GitHub PushEvent at 2014-12-22 00:24:01
Repository: linux-grsecurity
Actor: scrapenbump
Payload: {"shas":[["b1a390b6fe71d50ed440ac5522b4a26799aeeccb","be467f0e1be1cd5d65704bcad86a587c7f8efd36@grsecurity.net","grsec: Apply grsecurity-3.0-3.17.7-201412211910.patch\n\ncommit 4435991915e5b4ab6ed45d79d645d908e151ac55\nAuthor: Brad Spengler <spender@grsecurity.net>\nDate:   Sun Dec 21 17:28:43 2014 -0500\n\n    compile fix\n\n arch/x86/kernel/espfix_64.c |    3 +--\n 1 files changed, 1 insertions(+), 2 deletions(-)\n\ncommit 3ddee99dda3c76e47ae4719ea8cb432020eca31a\nAuthor: Andy Lutomirski <luto@amacapital.net>\nDate:   Fri Dec 5 19:03:28 2014 -0800\n\n    x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit\n\n    paravirt_enabled has the following effects:\n\n     - Disables the F00F bug workaround warning.  There is no F00F bug\n       workaround any more because Linux's standard IDT handling already\n       works around the F00F bug, but the warning still exists.  This\n       is only cosmetic, and, in any event, there is no such thing as\n       KVM on a CPU with the F00F bug.\n\n     - Disables 32-bit APM BIOS detection.  On a KVM paravirt system,\n       there should be no APM BIOS anyway.\n\n     - Disables tboot.  I think that the tboot code should check the\n       CPUID hypervisor bit directly if it matters.\n\n     - paravirt_enabled disables espfix32.  espfix32 should *not* be\n       disabled under KVM paravirt.\n\n    The last point is the purpose of this patch.  It fixes a leak of the\n    high 16 bits of the kernel stack address on 32-bit KVM paravirt\n    guests.  Fixes CVE-2014-8134.\n\n    Cc: stable@vger.kernel.org\n    Suggested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Andy Lutomirski <luto@amacapital.net>\n    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>\n\n arch/x86/kernel/kvm.c      |    9 ++++++++-\n arch/x86/kernel/kvmclock.c |    1 -\n 2 files changed, 8 insertions(+), 2 deletions(-)\n\ncommit 50ebd6166caa35db5b36989aa0bb7e8cd46bc12c\nAuthor: Andy Lutomirski <luto@amacapital.net>\nDate:   Wed Dec 17 14:48:30 2014 -0800\n\n    x86/tls: Don't validate lm in set_thread_area() after all\n\n    It turns out that there's a lurking ABI issue.  GCC, when\n    compiling this in a 32-bit program:\n\n    struct user_desc desc = {\n    \t.entry_number    = idx,\n    \t.base_addr       = base,\n    \t.limit           = 0xfffff,\n    \t.seg_32bit       = 1,\n    \t.contents        = 0, /* Data, grow-up */\n    \t.read_exec_only  = 0,\n    \t.limit_in_pages  = 1,\n    \t.seg_not_present = 0,\n    \t.useable         = 0,\n    };\n\n    will leave .lm uninitialized.  This means that anything in the\n    kernel that reads user_desc.lm for 32-bit tasks is unreliable.\n\n    Revert the .lm check in set_thread_area().  The value never did\n    anything in the first place.\n\n    Fixes: 0e58af4e1d21 (\"x86/tls: Disallow unusual TLS segments\")\n    Signed-off-by: Andy Lutomirski <luto@amacapital.net>\n    Acked-by: Thomas Gleixner <tglx@linutronix.de>\n    Cc: stable@vger.kernel.org # Only if 0e58af4e1d21 is backported\n    Cc: Linus Torvalds <torvalds@linux-foundation.org>\n    Link: http://lkml.kernel.org/r/d7875b60e28c512f6a6fc0baf5714d58e7eaadbb.1418856405.git.luto@amacapital.net\n    Signed-off-by: Ingo Molnar <mingo@kernel.org>\n\n arch/x86/include/uapi/asm/ldt.h |    7 +++++++\n arch/x86/kernel/tls.c           |    6 ------\n 2 files changed, 7 insertions(+), 6 deletions(-)\n\ncommit 0021bd1dc91c9230cabd959c040a516da99b6a70\nAuthor: Andy Lutomirski <luto@amacapital.net>\nDate:   Thu Dec 4 16:48:17 2014 -0800\n\n    x86/tls: Disallow unusual TLS segments\n\n    Users have no business installing custom code segments into the\n    GDT, and segments that are not present but are otherwise valid\n    are a historical source of interesting attacks.\n\n    For completeness, block attempts to set the L bit.  (Prior to\n    this patch, the L bit would have been silently dropped.)\n\n    This is an ABI break.  I've checked glibc, musl, and Wine, and\n    none of them look like they'll have any trouble.\n\n    Note to stable maintainers: this is a hardening patch that fixes\n    no known bugs.  Given the possibility of ABI issues, this\n    probably shouldn't be backported quickly.\n\n    Signed-off-by: Andy Lutomirski <luto@amacapital.net>\n    Acked-by: H. Peter Anvin <hpa@zytor.com>\n    Cc: stable@vger.kernel.org # optional\n    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Cc: Linus Torvalds <torvalds@linux-foundation.org>\n    Cc: security@kernel.org <security@kernel.org>\n    Cc: Willy Tarreau <w@1wt.eu>\n    Signed-off-by: Ingo Molnar <mingo@kernel.org>\n\n arch/x86/kernel/tls.c |   22 ++++++++++++++++++++++\n 1 files changed, 22 insertions(+), 0 deletions(-)\n\ncommit 080d7d65711e4c96d6393fff9223ace6a0162b8b\nAuthor: Andy Lutomirski <luto@amacapital.net>\nDate:   Thu Dec 4 16:48:16 2014 -0800\n\n    x86/tls: Validate TLS entries to protect espfix\n\n    Installing a 16-bit RW data segment into the GDT defeats espfix.\n    AFAICT this will not affect glibc, Wine, or dosemu at all.\n\n    Signed-off-by: Andy Lutomirski <luto@amacapital.net>\n    Acked-by: H. Peter Anvin <hpa@zytor.com>\n    Cc: stable@vger.kernel.org\n    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Cc: Linus Torvalds <torvalds@linux-foundation.org>\n    Cc: security@kernel.org <security@kernel.org>\n    Cc: Willy Tarreau <w@1wt.eu>\n    Signed-off-by: Ingo Molnar <mingo@kernel.org>\n\n arch/x86/kernel/tls.c |   23 +++++++++++++++++++++++\n 1 files changed, 23 insertions(+), 0 deletions(-)\n\ncommit 60ef5002e1dc5cf436df8d9f6b5882354308a7e0\nAuthor: Brad Spengler <spender@grsecurity.net>\nDate:   Sun Dec 21 16:32:08 2014 -0500\n\n    Fix a long-standing incompatibility between x64 UDEREF and CONFIG_PARAVIRT\n    on PCID-capable systems.  Generally it resulted in userland crashes preventing\n    boot of the system which were able to be worked around by booting with nopcid\n    and receiving a weaker UDEREF implementation.  The source of the problem\n    was paravirt-specific asm alternatives for flush_tlb_single rewriting the\n    pv_mm_ops's native code with a single invlpg.\n\n    As of this patch, no recommendations should be made to boot with nopcid, as\n    it results in a weaker UDEREF implementation.\n\n arch/x86/kernel/paravirt_patch_64.c |    4 ++++\n 1 files changed, 4 insertions(+), 0 deletions(-)\n\ncommit ff46fb93ffba1506ff56637e28d75b0cfa8b4901\nAuthor: Nadav Amit <namit@cs.technion.ac.il>\nDate:   Sun Nov 2 11:54:52 2014 +0200\n\n    KVM: x86: MOV to CR3 can set bit 63\n\n    Although Intel SDM mentions bit 63 is reserved, MOV to CR3 can have bit 63 set.\n    As Intel SDM states in section 4.10.4 \"Invalidation of TLBs and\n    Paging-Structure Caches\": \" MOV to CR3. ... If CR4.PCIDE = 1 and bit 63 of the\n    instructionâ€™s source operand is 0 ...\"\n\n    In other words, bit 63 is not reserved. KVM emulator currently consider bit 63\n    as reserved. Fix it.\n\n    Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>\n    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>\n\n arch/x86/include/asm/kvm_host.h |    1 +\n arch/x86/kvm/emulate.c          |    2 +-\n arch/x86/kvm/x86.c              |    2 ++\n 3 files changed, 4 insertions(+), 1 deletions(-)\n\ncommit 9e8d317bf5702db18f35451dd986f8d1b6f22766\nAuthor: Brad Spengler <spender@grsecurity.net>\nDate:   Sat Dec 20 11:50:30 2014 -0500\n\n    force off X86_16BIT if grsecurity is enabled -- nobody cares about\n    running Windows 3.1 apps under wine, it's not worth the risk\n\n arch/x86/Kconfig |    1 +\n 1 files changed, 1 insertions(+), 0 deletions(-)\n\ncommit e5d12973adec885b3bb3938387d0fa46f4a1de8b\nAuthor: Al Viro <viro@zeniv.linux.org.uk>\nDate:   Fri Dec 19 06:20:59 2014 +0000\n\n    Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket\n\n    same story as cmtp\n\n    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>\n    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>\n\n net/bluetooth/bnep/core.c |    3 +++\n 1 files changed, 3 insertions(+), 0 deletions(-)\n\ncommit 2144f9994a7028d81122a306272a9891ee254474\nAuthor: Al Viro <viro@zeniv.linux.org.uk>\nDate:   Fri Dec 19 06:20:58 2014 +0000\n\n    Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket\n\n    ... rather than relying on ciptool(8) never passing it anything else.  Give\n    it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops,\n    trying to evaluate &l2cap_pi(sock->sk)->chan->dst...\n\n    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>\n    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>\n\n net/bluetooth/cmtp/core.c |    3 +++\n 1 files changed, 3 insertions(+), 0 deletions(-)\n\ncommit eb77df555c6114324af1204e0882da0be274cd92\nAuthor: Al Viro <viro@zeniv.linux.org.uk>\nDate:   Fri Dec 19 06:20:57 2014 +0000\n\n    Bluetooth: hidp_connection_add() unsafe use of l2cap_pi()\n\n    it's OK after we'd verified the sockets, but not before that.\n\n    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>\n    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>\n\n net/bluetooth/hidp/core.c |    3 ++-\n 1 files changed, 2 insertions(+), 1 deletions(-)\n\ncommit df54837b6210c2ebc404618b052052aa6b186214\nAuthor: Jukka Rissanen <jukka.rissanen@linux.intel.com>\nDate:   Wed Dec 10 14:19:53 2014 +0200\n\n    Bluetooth: 6lowpan: Do not free skb when packet is dropped\n\n    If we need to drop the message because of some error in the\n    compression etc, then do not free the skb as that is done\n    automatically in other part of networking stack.\n\n    Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>\n    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>\n\n net/bluetooth/6lowpan.c |    1 -\n 1 files changed, 0 insertions(+), 1 deletions(-)\n\ncommit 5948f7c10baa9d96f95b14b504a87cb763fbcd3b\nAuthor: Eric W. Biederman <ebiederm@xmission.com>\nDate:   Thu Dec 18 10:57:19 2014 -0600\n\n    mnt: Fix a memory stomp in umount\n\n    While reviewing the code of umount_tree I realized that when we append\n    to a preexisting unmounted list we do not change pprev of the former\n    first item in the list.\n\n    Which means later in namespace_unlock hlist_del_init(&mnt->mnt_hash) on\n    the former first item of the list will stomp unmounted.first leaving\n    it set to some random mount point which we are likely to free soon.\n\n    This isn't likely to hit, but if it does I don't know how anyone could\n    track it down.\n\n    [ This happened because we don't have all the same operations for\n      hlist's as we do for normal doubly-linked lists. In particular,\n      list_splice() is easy on our standard doubly-linked lists, while\n      hlist_splice() doesn't exist and needs both start/end entries of the\n      hlist.  And commit 38129a13e6e7 incorrectly open-coded that missing\n      hlist_splice().\n\n      We should think about making these kinds of \"mindless\" conversions\n      easier to get right by adding the missing hlist helpers   - Linus ]\n\n    Fixes: 38129a13e6e71f666e0468e99fdd932a687b4d7e switch mnt_hash to hlist\n    Cc: stable@vger.kernel.org\n    Signed-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\n fs/namespace.c |    2 ++\n 1 files changed, 2 insertions(+), 0 deletions(-)\n\ncommit 0316f1732b50dd3abd23be4d25147eded9c293e3\nAuthor: Frank Praznik <frank.praznik@oh.rr.com>\nDate:   Wed Nov 12 14:10:09 2014 -0500\n\n    HID: sony: Use kernel allocated buffers for HID reports\n\n    Replace stack buffers with kernel allocated buffers for sending\n    and receiving HID reports to prevent issues with DMA transfers\n    on certain hardware.\n\n    Output report buffers are allocated at initialization time to avoid\n    excessive calls to kmalloc and kfree.\n\n    Link: https://bugzilla.kernel.org/show_bug.cgi?id=87991\n    Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>\n    Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\n    Signed-off-by: Jiri Kosina <jkosina@suse.cz>\n\n drivers/hid/hid-sony.c |  147 +++++++++++++++++++++++++++++++++++++-----------\n 1 files changed, 113 insertions(+), 34 deletions(-)\n\ncommit 182dd5b3de81d40f738573bb8c65e5ff946a1040\nAuthor: Brad Spengler <spender@grsecurity.net>\nDate:   Wed Dec 17 18:30:48 2014 -0500\n\n    make the statically allocated pud page read-only while we're at it\n\n arch/x86/kernel/espfix_64.c |    2 +-\n 1 files changed, 1 insertions(+), 1 deletions(-)\n\ncommit 5cdec75a0eabd70dd3e9a046b561d205ef4ea492\nAuthor: Brad Spengler <spender@grsecurity.net>\nDate:   Wed Dec 17 18:28:16 2014 -0500\n\n    Fix doublefault in espfix code when PAX_PER_CPU_PGD is enabled,\n    reported by Andy Lutomirski\n\n arch/x86/kernel/espfix_64.c |   11 +++++++----\n 1 files changed, 7 insertions(+), 4 deletions(-)\n\ncommit 2f69df693a08003037f418a68d01b600633f51df\nAuthor: Jan Kara <jack@suse.cz>\nDate:   Mon Dec 15 14:22:46 2014 +0100\n\n    isofs: Fix infinite looping over CE entries\n\n    Rock Ridge extensions define so called Continuation Entries (CE) which\n    define where is further space with Rock Ridge data. Corrupted isofs\n    image can contain arbitrarily long chain of these, including a one\n    containing loop and thus causing kernel to end in an infinite loop when\n    traversing these entries.\n\n    Limit the traversal to 32 entries which should be more than enough space\n    to store all the Rock Ridge data.\n\n    Reported-by: P J P <ppandit@redhat.com>\n    CC: stable@vger.kernel.org\n    Signed-off-by: Jan Kara <jack@suse.cz>\n\n fs/isofs/rock.c |    6 ++++++\n 1 files changed, 6 insertions(+), 0 deletions(-)\n\nSignature-tree: b0521b281b986b613fed5f4b758ba58fdc116ea3","Brad Spengler",false]],"size":1,"ref":"refs/heads/grsec-test","head":"b1a390b6fe71d50ed440ac5522b4a26799aeeccb"}