a0fa166...
by
Stefan Bader
on 2018-01-19
UBUNTU: Ubuntu- 3.13.0- 141.190
Signed-off-by: Stefan Bader <email address hidden>
d75f6f0...
by
Stefan Bader
on 2018-01-19
UBUNTU: SAUCE: x86/entry: Fixup 32bit compat call locations
CVE-2017-5753
CVE-2017-5715
BugLink: https:/ /bugs.launchpad .net/bugs/ 1744199
BugLink: https:/ /bugs.launchpad .net/bugs/ 1744226
The code generated by the STUFF_RSB macro modifies the stack pointer.
So move calls into places where it already points to the kernel stack.
Fixes: f3e554d ("UBUNTU: SAUCE: x86/entry: Stuff RSB for entry to kernel
for non-SMEP platform")
Signed-off-by: Stefan Bader <email address hidden>
Tested-by: Po-Hsu Lin <email address hidden>
Signed-off-by: Stefan Bader <email address hidden>
419ba69...
by
Stefan Bader
on 2018-01-17
UBUNTU: SAUCE: KVM: Fix spec_ctrl CPUID support for guests
CVE-2017-5753
CVE-2017-5715
The ordering of the internal enum in scatter.c is eax=0, exc, edx, ebx,
so CR_EDX is 2.
Fixes: 07dce5b ("UBUNTU: SAUCE: KVM: x86: Add speculative control CPUID
support for guests")
Signed-off-by: Stefan Bader <email address hidden>
Acked-by: Kleber Sacilotto de Souza <email address hidden>
Acked-by: Khalid Elmously <email address hidden>
Signed-off-by: Kleber Sacilotto de Souza <email address hidden>
aaec20a...
by
Stefan Bader
on 2018-01-17
UBUNTU: SAUCE: x86/cpuid: Fix ordering of scattered feature list
CVE-2017-5753
CVE-2017-5715
The list must be ordered by cpuid level, otherwise lookup will
not work.
Fixes: 8d4f329 ("x86/cpuid: Provide get_scattered_ cpuid_leaf( )")
Signed-off-by: Stefan Bader <email address hidden>
Acked-by: Kleber Sacilotto de Souza <email address hidden>
Acked-by: Khalid Elmously <email address hidden>
Signed-off-by: Kleber Sacilotto de Souza <email address hidden>
7b8cdd0...
by
lepton
on 2018-01-12
kaiser: Set _PAGE_NX only if supported
CVE-2017-5754
This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
Link: https:/ /www.spinics. net/lists/ kernel/ msg2689835. html
Reviewed-by: Guenter Roeck <email address hidden>
Signed-off-by: Lepton Wu <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
(backported from Greg K-H's 4.4 stable-queue)
Signed-off-by: Juerg Haefliger <email address hidden>
Signed-off-by: Kleber Sacilotto de Souza <email address hidden>
5c5a6fb...
by
Guenter Roeck <email address hidden>
on 2018-01-04
kaiser: Set _PAGE_NX only if supported
CVE-2017-5754
This resolves a crash if loaded under qemu + haxm under windows.
See https:/ /www.spinics. net/lists/ kernel/ msg2689835. html for details.
Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that
the same log is also seen with vanilla v4.4.110-rc1).
[ 0.712750] Freeing unused kernel memory: 552K
[ 0.721821] init: Corrupted page table at address 57b029b332e0
[ 0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067
[ 0.722761] Bad pagetable: 000b [#1] PREEMPT SMP
[ 0.722761] Modules linked in:
[ 0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31
[ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.7. 5.1-0-g8936dbb- 20141113_ 115728- nilsson. home.kraxel. org 04/01/2014
[ 0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000
[ 0.722761] RIP: 0010:[< ffffffff83f4129 e>] [<ffffffff83f41 29e>] __clear_ user+0x42/ 0x67
[ 0.722761] RSP: 0000:ffff8800bc 28fcf8 EFLAGS: 00010202
[ 0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4
[ 0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0
[ 0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000
[ 0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0
[ 0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00
[ 0.722761] FS: 000000000000000 0(0000) GS:ffff8800bfb0 0000(0000) knlGS:000000000 0000000
[ 0.722761] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0
[ 0.722761] Stack:
[ 0.722761] 000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c
[ 0.722761] ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000
[ 0.722761] ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000
[ 0.722761] Call Trace:
[ 0.722761] [<ffffffff83f41 20c>] clear_user+ 0x2e/0x30
[ 0.722761] [<ffffffff83e9e 7a1>] load_elf_ binary+ 0xa7f/0x18f7
[ 0.722761] [<ffffffff83de2 088>] search_ binary_ handler+ 0x86/0x19c
[ 0.722761] [<ffffffff83de3 89e>] do_execveat_ common. isra.26+ 0x909/0xf98
[ 0.722761] [<ffffffff844fe be0>] ? rest_init+0x87/0x87
[ 0.722761] [<ffffffff83de4 0be>] do_execve+0x23/0x25
[ 0.722761] [<ffffffff83c00 2e3>] run_init_ process+ 0x2b/0x2d
[ 0.722761] [<ffffffff844fe c4d>] kernel_ init+0x6d/ 0xda
[ 0.722761] [<ffffffff84505 b2f>] ret_from_ fork+0x3f/ 0x70
[ 0.722761] [<ffffffff844fe be0>] ? rest_init+0x87/0x87
[ 0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1
eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17
48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff
[ 0.722761] RIP [<ffffffff83f41 29e>] __clear_ user+0x42/ 0x67
[ 0.722761] RSP <ffff8800bc28fcf8>
[ 0.722761] ---[ end trace def703879b4ff090 ]---
[ 0.722761] BUG: sleeping function called from invalid context at /mnt/host/ source/ src/third_ party/kernel/ v4.4/kernel/ locking/ rwsem.c: 21
[ 0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init
[ 0.722761] CPU: 1 PID: 1 Comm: init Tainted: G D 4.4.96 #31
[ 0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7. 5.1-0-g8936dbb- 20141113_ 115728- nilsson. home.kraxel. org 04/01/2014
[ 0.722761] 0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004
[ 0.722761] ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9
[ 0.722761] ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000
[ 0.722761] Call Trace:
[ 0.722761] [<ffffffff83f34 004>] dump_stack+ 0x4d/0x63
[ 0.722761] [<ffffffff83d57 dc9>] ___might_ sleep+0x13a/ 0x13c
[ 0.722761] [<ffffffff83d57 e6a>] __might_ sleep+0x9f/ 0xa6
[ 0.722761] [<ffffffff84502 788>] down_read+0x20/0x31
[ 0.722761] [<ffffffff83cc5 d9b>] __blocking_ notifier_ call_chain+ 0x35/0x63
[ 0.722761] [<ffffffff83cc5 ddd>] blocking_ notifier_ call_chain+ 0x14/0x16
[ 0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd
[ 0.722761] [<ffffffff83cef e97>] profile_ task_exit+ 0x1a/0x1c
[ 0.802309] [<ffffffff83cac 84e>] do_exit+0x39/0xe7f
[ 0.802309] [<ffffffff83ce5 938>] ? vprintk_ default+ 0x1d/0x1f
[ 0.802309] [<ffffffff83d7b b95>] ? printk+0x57/0x73
[ 0.802309] [<ffffffff83c46 e25>] oops_end+0x80/0x85
[ 0.802309] [<ffffffff83c7b 747>] pgtable_ bad+0x8a/ 0x95
[ 0.802309] [<ffffffff83ca7 f4a>] __do_page_ fault+0x8c/ 0x352
[ 0.802309] [<ffffffff83eef ba5>] ? file_has_ perm+0xc4/ 0xe5
[ 0.802309] [<ffffffff83ca8 21c>] do_page_ fault+0xc/ 0xe
[ 0.802309] [<ffffffff84507 682>] page_fault+ 0x22/0x30
[ 0.802309] [<ffffffff83f41 29e>] ? __clear_ user+0x42/ 0x67
[ 0.802309] [<ffffffff83f41 27f>] ? __clear_ user+0x23/ 0x67
[ 0.802309] [<ffffffff83f41 20c>] clear_user+ 0x2e/0x30
[ 0.802309] [<ffffffff83e9e 7a1>] load_elf_ binary+ 0xa7f/0x18f7
[ 0.802309] [<ffffffff83de2 088>] search_ binary_ handler+ 0x86/0x19c
[ 0.802309] [<ffffffff83de3 89e>] do_execveat_ common. isra.26+ 0x909/0xf98
[ 0.802309] [<ffffffff844fe be0>] ? rest_init+0x87/0x87
[ 0.802309] [<ffffffff83de4 0be>] do_execve+0x23/0x25
[ 0.802309] [<ffffffff83c00 2e3>] run_init_ process+ 0x2b/0x2d
[ 0.802309] [<ffffffff844fe c4d>] kernel_ init+0x6d/ 0xda
[ 0.802309] [<ffffffff84505 b2f>] ret_from_ fork+0x3f/ 0x70
[ 0.802309] [<ffffffff844fe be0>] ? rest_init+0x87/0x87
[ 0.830559] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[ 0.830559]
[ 0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000 000-0xffffffffb fffffff)
[ 0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
The crash part of this problem may be solved with the following patch
(thanks to Hugh for the hint). There is still another problem, though -
with this patch applied, the qemu session aborts with "VCPU Shutdown
request", whatever that means.
Cc: lepton <email address hidden>
Signed-off-by: Guenter Roeck <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
(cherry picked from commit b33c3c64c4786cd 724ccde6fa97c87 ada49f6a73 linux-4.4.y)
Signed-off-by: Juerg Haefliger <email address hidden>
Signed-off-by: Kleber Sacilotto de Souza <email address hidden>
e4f66c5...
by
Kleber Sacilotto de Souza
on 2018-01-16
UBUNTU: Start new release
Ignore: yes
Signed-off-by: Kleber Sacilotto de Souza <email address hidden>
44441ef...
by
Marcelo Cerri
on 2018-01-15
UBUNTU: Ubuntu- 3.13.0- 140.189
Signed-off-by: Marcelo Henrique Cerri <email address hidden>
dbebadc...
by
Marcelo Cerri
on 2018-01-15
UBUNTU: SAUCE: powerpc: no gmb() implementation yet
CVE-2017-5753
CVE-2017-5715
Signed-off-by: Marcelo Henrique Cerri <email address hidden>
b60c4a4...
by
Andy Whitcroft
on 2018-01-12
UBUNTU: SAUCE: arm: no gmb() implementation yet
CVE-2017-5753
CVE-2017-5715
Signed-off-by: Andy Whitcroft <email address hidden>
Signed-off-by: Marcelo Henrique Cerri <email address hidden>