diff options
author | Stijn Segers <foss@volatilesystems.org> | 2018-08-04 18:08:26 +0200 |
---|---|---|
committer | John Crispin <john@phrozen.org> | 2018-08-06 07:30:41 +0200 |
commit | 9ce7aa325ebdc86426390b0f8adc3ea43d3b8b7d (patch) | |
tree | 06de2110b46b413f3ad1455774c68fe07683bf3d /target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch | |
parent | 9e1530b2a35e051664ed243efd1eac942883494a (diff) | |
download | upstream-9ce7aa325ebdc86426390b0f8adc3ea43d3b8b7d.tar.gz upstream-9ce7aa325ebdc86426390b0f8adc3ea43d3b8b7d.tar.bz2 upstream-9ce7aa325ebdc86426390b0f8adc3ea43d3b8b7d.zip |
kernel: bump 4.14 to 4.14.60 for 18.06
* Refreshed patches.
* Patches made redundant by changes upstream:
- target/linux/ramips/patches-4.14/0036-mtd-fix-cfi-cmdset-0002-erase-status-check.patch
* Patches accepted upstream:
- target/linux/apm821xx/patches-4.14/020-0001-crypto-crypto4xx-remove-bad-list_del.patch
- target/linux/apm821xx/patches-4.14/020-0011-crypto-crypto4xx-fix-crypto4xx_build_pdr-crypto4xx_b.patch
- target/linux/brcm63xx/patches-4.14/001-4.15-08-bcm63xx_enet-correct-clock-usage.patch
- target/linux/brcm63xx/patches-4.14/001-4.15-09-bcm63xx_enet-do-not-write-to-random-DMA-channel-on-B.patch
- target/linux/generic/backport-4.14/080-net-convert-sock.sk_wmem_alloc-from-atomic_t-to-refc.patch
- target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch
The ext4 regression introduced in 4.14.55 has been fixed by 4.14.60 (commit f547aa20b4f61662ad3e1a2040bb3cc5778f19b0).
Fixes the following CVEs:
- CVE-2018-10876
- CVE-2018-10877
- CVE-2018-10879
- CVE-2018-10880
- CVE-2018-10881
- CVE-2018-10882
- CVE-2018-10883
Thanks to Stijn Tintel for the CVE list :-).
Compile-tested on: ramips/mt7621, x86/64
Run-tested on: ramips/mt7621, x86/64
Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Diffstat (limited to 'target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch')
-rw-r--r-- | target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch | 49 |
1 files changed, 0 insertions, 49 deletions
diff --git a/target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch b/target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch deleted file mode 100644 index f5ceecca93..0000000000 --- a/target/linux/generic/pending-4.14/900-gen_stats-fix-netlink-stats-padding.patch +++ /dev/null @@ -1,49 +0,0 @@ -The gen_stats facility will add a header for the toplevel nlattr of type -TCA_STATS2 that contains all stats added by qdisc callbacks. A reference -to this header is stored in the gnet_dump struct, and when all the -per-qdisc callbacks have finished adding their stats, the length of the -containing header will be adjusted to the right value. - -However, on architectures that need padding (i.e., that don't set -CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), the padding nlattr is added -before the stats, which means that the stored pointer will point to the -padding, and so when the header is fixed up, the result is just a very -big padding nlattr. Because most qdiscs also supply the legacy TCA_STATS -struct, this problem has been mostly invisible, but we exposed it with -the netlink attribute-based statistics in CAKE. - -Fix the issue by fixing up the stored pointer if it points to a padding -nlattr. - -Tested-by: Pete Heist <pete@heistp.net> -Tested-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk> -Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk> ---- - net/core/gen_stats.c | 16 ++++++++++++++-- - 1 file changed, 14 insertions(+), 2 deletions(-) - ---- a/net/core/gen_stats.c -+++ b/net/core/gen_stats.c -@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_b - d->lock = lock; - spin_lock_bh(lock); - } -- if (d->tail) -- return gnet_stats_copy(d, type, NULL, 0, padattr); -+ if (d->tail) { -+ int ret = gnet_stats_copy(d, type, NULL, 0, padattr); -+ -+ /* The initial attribute added in gnet_stats_copy() may be -+ * preceded by a padding attribute, in which case d->tail will -+ * end up pointing at the padding instead of the real attribute. -+ * Fix this so gnet_stats_finish_copy() adjusts the length of -+ * the right attribute. -+ */ -+ if (ret == 0 && d->tail->nla_type == padattr) -+ d->tail = (struct nlattr *)((char *)d->tail + -+ NLA_ALIGN(d->tail->nla_len)); -+ return ret; -+ } - - return 0; - } |