UBUNTU: Start new release

Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: SAUCE: Fix compat_sys_recvmsg on x32 archs

BugLink: http://bugs.launchpad.net/bugs/1274349

Reported by pageexec

asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
                                    unsigned int vlen, unsigned int flags,
                                    struct compat_timespec __user *timeout)
{
        int datagrams;
        struct timespec ktspec;

        if (flags & MSG_CMSG_COMPAT)
                return -EINVAL;

        if (COMPAT_USE_64BIT_TIME)
                return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                      flags | MSG_CMSG_COMPAT,
                                      (struct timespec *) timeout);
/*...*/

The timeout pointer parameter is provided by userland (hence the
__user annotation) but for x32 syscalls it's simply cast to a kernel
pointer and is passed to __sys_recvmmsg which will eventually directly
dereference it for both reading and writing. Other callers to
__sys_recvmmsg properly copy from userland to the kernel first.

The impact is a sort of arbitrary kernel write-where-what primitive by
unprivileged users where the to-be-written area must contain valid
timespec data initially (the first 64 bit long field must be positive
and the second one must be < 1G).

The bug was introduced by commit
http://git.kernel.org/linus/ee4fa23c4b (other uses of
COMPAT_USE_64BIT_TIME seem fine) and should affect all kernels since
3.4 (and perhaps vendor kernels if they backported x32 support along
with this code). Note that CONFIG_X86_X32_ABI gets enabled at build
time and only if CONFIG_X86_X32 is enabled and ld can build x32
executables.

Signed-off-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: John Johansen <john.johansen@canonical.com>
UBUNTU: Ubuntu-3.11.0-15.25

Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: Merge of security fix for CVE-2013-0038

Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: Start new release

Ignore: yes

Signed-off-by: Brad Figg <brad.figg@canonical.com>
Revert "UBUNTU: SAUCE: Fix compat_sys_recvmsg on x32 archs"

This reverts commit 8c57646584aab87099d0dc69785ce3e2b2b3b626. There is a
different commit applied to upstream to address this same issue.
UBUNTU: [Upstream] x86, x32: Correct invalid use of user timespec in the kernel

This patch is the upstream revision of the patch pushed out for
CVE-2013-0038. It needs to be applied to

    saucy: linux
  precise: linux-lts-raring linux-lts-saucy

The x32 case for the recvmsg() timout handling is broken:

http://bugs.launchpad.net/bugs/1274754

  asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
                                      unsigned int vlen, unsigned int flags,
                                      struct compat_timespec __user *timeout)
  {
          int datagrams;
          struct timespec ktspec;

          if (flags & MSG_CMSG_COMPAT)
                  return -EINVAL;

          if (COMPAT_USE_64BIT_TIME)
                  return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                        flags | MSG_CMSG_COMPAT,
                                        (struct timespec *) timeout);
          ...

The timeout pointer parameter is provided by userland (hence the __user
annotation) but for x32 syscalls it's simply cast to a kernel pointer
and is passed to __sys_recvmmsg which will eventually directly
dereference it for both reading and writing.  Other callers to
__sys_recvmmsg properly copy from userland to the kernel first.

The bug was introduced by commit ee4fa23c4bfc ("compat: Use
COMPAT_USE_64BIT_TIME in net/compat.c") and should affect all kernels
since 3.4 (and perhaps vendor kernels if they backported x32 support
along with this code).

Note that CONFIG_X86_X32_ABI gets enabled at build time and only if
CONFIG_X86_X32 is enabled and ld can build x32 executables.

Other uses of COMPAT_USE_64BIT_TIME seem fine.

This addresses CVE-2014-0038.

Signed-off-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry-picked from commit 2def2ef2ae5f3990aabdbe8a755911902707d268)
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: Ubuntu-3.11.0-17.31

Signed-off-by: Brad Figg <brad.figg@canonical.com>
UBUNTU: [Config] add the lowlatency flavours

Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: update-from-master -- copy over Build-Depends: if they change

Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: Start new release

Ignore: yes
Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: rebase to Ubuntu-3.10.0-5.14

Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: Bump ABI

Ignore: yes
Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: [Config] update Build-Depends: from master

Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: Lowlatency-3.10.0-5.17

Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: Start new release

Ignore: yes
Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: Bump ABI

Ignore: yes
Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: [Config] update Build-Depends: from master

Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: Lowlatency-3.11.0-2.1

Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: switch Vcs-git: to official repo

Signed-off-by: Andy Whitcroft <apw@canonical.com>