1. 13 5月, 2016 4 次提交
  2. 12 5月, 2016 9 次提交
    • D
      KEYS: Fix ASN.1 indefinite length object parsing · 23c8a812
      David Howells 提交于
      This fixes CVE-2016-0758.
      
      In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
      it isn't validated against the remaining amount of data before being added
      to the cursor.  With a sufficiently large size indicated, the check:
      
      	datalen - dp < 2
      
      may then fail due to integer overflow.
      
      Fix this by checking the length indicated against the amount of remaining
      data in both places a definite length is determined.
      
      Whilst we're at it, make the following changes:
      
       (1) Check the maximum size of extended length does not exceed the capacity
           of the variable it's being stored in (len) rather than the type that
           variable is assumed to be (size_t).
      
       (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
           integer 0.
      
       (3) To reduce confusion, move the initialisation of len outside of:
      
      	for (len = 0; n > 0; n--) {
      
           since it doesn't have anything to do with the loop counter n.
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      Reviewed-by: NMimi Zohar <zohar@linux.vnet.ibm.com>
      Acked-by: NDavid Woodhouse <David.Woodhouse@intel.com>
      Acked-by: NPeter Jones <pjones@redhat.com>
      23c8a812
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 685764b1
      Linus Torvalds 提交于
      Pull SCSI fixes from James Bottomley:
       "This is a couple of small fixes: one is a potential uninitialised
        error variable in the alua code, potentially causing spurious failures
        and the other is a problem caused by the conversion of SCSI to
        hostwide tags which resulted in the qla1280 driver always failing in
        host initialisation"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        qla1280: Don't allocate 512kb of host tags
        scsi_dh_alua: uninitialized variable in alua_rtpg()
      685764b1
    • L
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · 4d8bbbff
      Linus Torvalds 提交于
      Pull networking fixes from David Miller:
       "Hopefully the last round of fixes this release, fingers crossed :)
      
         1) Initialize static nf_conntrack_locks_all_lock properly, from
            Florian Westphal.
      
         2) Need to cancel pending work when destroying IDLETIMER entries,
            from Liping Zhang.
      
         3) Fix TX param usage when sending TSO over iwlwifi devices, from
            Emmanuel Grumbach.
      
         4) NFACCT quota params not validated properly, from Phil Turnbull.
      
         5) Resolve more glibc vs.  kernel header conflicts, from Mikko
            Tapeli.
      
         6) Missing IRQ free in ravb_close(), from Geert Uytterhoeven.
      
         7) Fix infoleak in x25, from Kangjie Lu.
      
         8) Similarly in thunderx driver, from Heinrich Schuchardt.
      
         9) tc_ife.h uapi header not exported properly, from Jamal Hadi Salim.
      
        10) Don't reenable PHY interreupts if device is in polling mode, from
            Shaohui Xie.
      
        11) Packet scheduler actions late binding was not being handled
            properly at all, from Jamal Hadi Salim.
      
        12) Fix binding of conntrack entries to helpers in openvswitch, from
            Joe Stringer"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (21 commits)
        gre: do not keep the GRE header around in collect medata mode
        openvswitch: Fix cached ct with helper.
        net sched: ife action fix late binding
        net sched: skbedit action fix late binding
        net sched: simple action fix late binding
        net sched: mirred action fix late binding
        net sched: ipt action fix late binding
        net sched: vlan action fix late binding
        net: phylib: fix interrupts re-enablement in phy_start
        tcp: refresh skb timestamp at retransmit time
        net: nps_enet: bug fix - handle lost tx interrupts
        net: nps_enet: Tx handler synchronization
        export tc ife uapi header
        net: thunderx: avoid exposing kernel stack
        net: fix a kernel infoleak in x25 module
        ravb: Add missing free_irq() call to ravb_close()
        uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h
        netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter
        iwlwifi: mvm: don't override the rate with the AMSDU len
        netfilter: IDLETIMER: fix race condition when destroy the target
        ...
      4d8bbbff
    • J
      gre: do not keep the GRE header around in collect medata mode · e271c7b4
      Jiri Benc 提交于
      For ipgre interface in collect metadata mode, it doesn't make sense for the
      interface to be of ARPHRD_IPGRE type. The outer header of received packets
      is not needed, as all the information from it is present in metadata_dst. We
      already don't set ipgre_header_ops for collect metadata interfaces, which is
      the only consumer of mac_header pointing to the outer IP header.
      
      Just set the interface type to ARPHRD_NONE in collect metadata mode for
      ipgre (not gretap, that still correctly stays ARPHRD_ETHER) and reset
      mac_header.
      
      Fixes: a64b04d8 ("gre: do not assign header_ops in collect metadata mode")
      Fixes: 2e15ea39 ("ip_gre: Add support to collect tunnel metadata.")
      Signed-off-by: NJiri Benc <jbenc@redhat.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e271c7b4
    • J
      openvswitch: Fix cached ct with helper. · 16ec3d4f
      Joe Stringer 提交于
      When using conntrack helpers from OVS, a common configuration is to
      perform a lookup without specifying a helper, then go through a
      firewalling policy, only to decide to attach a helper afterwards.
      
      In this case, the initial lookup will cause a ct entry to be attached to
      the skb, then the later commit with helper should attach the helper and
      confirm the connection. However, the helper attachment has been missing.
      If the user has enabled automatic helper attachment, then this issue
      will be masked as it will be applied in init_conntrack(). It is also
      masked if the action is executed from ovs_packet_cmd_execute() as that
      will construct a fresh skb.
      
      This patch fixes the issue by making an explicit call to try to assign
      the helper if there is a discrepancy between the action's helper and the
      current skb->nfct.
      
      Fixes: cae3a262 ("openvswitch: Allow attaching helpers to ct action")
      Signed-off-by: NJoe Stringer <joe@ovn.org>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      16ec3d4f
    • M
      x86/extable: ensure entries are swapped completely when sorting · 50c73890
      Mathias Krause 提交于
      The x86 exception table sorting was changed in commit 29934b0f
      ("x86/extable: use generic search and sort routines") to use the arch
      independent code in lib/extable.c.  However, the patch was mangled
      somehow on its way into the kernel from the last version posted at [1].
      The committed version kind of attempted to incorporate the changes of
      commit 548acf19 ("x86/mm: Expand the exception table logic to allow
      new handling options") as in _completely_ _ignoring_ the x86 specific
      'handler' member of struct exception_table_entry.  This effectively
      broke the sorting as entries will only partly be swapped now.
      
      Fortunately, the x86 Kconfig selects BUILDTIME_EXTABLE_SORT, so the
      exception table doesn't need to be sorted at runtime. However, in case
      that ever changes, we better not break the exception table sorting just
      because of that.
      
      [ Ard Biesheuvel points out that BUILDTIME_EXTABLE_SORT applies to the
        core image only, but we still rely on the sorting routines for modules
        in that case - Linus ]
      
      Fix this by providing a swap_ex_entry_fixup() macro that takes care of
      the 'handler' member.
      
      [1] https://lkml.org/lkml/2016/1/27/232Signed-off-by: NMathias Krause <minipli@googlemail.com>
      Fixes: 29934b0f ("x86/extable: use generic search and sort routines")
      Reviewed-by: NArd Biesheuvel <ard.biesheuvel@linaro.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Borislav Petkov <bp@suse.de>
      Cc: H. Peter Anvin <hpa@linux.intel.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Tony Luck <tony.luck@intel.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      50c73890
    • L
      Merge tag 'spi-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · e0d09e32
      Linus Torvalds 提交于
      Pull spi fixes from Mark Brown:
       "A bunch of small driver specific fixes that have come up, none of them
        remarkable in themselves.  One fixes a regression introduced in the
        merge window and another two are targetted at stable"
      
      * tag 'spi-fix-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: pxa2xx: Do not detect number of enabled chip selects on Intel SPT
        spi: spi-ti-qspi: Handle truncated frames properly
        spi: spi-ti-qspi: Fix FLEN and WLEN settings if bits_per_word is overridden
        spi: omap2-mcspi: Undo broken fix for dma transfer of vmalloced buffer
        spi: spi-fsl-dspi: Fix cs_change handling in message transfer
      e0d09e32
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · d32917ee
      Linus Torvalds 提交于
      Pull KVM fixes from Paolo Bonzini:
       "Two small x86 patches, improving "make kvmconfig" and fixing an
        objtool warning for CONFIG_PROFILE_ALL_BRANCHES"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        kvmconfig: add more virtio drivers
        x86/kvm: Add stack frame dependency to fastop() inline asm
      d32917ee
    • T
      ALSA: usb-audio: Yet another Phoneix Audio device quirk · 84add303
      Takashi Iwai 提交于
      Phoenix Audio has yet another device with another id (even a different
      vendor id, 0556:0014) that requires the same quirk for the sample
      rate.
      
      Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110221
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NTakashi Iwai <tiwai@suse.de>
      84add303
  3. 11 5月, 2016 18 次提交
  4. 10 5月, 2016 9 次提交
新手
引导
客服 返回
顶部