kernel-small_fixes.patch

   1 --- linux-2.6.33/scripts/mod/modpost.c~ 2010-02-24 19:52:17.000000000 +0100
   2 +++ linux-2.6.33/scripts/mod/modpost.c  2010-03-07 14:26:47.242168558 +0100
   3 @@ -15,7 +15,8 @@
   4  #include <stdio.h>
   5  #include <ctype.h>
   6  #include "modpost.h"
   7 -#include "../../include/generated/autoconf.h"
   8 +// PLD architectures don't use CONFIG_SYMBOL_PREFIX
   9 +//#include "../../include/generated/autoconf.h"
  10  #include "../../include/linux/license.h"
  11
  12  /* Some toolchains use a `_' prefix for all user symbols. */
  13
  14 --- linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh~       2011-07-22 04:17:23.000000000 +0200
  15 +++ linux-3.0/scripts/kconfig/lxdialog/check-lxdialog.sh        2011-08-25 21:26:04.799150642 +0200
  16 @@ -9,6 +9,12 @@
  17                         $cc -print-file-name=lib${lib}.${ext} | grep -q /
  18                         if [ $? -eq 0 ]; then
  19                                 echo "-l${lib}"
  20 +                               for libt in tinfow tinfo ; do
  21 +                                       $cc -print-file-name=lib${libt}.${ext} | grep -q /
  22 +                                       if [ $? -eq 0 ]; then
  23 +                                               echo "-l${libt}"
  24 +                                       fi
  25 +                               done
  26                                 exit
  27                         fi
  28                 done
  29 --- a/Makefile  2016-11-10 20:41:43.646224629 +0100
  30 +++ b/Makefile  2016-11-10 20:40:35.640323501 +0100
  31 @@ -784,6 +774,9 @@
  32  # Prohibit date/time macros, which would make the build non-deterministic
  33  KBUILD_CFLAGS   += $(call cc-option,-Werror=date-time)
  34
  35 +# enforce correct pointer usage
  36 +KBUILD_CFLAGS   += $(call cc-option,-Werror=incompatible-pointer-types)
  37 +
  38  # use the deterministic mode of AR if available
  39  KBUILD_ARFLAGS := $(call ar-option,D)
  40
  41 From 84ac7260236a49c79eede91617700174c2c19b0c Mon Sep 17 00:00:00 2001
  42 From: Philip Pettersson <philip.pettersson@gmail.com>
  43 Date: Wed, 30 Nov 2016 14:55:36 -0800
  44 Subject: packet: fix race condition in packet_set_ring
  45
  46 When packet_set_ring creates a ring buffer it will initialize a
  47 struct timer_list if the packet version is TPACKET_V3. This value
  48 can then be raced by a different thread calling setsockopt to
  49 set the version to TPACKET_V1 before packet_set_ring has finished.
  50
  51 This leads to a use-after-free on a function pointer in the
  52 struct timer_list when the socket is closed as the previously
  53 initialized timer will not be deleted.
  54
  55 The bug is fixed by taking lock_sock(sk) in packet_setsockopt when
  56 changing the packet version while also taking the lock at the start
  57 of packet_set_ring.
  58
  59 Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
  60 Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com>
  61 Signed-off-by: Eric Dumazet <edumazet@google.com>
  62 Signed-off-by: David S. Miller <davem@davemloft.net>
  63 ---
  64  net/packet/af_packet.c | 18 ++++++++++++------
  65  1 file changed, 12 insertions(+), 6 deletions(-)
  66
  67 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
  68 index d2238b2..dd23323 100644
  69 --- a/net/packet/af_packet.c
  70 +++ b/net/packet/af_packet.c
  71 @@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
  72
  73                 if (optlen != sizeof(val))
  74                         return -EINVAL;
  75 -               if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
  76 -                       return -EBUSY;
  77                 if (copy_from_user(&val, optval, sizeof(val)))
  78                         return -EFAULT;
  79                 switch (val) {
  80                 case TPACKET_V1:
  81                 case TPACKET_V2:
  82                 case TPACKET_V3:
  83 -                       po->tp_version = val;
  84 -                       return 0;
  85 +                       break;
  86                 default:
  87                         return -EINVAL;
  88                 }
  89 +               lock_sock(sk);
  90 +               if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
  91 +                       ret = -EBUSY;
  92 +               } else {
  93 +                       po->tp_version = val;
  94 +                       ret = 0;
  95 +               }
  96 +               release_sock(sk);
  97 +               return ret;
  98         }
  99         case PACKET_RESERVE:
 100         {
 101 @@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 102         /* Added to avoid minimal code churn */
 103         struct tpacket_req *req = &req_u->req;
 104
 105 +       lock_sock(sk);
 106         /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
 107         if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
 108                 net_warn_ratelimited("Tx-ring is not supported.\n");
 109 @@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 110                         goto out;
 111         }
 112
 113 -       lock_sock(sk);
 114
 115         /* Detach socket from network */
 116         spin_lock(&po->bind_lock);
 117 @@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
 118                 if (!tx_ring)
 119                         prb_shutdown_retire_blk_timer(po, rb_queue);
 120         }
 121 -       release_sock(sk);
 122
 123         if (pg_vec)
 124                 free_pg_vec(pg_vec, order, req->tp_block_nr);
 125  out:
 126 +       release_sock(sk);
 127         return err;
 128  }
 129
 130 --
 131 cgit v0.12
 132