]> git.pld-linux.org Git - packages/kernel.git/blobdiff - kernel-small_fixes.patch
- rel 2; fixes CVE-2017-6074 (local root)
[packages/kernel.git] / kernel-small_fixes.patch
index 01e03aa64da497ac17ba88984c47f9e05ec251da..3ac8a0bb6f5863a1b0df259a7772e02a99fae9d7 100644 (file)
                                exit
                        fi
                done
+--- a/Makefile 2016-11-10 20:41:43.646224629 +0100
++++ b/Makefile 2016-11-10 20:40:35.640323501 +0100
+@@ -784,6 +774,9 @@
+ # Prohibit date/time macros, which would make the build non-deterministic
+ KBUILD_CFLAGS   += $(call cc-option,-Werror=date-time)
++# enforce correct pointer usage
++KBUILD_CFLAGS   += $(call cc-option,-Werror=incompatible-pointer-types)
++
+ # use the deterministic mode of AR if available
+ KBUILD_ARFLAGS := $(call ar-option,D)
+From 5d12f71723762a39435d054d02bbf5fb87c5cd14 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Arkadiusz=20Mi=C5=9Bkiewicz?= <arekm@maven.pl>
+Date: Mon, 6 Feb 2017 14:45:15 +0100
+Subject: [PATCH] mac80211: Print text for disassociation reason
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When disassociation happens only numeric reason is printed
+in ieee80211_rx_mgmt_disassoc(). Add text variant, too.
+
+Signed-off-by: Arkadiusz Miƛkiewicz <arekm@maven.pl>
+---
+ net/mac80211/mlme.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 098ce9b179ee..fcf8d0aa66ec 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2801,8 +2801,9 @@ static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
+       reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
+-      sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
+-                 mgmt->sa, reason_code);
++      sdata_info(sdata, "disassociated from %pM (Reason: %u=%s)\n",
++                 mgmt->sa, reason_code,
++                 ieee80211_get_reason_code_string(reason_code));
+       ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
+-- 
+2.11.0
+
+From 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Thu, 16 Feb 2017 17:22:46 +0100
+Subject: dccp: fix freeing skb too early for IPV6_RECVPKTINFO
 
-From 30927520dbae297182990bb21d08762bcc35ce1d Mon Sep 17 00:00:00 2001
-From: Eric Dumazet <edumazet@google.com>
-Date: Wed, 9 Sep 2015 21:55:07 -0700
-Subject: [PATCH] tcp_cubic: better follow cubic curve after idle period
+In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet
+is forcibly freed via __kfree_skb in dccp_rcv_state_process if
+dccp_v6_conn_request successfully returns.
 
-Jana Iyengar found an interesting issue on CUBIC :
+However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb
+is saved to ireq->pktopts and the ref count for skb is incremented in
+dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed
+in dccp_rcv_state_process.
 
-The epoch is only updated/reset initially and when experiencing losses.
-The delta "t" of now - epoch_start can be arbitrary large after app idle
-as well as the bic_target. Consequentially the slope (inverse of
-ca->cnt) would be really large, and eventually ca->cnt would be
-lower-bounded in the end to 2 to have delayed-ACK slow-start behavior.
+Fix by calling consume_skb instead of doing goto discard and therefore
+calling __kfree_skb.
 
-This particularly shows up when slow_start_after_idle is disabled
-as a dangerous cwnd inflation (1.5 x RTT) after few seconds of idle
-time.
+Similar fixes for TCP:
 
-Jana initial fix was to reset epoch_start if app limited,
-but Neal pointed out it would ask the CUBIC algorithm to recalculate the
-curve so that we again start growing steeply upward from where cwnd is
-now (as CUBIC does just after a loss). Ideally we'd want the cwnd growth
-curve to be the same shape, just shifted later in time by the amount of
-the idle period.
+fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.
+0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now
+simply consumed
 
-Reported-by: Jana Iyengar <jri@google.com>
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Signed-off-by: Yuchung Cheng <ycheng@google.com>
-Signed-off-by: Neal Cardwell <ncardwell@google.com>
-Cc: Stephen Hemminger <stephen@networkplumber.org>
-Cc: Sangtae Ha <sangtae.ha@gmail.com>
-Cc: Lawrence Brakmo <lawrence@brakmo.org>
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
 Signed-off-by: David S. Miller <davem@davemloft.net>
 ---
- net/ipv4/tcp_cubic.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
+ net/dccp/input.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/dccp/input.c b/net/dccp/input.c
+index ba34718..8fedc2d 100644
+--- a/net/dccp/input.c
++++ b/net/dccp/input.c
+@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+                       if (inet_csk(sk)->icsk_af_ops->conn_request(sk,
+                                                                   skb) < 0)
+                               return 1;
+-                      goto discard;
++                      consume_skb(skb);
++                      return 0;
+               }
+               if (dh->dccph_type == DCCP_PKT_RESET)
+                       goto discard;
+-- 
+cgit v0.12
 
-diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
-index 28011fb1..c6ded6b 100644
---- a/net/ipv4/tcp_cubic.c
-+++ b/net/ipv4/tcp_cubic.c
-@@ -151,6 +151,21 @@ static void bictcp_init(struct sock *sk)
-               tcp_sk(sk)->snd_ssthresh = initial_ssthresh;
- }
-+static void bictcp_cwnd_event(struct sock *sk, enum tcp_ca_event event)
-+{
-+      if (event == CA_EVENT_TX_START) {
-+              s32 delta = tcp_time_stamp - tcp_sk(sk)->lsndtime;
-+              struct bictcp *ca = inet_csk_ca(sk);
-+
-+              /* We were application limited (idle) for a while.
-+               * Shift epoch_start to keep cwnd growth to cubic curve.
-+               */
-+              if (ca->epoch_start && delta > 0)
-+                      ca->epoch_start += delta;
-+              return;
-+      }
-+}
-+
- /* calculate the cubic root of x using a table lookup followed by one
-  * Newton-Raphson iteration.
-  * Avg err ~= 0.195%
-@@ -450,6 +465,7 @@ static struct tcp_congestion_ops cubictcp __read_mostly = {
-       .cong_avoid     = bictcp_cong_avoid,
-       .set_state      = bictcp_state,
-       .undo_cwnd      = bictcp_undo_cwnd,
-+      .cwnd_event     = bictcp_cwnd_event,
-       .pkts_acked     = bictcp_acked,
-       .owner          = THIS_MODULE,
-       .name           = "cubic",
This page took 0.160372 seconds and 4 git commands to generate.