update to kernel-3.10.0-327.4.5.el7.src.rpm

diff --git a/CVE-2016-0728-fix-keyring-ref-leak.patch b/CVE-2016-0728-fix-keyring-ref-leak.patch
deleted file mode 100644 (file)
index e915d82..0000000
--- a/CVE-2016-0728-fix-keyring-ref-leak.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 Mon Sep 17 00:00:00 2001
-From: Yevgeny Pats <yevgeny@perception-point.io>
-Date: Tue, 19 Jan 2016 22:09:04 +0000
-Subject: [PATCH] KEYS: Fix keyring ref leak in join_session_keyring()
-
-This fixes CVE-2016-0728.
-
-If a thread is asked to join as a session keyring the keyring that's already
-set as its session, we leak a keyring reference.
-
-This can be tested with the following program:
-
-       #include <stddef.h>
-       #include <stdio.h>
-       #include <sys/types.h>
-       #include <keyutils.h>
-
-       int main(int argc, const char *argv[])
-       {
-               int i = 0;
-               key_serial_t serial;
-
-               serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
-                               "leaked-keyring");
-               if (serial < 0) {
-                       perror("keyctl");
-                       return -1;
-               }
-
-               if (keyctl(KEYCTL_SETPERM, serial,
-                          KEY_POS_ALL | KEY_USR_ALL) < 0) {
-                       perror("keyctl");
-                       return -1;
-               }
-
-               for (i = 0; i < 100; i++) {
-                       serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
-                                       "leaked-keyring");
-                       if (serial < 0) {
-                               perror("keyctl");
-                               return -1;
-                       }
-               }
-
-               return 0;
-       }
-
-If, after the program has run, there something like the following line in
-/proc/keys:
-
-3f3d898f I--Q---   100 perm 3f3f0000     0     0 keyring   leaked-keyring: empty
-
-with a usage count of 100 * the number of times the program has been run,
-then the kernel is malfunctioning.  If leaked-keyring has zero usages or
-has been garbage collected, then the problem is fixed.
-
-Reported-by: Yevgeny Pats <yevgeny@perception-point.io>
-Signed-off-by: David Howells <dhowells@redhat.com>
-Acked-by: Don Zickus <dzickus@redhat.com>
-Acked-by: Prarit Bhargava <prarit@redhat.com>
-Acked-by: Jarod Wilson <jarod@redhat.com>
-Signed-off-by: James Morris <james.l.morris@oracle.com>
----
- security/keys/process_keys.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index a3f85d2a..e6d50172 100644
---- a/security/keys/process_keys.c
-+++ b/security/keys/process_keys.c
-@@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
-               ret = PTR_ERR(keyring);
-               goto error2;
-       } else if (keyring == new->session_keyring) {
-+              key_put(keyring);
-               ret = 0;
-               goto error2;
-       }

diff --git a/Makefile b/Makefile
index 072aecb1e9e7ff4a1ec36e96e656fdc663fee47b..f80d29bad02d3de8c64f5a782ca6002c603a9ddc 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,12 +1,12 @@
 RELEASE=3.4
 
 KERNEL_VER=3.10.0
-PKGREL=42
+PKGREL=43
 # also include firmware of previous versrion into 
 # the fw package:  fwlist-2.6.32-PREV-pve
 KREL=16
 
-RHKVER=327.4.4.el7
+RHKVER=327.4.5.el7
 
 KERNELSRCRPM=kernel-${KERNEL_VER}-${RHKVER}.src.rpm
 
@@ -193,8 +193,6 @@ ${KERNEL_SRC}/README: ${KERNEL_SRC}.org/README
        cp ${KERNEL_SRC}/drivers/vhost/scsi.c ${KERNEL_SRC}/drivers/vhost/scsi.c.backup 
        # vhost-scsi compile fixes
        cd ${KERNEL_SRC}; patch -p1 <../vhost-scsi-fixes.patch
-       # fix CVE-2016-0728
-       cd ${KERNEL_SRC}; patch -p1 <../CVE-2016-0728-fix-keyring-ref-leak.patch
        sed -i ${KERNEL_SRC}/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=${EXTRAVERSION}/'
        touch $@
 

diff --git a/changelog.Debian b/changelog.Debian
index 35c6b8f01ae2f40a4f4abeace7519f1af5da0203..8df7f3f938e89f581234790a8661c7d9c773c605 100644 (file)
--- a/changelog.Debian
+++ b/changelog.Debian
@@ -1,3 +1,11 @@
+pve-kernel-3.10.0 (3.10.0-43) unstable; urgency=low
+
+  * update to kernel-3.10.0-327.4.5.el7.src.rpm
+  
+  * remove CVE-2016-0728-fix-keyring-ref-leak.patch (upstream)
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 09 Feb 2016 17:45:35 +0100
+
 pve-kernel-3.10.0 (3.10.0-42) unstable; urgency=low
 
   * update to kernel-3.10.0-327.4.4.el7.src.rpm

diff --git a/kernel-3.10.0-327.4.4.el7.src.rpm b/kernel-3.10.0-327.4.4.el7.src.rpm
deleted file mode 100644 (file)
index 1c8d0f7..0000000
Binary files a/kernel-3.10.0-327.4.4.el7.src.rpm and /dev/null differ

diff --git a/kernel-3.10.0-327.4.5.el7.src.rpm b/kernel-3.10.0-327.4.5.el7.src.rpm
new file mode 100644 (file)
index 0000000..300437c
Binary files /dev/null and b/kernel-3.10.0-327.4.5.el7.src.rpm differ