[pve-devel] r5175 - pve-kernel-2.6.32/trunk

svn-commits at proxmox.com svn-commits at proxmox.com
Fri Sep 17 18:02:14 CEST 2010


Author: dietmar
Date: 2010-09-17 16:02:14 +0000 (Fri, 17 Sep 2010)
New Revision: 5175

Added:
   pve-kernel-2.6.32/trunk/security-fix2.patch
Modified:
   pve-kernel-2.6.32/trunk/Makefile
   pve-kernel-2.6.32/trunk/changelog.Debian
Log:


Modified: pve-kernel-2.6.32/trunk/Makefile
===================================================================
--- pve-kernel-2.6.32/trunk/Makefile	2010-09-17 13:43:31 UTC (rev 5174)
+++ pve-kernel-2.6.32/trunk/Makefile	2010-09-17 16:02:14 UTC (rev 5175)
@@ -3,7 +3,7 @@
 KERNEL_VER=2.6.32
 KERNEL_DEB_REL=22
 
-PKGREL=17
+PKGREL=18
 KREL=3
 
 EXTRAVERSION=-${KREL}-pve
@@ -124,6 +124,8 @@
 	zcat ${KERNEL_DEB_DIFF}|patch -p1 -d ${KERNEL_SRC}
 	# fix CVE-2010-3081
 	cd ${KERNEL_SRC}; patch -p1 <../security-fix1.patch 
+	# fix CVE-2010-3301
+	cd ${KERNEL_SRC}; patch -p1 <../security-fix2.patch 
 	./applydebpatches.pl ${KERNEL_SRC} ${KERNEL_DEB_REL}
 	cd ${KERNEL_SRC}; patch -p1 <../bootsplash-3.1.9-2.6.31.patch 
 	cd ${KERNEL_SRC}; patch -p1 <../bridge-patch.diff

Modified: pve-kernel-2.6.32/trunk/changelog.Debian
===================================================================
--- pve-kernel-2.6.32/trunk/changelog.Debian	2010-09-17 13:43:31 UTC (rev 5174)
+++ pve-kernel-2.6.32/trunk/changelog.Debian	2010-09-17 16:02:14 UTC (rev 5175)
@@ -1,6 +1,13 @@
+pve-kernel-2.6.32 (2.6.32-18) unstable; urgency=low
+
+  * fix previous fix: see http://sota.gen.nz/compat1/ and
+    http://sota.gen.nz/compat2/ (security-fix2.patch)
+
+ -- Proxmox Support Team <support at proxmox.com>  Fri, 17 Sep 2010 17:29:28 +0200
+
 pve-kernel-2.6.32 (2.6.32-17) unstable; urgency=low
 
-  * fix  CVE-2010-3081 kernel
+  * fix CVE-2010-3081 kernel (security-fix1.patch)
   
  -- Proxmox Support Team <support at proxmox.com>  Fri, 17 Sep 2010 15:42:14 +0200
 

Added: pve-kernel-2.6.32/trunk/security-fix2.patch
===================================================================
--- pve-kernel-2.6.32/trunk/security-fix2.patch	                        (rev 0)
+++ pve-kernel-2.6.32/trunk/security-fix2.patch	2010-09-17 16:02:14 UTC (rev 5175)
@@ -0,0 +1,137 @@
+commit 36d001c70d8a0144ac1d038f6876c484849a74de
+Author: H. Peter Anvin <hpa at linux.intel.com>
+Date:   Tue Sep 14 12:42:41 2010 -0700
+
+    x86-64, compat: Test %rax for the syscall number, not %eax
+    
+    On 64 bits, we always, by necessity, jump through the system call
+    table via %rax.  For 32-bit system calls, in theory the system call
+    number is stored in %eax, and the code was testing %eax for a valid
+    system call number.  At one point we loaded the stored value back from
+    the stack to enforce zero-extension, but that was removed in checkin
+    d4d67150165df8bf1cc05e532f6efca96f907cab.  An actual 32-bit process
+    will not be able to introduce a non-zero-extended number, but it can
+    happen via ptrace.
+    
+    Instead of re-introducing the zero-extension, test what we are
+    actually going to use, i.e. %rax.  This only adds a handful of REX
+    prefixes to the code.
+    
+    Reported-by: Ben Hawkes <hawkes at sota.gen.nz>
+    Signed-off-by: H. Peter Anvin <hpa at linux.intel.com>
+    Cc: <stable at kernel.org>
+    Cc: Roland McGrath <roland at redhat.com>
+    Cc: Andrew Morton <akpm at linux-foundation.org>
+
+diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
+index b86feab..84e3a4e 100644
+--- a/arch/x86/ia32/ia32entry.S
++++ b/arch/x86/ia32/ia32entry.S
+@@ -153,7 +153,7 @@ ENTRY(ia32_sysenter_target)
+ 	testl  $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
+ 	CFI_REMEMBER_STATE
+ 	jnz  sysenter_tracesys
+-	cmpl	$(IA32_NR_syscalls-1),%eax
++	cmpq	$(IA32_NR_syscalls-1),%rax
+ 	ja	ia32_badsys
+ sysenter_do_call:
+ 	IA32_ARG_FIXUP
+@@ -195,7 +195,7 @@ sysexit_from_sys_call:
+ 	movl $AUDIT_ARCH_I386,%edi	/* 1st arg: audit arch */
+ 	call audit_syscall_entry
+ 	movl RAX-ARGOFFSET(%rsp),%eax	/* reload syscall number */
+-	cmpl $(IA32_NR_syscalls-1),%eax
++	cmpq $(IA32_NR_syscalls-1),%rax
+ 	ja ia32_badsys
+ 	movl %ebx,%edi			/* reload 1st syscall arg */
+ 	movl RCX-ARGOFFSET(%rsp),%esi	/* reload 2nd syscall arg */
+@@ -248,7 +248,7 @@ sysenter_tracesys:
+ 	call	syscall_trace_enter
+ 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
+ 	RESTORE_REST
+-	cmpl	$(IA32_NR_syscalls-1),%eax
++	cmpq	$(IA32_NR_syscalls-1),%rax
+ 	ja	int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
+ 	jmp	sysenter_do_call
+ 	CFI_ENDPROC
+@@ -314,7 +314,7 @@ ENTRY(ia32_cstar_target)
+ 	testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
+ 	CFI_REMEMBER_STATE
+ 	jnz   cstar_tracesys
+-	cmpl $IA32_NR_syscalls-1,%eax
++	cmpq $IA32_NR_syscalls-1,%rax
+ 	ja  ia32_badsys
+ cstar_do_call:
+ 	IA32_ARG_FIXUP 1
+@@ -367,7 +367,7 @@ cstar_tracesys:
+ 	LOAD_ARGS32 ARGOFFSET, 1  /* reload args from stack in case ptrace changed it */
+ 	RESTORE_REST
+ 	xchgl %ebp,%r9d
+-	cmpl $(IA32_NR_syscalls-1),%eax
++	cmpq $(IA32_NR_syscalls-1),%rax
+ 	ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
+ 	jmp cstar_do_call
+ END(ia32_cstar_target)
+@@ -425,7 +425,7 @@ ENTRY(ia32_syscall)
+ 	orl   $TS_COMPAT,TI_status(%r10)
+ 	testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
+ 	jnz ia32_tracesys
+-	cmpl $(IA32_NR_syscalls-1),%eax
++	cmpq $(IA32_NR_syscalls-1),%rax
+ 	ja ia32_badsys
+ ia32_do_call:
+ 	IA32_ARG_FIXUP
+@@ -444,7 +444,7 @@ ia32_tracesys:
+ 	call syscall_trace_enter
+ 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
+ 	RESTORE_REST
+-	cmpl $(IA32_NR_syscalls-1),%eax
++	cmpq $(IA32_NR_syscalls-1),%rax
+ 	ja  int_ret_from_sys_call	/* ia32_tracesys has set RAX(%rsp) */
+ 	jmp ia32_do_call
+ END(ia32_syscall)
+
+commit eefdca043e8391dcd719711716492063030b55ac
+Author: Roland McGrath <roland at redhat.com>
+Date:   Tue Sep 14 12:22:58 2010 -0700
+
+    x86-64, compat: Retruncate rax after ia32 syscall entry tracing
+    
+    In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a
+    32-bit tracee in system call entry.  A %rax value set via ptrace at the
+    entry tracing stop gets used whole as a 32-bit syscall number, while we
+    only check the low 32 bits for validity.
+    
+    Fix it by truncating %rax back to 32 bits after syscall_trace_enter,
+    in addition to testing the full 64 bits as has already been added.
+    
+    Reported-by: Ben Hawkes <hawkes at sota.gen.nz>
+    Signed-off-by: Roland McGrath <roland at redhat.com>
+    Signed-off-by: H. Peter Anvin <hpa at linux.intel.com>
+
+diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
+index 84e3a4e..518bb99 100644
+--- a/arch/x86/ia32/ia32entry.S
++++ b/arch/x86/ia32/ia32entry.S
+@@ -50,7 +50,12 @@
+ 	/*
+ 	 * Reload arg registers from stack in case ptrace changed them.
+ 	 * We don't reload %eax because syscall_trace_enter() returned
+-	 * the value it wants us to use in the table lookup.
++	 * the %rax value we should see.  Instead, we just truncate that
++	 * value to 32 bits again as we did on entry from user mode.
++	 * If it's a new value set by user_regset during entry tracing,
++	 * this matches the normal truncation of the user-mode value.
++	 * If it's -1 to make us punt the syscall, then (u32)-1 is still
++	 * an appropriately invalid value.
+ 	 */
+ 	.macro LOAD_ARGS32 offset, _r9=0
+ 	.if \_r9
+@@ -60,6 +65,7 @@
+ 	movl \offset+48(%rsp),%edx
+ 	movl \offset+56(%rsp),%esi
+ 	movl \offset+64(%rsp),%edi
++	movl %eax,%eax			/* zero extension */
+ 	.endm
+ 	
+ 	.macro CFI_STARTPROC32 simple




More information about the pve-devel mailing list