failure case is trying to set a new local node
156 
+ 	 * when a different one is already set */
157 
+ 	if (tmp && tmp == cluster->cl_has_local &&
158 
+-	    cluster->cl_local_node != node->nd_num)
159 
+-		return -EBUSY;
160 
++	    cluster->cl_local_node != node->nd_num) {
161 
++		ret = -EBUSY;
162 
++		goto out;
163 
++	}
164 
+
165 
+ 	/* bring up the rx thread if we're setting the new local node. */
166 
+ 	if (tmp && !cluster->cl_has_local) {
167 
+ 		ret = o2net_start_listening(node);
168 
+ 		if (ret)
169 
+-			return ret;
170 
++			goto out;
171 
+ 	}
172 
+
173 
+ 	if (!tmp && cluster->cl_has_local &&
174 
+@@ -358,7 +391,11 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page,
175 
+ 		cluster->cl_local_node = node->nd_num;
176 
+ 	}
177 
+
178 
+-	return count;
179 
++	ret = count;
180 
++
181 
++out:
182 
++	o2nm_unlock_subsystem();
183 
++	return ret;
184 
+ }
185 
+
186 
+ CONFIGFS_ATTR(o2nm_node_, num);
187 
+@@ -738,6 +775,16 @@ static struct o2nm_cluster_group o2nm_cluster_group = {
188 
+ 	},
189 
+ };
190 
+
191 
++static inline void o2nm_lock_subsystem(void)
192 
++{
193 
++	mutex_lock(&o2nm_cluster_group.cs_subsys.su_mutex);
194 
++}
195 
++
196 
++static inline void o2nm_unlock_subsystem(void)
197 
++{
198 
++	mutex_unlock(&o2nm_cluster_group.cs_subsys.su_mutex);
199 
++}
200 
++
201 
+ int o2nm_depend_item(struct config_item *item)
202 
+ {
203 
+ 	return configfs_depend_item(&o2nm_cluster_group.cs_subsys, item);
204 
+--
205 
+2.7.4
206 
+
SPECS/linux/config-aws
History View file @ 09062db
... ... 
@@ -1481,7 +1481,7 @@ CONFIG_PNP_DEBUG_MESSAGES=y
1481 1481 
 CONFIG_PNPACPI=y
1482 1482 
 CONFIG_BLK_DEV=y
1483 1483 
 CONFIG_BLK_DEV_NULL_BLK=m
1484 
-CONFIG_BLK_DEV_FD=m
1484 
+# CONFIG_BLK_DEV_FD is not set
1485 1485 
 # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
1486 1486 
 CONFIG_ZRAM=m
1487 1487 
 # CONFIG_BLK_CPQ_CISS_DA is not set
SPECS/linux/linux-aws.spec
History View file @ 09062db
... ... 
@@ -2,7 +2,7 @@
2 2 
 Summary:        Kernel
3 3 
 Name:           linux-aws
4 4 
 Version:        4.9.98
5 
-Release:        1%{?kat_build:.%kat_build}%{?dist}
5 
+Release:        2%{?kat_build:.%kat_build}%{?dist}
6 6 
 License:    	GPLv2
7 7 
 URL:        	http://www.kernel.org/
8 8 
 Group:        	System Environment/Kernel
... ... 
@@ -51,6 +51,16 @@ Patch34:        0001-net-create-skb_gso_validate_mac_len.patch
51 51 
 Patch35:        0002-bnx2x-disable-GSO-where-gso_size-is-too-big-for-hard.patch
52 52 
 # Fix for CVE-2017-18255
53 53 
 Patch36:        0001-perf-core-Fix-the-perf_cpu_time_max_percent-check.patch
54 
+# Fix for CVE-2017-18216
55 
+Patch37:        0001-ocfs2-subsystem.su_mutex-is-required-while-accessing.patch
56 
+# Fix for CVE-2018-8043
57 
+Patch38:        0001-net-phy-mdio-bcm-unimac-fix-potential-NULL-dereferen.patch
58 
+# Fix for CVE-2018-8087
59 
+Patch39:        0001-mac80211_hwsim-fix-possible-memory-leak-in-hwsim_new.patch
60 
+# Fix for CVE-2017-18241
61 
+Patch40:        0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
62 
+# Fix for CVE-2017-18224
63 
+Patch41:        0001-ocfs2-ip_alloc_sem-should-be-taken-in-ocfs2_get_bloc.patch
54 64
55 65 
 # For Spectre
56 66 
 Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
... ... 
@@ -217,6 +227,11 @@ This package contains the 'perf' performance analysis tools for Linux kernel.
217 217 
 %patch34 -p1
218 218 
 %patch35 -p1
219 219 
 %patch36 -p1
220 
+%patch37 -p1
221 
+%patch38 -p1
222 
+%patch39 -p1
223 
+%patch40 -p1
224 
+%patch41 -p1
220 225
221 226 
 %patch52 -p1
222 227 
 %patch53 -p1
... ... 
@@ -436,6 +451,10 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
436 436 
 /usr/share/doc/*
437 437
438 438 
 %changelog
439 
+*   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-2
440 
+-   Fix CVE-2017-18216, CVE-2018-8043, CVE-2018-8087, CVE-2017-18241,
441 
+-   CVE-2017-18224.
442 
+-   Disable floppy driver support (CONFIG_BLK_DEV_FD) in config-aws.
439 443 
 *   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-1
440 444 
 -   Update to version 4.9.98
441 445 
 *   Wed May 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.97-3
SPECS/linux/linux-esx.spec
History View file @ 09062db
... ... 
@@ -2,7 +2,7 @@
2 2 
 Summary:        Kernel
3 3 
 Name:           linux-esx
4 4 
 Version:        4.9.98
5 
-Release:        1%{?dist}
5 
+Release:        2%{?dist}
6 6 
 License:        GPLv2
7 7 
 URL:            http://www.kernel.org/
8 8 
 Group:          System Environment/Kernel
... ... 
@@ -48,6 +48,16 @@ Patch34:        0001-net-create-skb_gso_validate_mac_len.patch
48 48 
 Patch35:        0002-bnx2x-disable-GSO-where-gso_size-is-too-big-for-hard.patch
49 49 
 # Fix for CVE-2017-18255
50 50 
 Patch36:        0001-perf-core-Fix-the-perf_cpu_time_max_percent-check.patch
51 
+# Fix for CVE-2017-18216
52 
+Patch37:        0001-ocfs2-subsystem.su_mutex-is-required-while-accessing.patch
53 
+# Fix for CVE-2018-8043
54 
+Patch38:        0001-net-phy-mdio-bcm-unimac-fix-potential-NULL-dereferen.patch
55 
+# Fix for CVE-2018-8087
56 
+Patch39:        0001-mac80211_hwsim-fix-possible-memory-leak-in-hwsim_new.patch
57 
+# Fix for CVE-2017-18241
58 
+Patch40:        0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
59 
+# Fix for CVE-2017-18224
60 
+Patch41:        0001-ocfs2-ip_alloc_sem-should-be-taken-in-ocfs2_get_bloc.patch
51 61
52 62 
 # For Spectre
53 63 
 Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
... ... 
@@ -132,6 +142,11 @@ The Linux package contains the Linux kernel doc files
132 132 
 %patch34 -p1
133 133 
 %patch35 -p1
134 134 
 %patch36 -p1
135 
+%patch37 -p1
136 
+%patch38 -p1
137 
+%patch39 -p1
138 
+%patch40 -p1
139 
+%patch41 -p1
135 140
136 141 
 %patch52 -p1
137 142 
 %patch53 -p1
... ... 
@@ -243,6 +258,9 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
243 243 
 /usr/src/linux-headers-%{uname_r}
244 244
245 245 
 %changelog
246 
+*   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-2
247 
+-   Fix CVE-2017-18216, CVE-2018-8043, CVE-2018-8087, CVE-2017-18241,
248 
+-   CVE-2017-18224.
246 249 
 *   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-1
247 250 
 -   Update to version 4.9.98
248 251 
 *   Wed May 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.97-3
SPECS/linux/linux-secure.spec
History View file @ 09062db
... ... 
@@ -2,7 +2,7 @@
2 2 
 Summary:        Kernel
3 3 
 Name:           linux-secure
4 4 
 Version:        4.9.98
5 
-Release:        1%{?kat_build:.%kat_build}%{?dist}
5 
+Release:        2%{?kat_build:.%kat_build}%{?dist}
6 6 
 License:        GPLv2
7 7 
 URL:            http://www.kernel.org/
8 8 
 Group:          System Environment/Kernel
... ... 
@@ -57,6 +57,16 @@ Patch36:        0001-net-create-skb_gso_validate_mac_len.patch
57 57 
 Patch37:        0002-bnx2x-disable-GSO-where-gso_size-is-too-big-for-hard.patch
58 58 
 # Fix for CVE-2017-18255
59 59 
 Patch38:        0001-perf-core-Fix-the-perf_cpu_time_max_percent-check.patch
60 
+# Fix for CVE-2017-18216
61 
+Patch39:        0001-ocfs2-subsystem.su_mutex-is-required-while-accessing.patch
62 
+# Fix for CVE-2018-8043
63 
+Patch40:        0001-net-phy-mdio-bcm-unimac-fix-potential-NULL-dereferen.patch
64 
+# Fix for CVE-2018-8087
65 
+Patch41:        0001-mac80211_hwsim-fix-possible-memory-leak-in-hwsim_new.patch
66 
+# Fix for CVE-2017-18241
67 
+Patch42:        0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
68 
+# Fix for CVE-2017-18224
69 
+Patch43:        0001-ocfs2-ip_alloc_sem-should-be-taken-in-ocfs2_get_bloc.patch
60 70
61 71 
 # For Spectre
62 72 
 Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
... ... 
@@ -185,6 +195,11 @@ EOF
185 185 
 %patch36 -p1
186 186 
 %patch37 -p1
187 187 
 %patch38 -p1
188 
+%patch39 -p1
189 
+%patch40 -p1
190 
+%patch41 -p1
191 
+%patch42 -p1
192 
+%patch43 -p1
188 193
189 194 
 # spectre
190 195 
 %patch52 -p1
... ... 
@@ -332,6 +347,9 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
332 332 
 /usr/src/linux-headers-%{uname_r}
333 333
334 334 
 %changelog
335 
+*   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-2
336 
+-   Fix CVE-2017-18216, CVE-2018-8043, CVE-2018-8087, CVE-2017-18241,
337 
+-   CVE-2017-18224.
335 338 
 *   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-1
336 339 
 -   Update to version 4.9.98
337 340 
 *   Wed May 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.97-3
SPECS/linux/linux.spec
History View file @ 09062db
... ... 
@@ -2,7 +2,7 @@
2 2 
 Summary:        Kernel
3 3 
 Name:           linux
4 4 
 Version:        4.9.98
5 
-Release:        1%{?kat_build:.%kat_build}%{?dist}
5 
+Release:        2%{?kat_build:.%kat_build}%{?dist}
6 6 
 License:    	GPLv2
7 7 
 URL:        	http://www.kernel.org/
8 8 
 Group:        	System Environment/Kernel
... ... 
@@ -55,6 +55,16 @@ Patch34:        0001-net-create-skb_gso_validate_mac_len.patch
55 55 
 Patch35:        0002-bnx2x-disable-GSO-where-gso_size-is-too-big-for-hard.patch
56 56 
 # Fix for CVE-2017-18255
57 57 
 Patch36:        0001-perf-core-Fix-the-perf_cpu_time_max_percent-check.patch
58 
+# Fix for CVE-2017-18216
59 
+Patch37:        0001-ocfs2-subsystem.su_mutex-is-required-while-accessing.patch
60 
+# Fix for CVE-2018-8043
61 
+Patch38:        0001-net-phy-mdio-bcm-unimac-fix-potential-NULL-dereferen.patch
62 
+# Fix for CVE-2018-8087
63 
+Patch39:        0001-mac80211_hwsim-fix-possible-memory-leak-in-hwsim_new.patch
64 
+# Fix for CVE-2017-18241
65 
+Patch40:        0001-f2fs-fix-a-panic-caused-by-NULL-flush_cmd_control.patch
66 
+# Fix for CVE-2017-18224
67 
+Patch41:        0001-ocfs2-ip_alloc_sem-should-be-taken-in-ocfs2_get_bloc.patch
58 68
59 69 
 # For Spectre
60 70 
 Patch52: 0141-locking-barriers-introduce-new-observable-speculatio.patch
... ... 
@@ -176,6 +186,11 @@ This package contains the 'perf' performance analysis tools for Linux kernel.
176 176 
 %patch34 -p1
177 177 
 %patch35 -p1
178 178 
 %patch36 -p1
179 
+%patch37 -p1
180 
+%patch38 -p1
181 
+%patch39 -p1
182 
+%patch40 -p1
183 
+%patch41 -p1
179 184
180 185 
 %patch52 -p1
181 186 
 %patch53 -p1
... ... 
@@ -358,6 +373,9 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
358 358 
 /usr/share/doc/*
359 359
360 360 
 %changelog
361 
+*   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-2
362 
+-   Fix CVE-2017-18216, CVE-2018-8043, CVE-2018-8087, CVE-2017-18241,
363 
+-   CVE-2017-18224.
361 364 
 *   Fri May 04 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.98-1
362 365 
 -   Update to version 4.9.98
363 366 
 *   Wed May 02 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.97-3