diff --git a/debian/changelog b/debian/changelog index 4114cb883..33684cd01 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -linux (4.10~rc5-1~exp1) UNRELEASED; urgency=medium +linux (4.10~rc6-1~exp1) UNRELEASED; urgency=medium * New upstream release candidate diff --git a/debian/patches/bugfix/all/fbdev-color-map-coying-bounds-checking.patch b/debian/patches/bugfix/all/fbdev-color-map-coying-bounds-checking.patch deleted file mode 100644 index 10c6e2a6e..000000000 --- a/debian/patches/bugfix/all/fbdev-color-map-coying-bounds-checking.patch +++ /dev/null @@ -1,80 +0,0 @@ -From: Kees Cook -Date: Tue, 24 Jan 2017 15:18:24 -0800 -Subject: fbdev: color map copying bounds checking -Origin: https://git.kernel.org/linus/2dc705a9930b4806250fbf5a76e55266e59389f2 -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2016-8405 - -Copying color maps to userspace doesn't check the value of to->start, -which will cause kernel heap buffer OOB read due to signedness wraps. - -CVE-2016-8405 - -Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Kees Cook -Reported-by: Peter Pi (@heisecode) of Trend Micro -Cc: Min Chong -Cc: Dan Carpenter -Cc: Tomi Valkeinen -Cc: Bartlomiej Zolnierkiewicz -Cc: -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds ---- - drivers/video/fbdev/core/fbcmap.c | 26 ++++++++++++++------------ - 1 file changed, 14 insertions(+), 12 deletions(-) - -diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c -index f89245b8ba8e..68a113594808 100644 ---- a/drivers/video/fbdev/core/fbcmap.c -+++ b/drivers/video/fbdev/core/fbcmap.c -@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap) - - int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) - { -- int tooff = 0, fromoff = 0; -- int size; -+ unsigned int tooff = 0, fromoff = 0; -+ size_t size; - - if (to->start > from->start) - fromoff = to->start - from->start; - else - tooff = from->start - to->start; -- size = to->len - tooff; -- if (size > (int) (from->len - fromoff)) -- size = from->len - fromoff; -- if (size <= 0) -+ if (fromoff >= from->len || tooff >= to->len) -+ return -EINVAL; -+ -+ size = min_t(size_t, to->len - tooff, from->len - fromoff); -+ if (size == 0) - return -EINVAL; - size *= sizeof(u16); - -@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) - - int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) - { -- int tooff = 0, fromoff = 0; -- int size; -+ unsigned int tooff = 0, fromoff = 0; -+ size_t size; - - if (to->start > from->start) - fromoff = to->start - from->start; - else - tooff = from->start - to->start; -- size = to->len - tooff; -- if (size > (int) (from->len - fromoff)) -- size = from->len - fromoff; -- if (size <= 0) -+ if (fromoff >= from->len || tooff >= to->len) -+ return -EINVAL; -+ -+ size = min_t(size_t, to->len - tooff, from->len - fromoff); -+ if (size == 0) - return -EINVAL; - size *= sizeof(u16); - diff --git a/debian/patches/bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch b/debian/patches/bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch deleted file mode 100644 index be7736050..000000000 --- a/debian/patches/bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch +++ /dev/null @@ -1,36 +0,0 @@ -From: Eric Anholt -Date: Wed, 18 Jan 2017 07:20:49 +1100 -Subject: drm/vc4: Fix an integer overflow in temporary allocation layout. -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-5576 -Origin: https://lkml.org/lkml/2017/1/17/761 - -We copy the unvalidated ioctl arguments from the user into kernel -temporary memory to run the validation from, to avoid a race where the -user updates the unvalidate contents in between validating them and -copying them into the validated BO. - -However, in setting up the layout of the kernel side, we failed to -check one of the additions (the roundup() for shader_rec_offset) -against integer overflow, allowing a nearly MAX_UINT value of -bin_cl_size to cause us to under-allocate the temporary space that we -then copy_from_user into. - -Reported-by: Murray McAllister -Signed-off-by: Eric Anholt -Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") ---- - drivers/gpu/drm/vc4/vc4_gem.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/drivers/gpu/drm/vc4/vc4_gem.c -+++ b/drivers/gpu/drm/vc4/vc4_gem.c -@@ -594,7 +594,8 @@ vc4_get_bcl(struct drm_device *dev, stru - args->shader_rec_count); - struct vc4_bo *bo; - -- if (uniforms_offset < shader_rec_offset || -+ if (shader_rec_offset < args->bin_cl_size || -+ uniforms_offset < shader_rec_offset || - exec_size < uniforms_offset || - args->shader_rec_count >= (UINT_MAX / - sizeof(struct vc4_shader_state)) || diff --git a/debian/patches/bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch b/debian/patches/bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch deleted file mode 100644 index 95dc72119..000000000 --- a/debian/patches/bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch +++ /dev/null @@ -1,27 +0,0 @@ -From: Eric Anholt -Date: Wed, 18 Jan 2017 07:20:50 +1100 -Subject: drm/vc4: Return -EINVAL on the overflow checks failing. -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-5577 -Origin: https://lkml.org/lkml/2017/1/17/759 - -By failing to set the errno, we'd continue on to trying to set up the -RCL, and then oops on trying to dereference the tile_bo that binning -validation should have set up. - -Reported-by: Ingo Molnar -Signed-off-by: Eric Anholt -Fixes: d5b1a78a772f ("drm/vc4: Add support for drawing 3D frames.") ---- - drivers/gpu/drm/vc4/vc4_gem.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/gpu/drm/vc4/vc4_gem.c -+++ b/drivers/gpu/drm/vc4/vc4_gem.c -@@ -601,6 +601,7 @@ vc4_get_bcl(struct drm_device *dev, stru - sizeof(struct vc4_shader_state)) || - temp_size < exec_size) { - DRM_ERROR("overflow in exec arguments\n"); -+ ret = -EINVAL; - goto fail; - } - diff --git a/debian/patches/series b/debian/patches/series index 0032a56b0..945b4ce17 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -92,9 +92,6 @@ features/all/securelevel/arm64-add-kernel-config-option-to-set-securelevel-wh.pa # Security fixes debian/i386-686-pae-pci-set-pci-nobios-by-default.patch -bugfix/all/fbdev-color-map-coying-bounds-checking.patch -bugfix/arm/drm-vc4-fix-an-integer-overflow-in-temporary-allocation-layout.patch -bugfix/arm/drm/vc4-return-einval-on-the-overflow-checks-failing.patch # Fix exported symbol versions bugfix/ia64/revert-ia64-move-exports-to-definitions.patch