add fix for CVE-2014-0196

diff --git a/Makefile b/Makefile
index fe10cff152deb59a4529b5ce0b8f2bbe50d8f873..ca4ecab8854db8ffec6644a3e62f2646ffafd2f8 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 RELEASE=3.2
 
 KERNEL_VER=3.10.0
-PKGREL=9
+PKGREL=10
 # also include firmware of previous versrion into 
 # the fw package:  fwlist-2.6.32-PREV-pve
 KREL=2
@@ -147,6 +147,7 @@ ${KERNEL_SRC}/README: ${KERNEL_SRC}.org/README
        #cd ${KERNEL_SRC}; patch -p1 <../add-tiocgdev-ioctl.patch
        #cd ${KERNEL_SRC}; patch -p1 <../fix-nfs-block-count.patch
        #cd ${KERNEL_SRC}; patch -p1 <../fix-idr-header-for-drbd-compilation.patch
+       cd ${KERNEL_SRC}; patch -p1 <../n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
        sed -i ${KERNEL_SRC}/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=${EXTRAVERSION}/'
        touch $@
 

diff --git a/changelog.Debian b/changelog.Debian
index d38e10d9c87d891c5593ca630f6a2d04cd6df8a3..8346e4cc366617cf61f08e0cf4ac3c5171c8a882 100644 (file)
--- a/changelog.Debian
+++ b/changelog.Debian
@@ -1,3 +1,9 @@
+pve-kernel-3.10.0 (3.10.0-10) unstable; urgency=low
+
+  * add fix for CVE-2014-0196
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 13 May 2014 07:06:37 +0200
+
 pve-kernel-3.10.0 (3.10.0-9) unstable; urgency=low
 
   * enable BCACHE

diff --git a/n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch b/n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
new file mode 100644 (file)
index 0000000..3d837a8
--- /dev/null
+++ b/n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
@@ -0,0 +1,78 @@
+From: Peter Hurley <peter@hurleysoftware.com>\r
+\r
+commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.\r
+\r
+The tty atomic_write_lock does not provide an exclusion guarantee for\r
+the tty driver if the termios settings are LECHO & !OPOST.  And since\r
+it is unexpected and not allowed to call TTY buffer helpers like\r
+tty_insert_flip_string concurrently, this may lead to crashes when\r
+concurrect writers call pty_write. In that case the following two\r
+writers:\r
+* the ECHOing from a workqueue and\r
+* pty_write from the process\r
+race and can overflow the corresponding TTY buffer like follows.\r
+\r
+If we look into tty_insert_flip_string_fixed_flag, there is:\r
+  int space = __tty_buffer_request_room(port, goal, flags);\r
+  struct tty_buffer *tb = port->buf.tail;\r
+  ...\r
+  memcpy(char_buf_ptr(tb, tb->used), chars, space);\r
+  ...\r
+  tb->used += space;\r
+\r
+so the race of the two can result in something like this:\r
+              A                                B\r
+__tty_buffer_request_room\r
+                                  __tty_buffer_request_room\r
+memcpy(buf(tb->used), ...)\r
+tb->used += space;\r
+                                  memcpy(buf(tb->used), ...) ->BOOM\r
+\r
+B's memcpy is past the tty_buffer due to the previous A's tb->used\r
+increment.\r
+\r
+Since the N_TTY line discipline input processing can output\r
+concurrently with a tty write, obtain the N_TTY ldisc output_lock to\r
+serialize echo output with normal tty writes.  This ensures the tty\r
+buffer helper tty_insert_flip_string is not called concurrently and\r
+everything is fine.\r
+\r
+Note that this is nicely reproducible by an ordinary user using\r
+forkpty and some setup around that (raw termios + ECHO). And it is\r
+present in kernels at least after commit\r
+d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to\r
+use the normal buffering logic) in 2.6.31-rc3.\r
+\r
+js: add more info to the commit log\r
+js: switch to bool\r
+js: lock unconditionally\r
+js: lock only the tty->ops->write call\r
+\r
+References: CVE-2014-0196\r
+Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>\r
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>\r
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>\r
+Cc: Linus Torvalds <torvalds@linux-foundation.org>\r
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>\r
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\r
+\r
+---\r
+ drivers/tty/n_tty.c |    4 ++++\r
+ 1 file changed, 4 insertions(+)\r
+\r
+--- a/drivers/tty/n_tty.c\r
++++ b/drivers/tty/n_tty.c\r
+@@ -2066,8 +2066,12 @@ static ssize_t n_tty_write(struct tty_st\r
+                       if (tty->ops->flush_chars)\r
+                               tty->ops->flush_chars(tty);\r
+               } else {\r
++                      struct n_tty_data *ldata = tty->disc_data;\r
++\r
+                       while (nr > 0) {\r
++                              mutex_lock(&ldata->output_lock);\r
+                               c = tty->ops->write(tty, b, nr);\r
++                              mutex_unlock(&ldata->output_lock);\r
+                               if (c < 0) {\r
+                                       retval = c;\r
+                                       goto break_out;\r
+\r