diff --git a/ASLR-fix-stack-randomization-on-64-bit-systems.patch b/ASLR-fix-stack-randomization-on-64-bit-systems.patch deleted file mode 100644 index b382815f8..000000000 --- a/ASLR-fix-stack-randomization-on-64-bit-systems.patch +++ /dev/null @@ -1,104 +0,0 @@ -From: Hector Marco-Gisbert -Date: Sat, 14 Feb 2015 09:33:50 -0800 -Subject: [PATCH] ASLR: fix stack randomization on 64-bit systems - -The issue is that the stack for processes is not properly randomized on 64 bit -architectures due to an integer overflow. - -The affected function is randomize_stack_top() in file "fs/binfmt_elf.c": - -static unsigned long randomize_stack_top(unsigned long stack_top) -{ - unsigned int random_variable = 0; - - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { - random_variable = get_random_int() & STACK_RND_MASK; - random_variable <<= PAGE_SHIFT; - } - return PAGE_ALIGN(stack_top) + random_variable; - return PAGE_ALIGN(stack_top) - random_variable; -} - -Note that, it declares the "random_variable" variable as "unsigned int". Since -the result of the shifting operation between STACK_RND_MASK (which is -0x3fffff on x86_64, 22 bits) and PAGE_SHIFT (which is 12 on x86_64): - -random_variable <<= PAGE_SHIFT; - -then the two leftmost bits are dropped when storing the result in the -"random_variable". This variable shall be at least 34 bits long to hold the -(22+12) result. - -These two dropped bits have an impact on the entropy of process stack. -Concretely, the total stack entropy is reduced by four: from 2^28 to 2^30 (One -fourth of expected entropy). - -This patch restores back the entropy by correcting the types involved in the -operations in the functions randomize_stack_top() and stack_maxrandom_size(). - -The successful fix can be tested with: -$ for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done -7ffeda566000-7ffeda587000 rw-p 00000000 00:00 0 [stack] -7fff5a332000-7fff5a353000 rw-p 00000000 00:00 0 [stack] -7ffcdb7a1000-7ffcdb7c2000 rw-p 00000000 00:00 0 [stack] -7ffd5e2c4000-7ffd5e2e5000 rw-p 00000000 00:00 0 [stack] -... - -Once corrected, the leading bytes should be between 7ffc and 7fff, rather -than always being 7fff. - -CVE-2015-1593 - -Signed-off-by: Hector Marco-Gisbert -Signed-off-by: Ismael Ripoll -[kees: rebase, fix 80 char, clean up commit message, add test example, cve] -Signed-off-by: Kees Cook -Cc: stable@vger.kernel.org ---- - arch/x86/mm/mmap.c | 6 +++--- - fs/binfmt_elf.c | 5 +++-- - 2 files changed, 6 insertions(+), 5 deletions(-) - -diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c -index 919b91205cd4..df4552bd239e 100644 ---- a/arch/x86/mm/mmap.c -+++ b/arch/x86/mm/mmap.c -@@ -35,12 +35,12 @@ struct va_alignment __read_mostly va_align = { - .flags = -1, - }; - --static unsigned int stack_maxrandom_size(void) -+static unsigned long stack_maxrandom_size(void) - { -- unsigned int max = 0; -+ unsigned long max = 0; - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { -- max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT; -+ max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT; - } - - return max; -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 02b16910f4c9..995986b8e36b 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -645,11 +645,12 @@ out: - - static unsigned long randomize_stack_top(unsigned long stack_top) - { -- unsigned int random_variable = 0; -+ unsigned long random_variable = 0; - - if ((current->flags & PF_RANDOMIZE) && - !(current->personality & ADDR_NO_RANDOMIZE)) { -- random_variable = get_random_int() & STACK_RND_MASK; -+ random_variable = (unsigned long) get_random_int(); -+ random_variable &= STACK_RND_MASK; - random_variable <<= PAGE_SHIFT; - } - #ifdef CONFIG_STACK_GROWSUP --- -2.1.0 - diff --git a/Add-option-to-automatically-enforce-module-signature.patch b/Add-option-to-automatically-enforce-module-signature.patch index 4f251711c..8f9122481 100644 --- a/Add-option-to-automatically-enforce-module-signature.patch +++ b/Add-option-to-automatically-enforce-module-signature.patch @@ -20,7 +20,7 @@ Signed-off-by: Matthew Garrett 7 files changed, 69 insertions(+), 1 deletion(-) diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt -index 199f453cb4de..ec38acf00b40 100644 +index 82fbdbc1e0b0..a811210ad486 100644 --- a/Documentation/x86/zero-page.txt +++ b/Documentation/x86/zero-page.txt @@ -30,6 +30,8 @@ Offset Proto Name Meaning @@ -33,10 +33,10 @@ index 199f453cb4de..ec38acf00b40 100644 290/040 ALL edd_mbr_sig_buffer EDD MBR signatures 2D0/A00 ALL e820_map E820 memory map table diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index eb1cf898ed3c..a2a0a1636287 100644 +index c2fb8a87dccb..0ec6272203e4 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig -@@ -1678,6 +1678,16 @@ config EFI_MIXED +@@ -1694,6 +1694,16 @@ config EFI_MIXED If unsure, say N. @@ -115,10 +115,10 @@ index ef17683484e9..105e7360d747 100644 setup_efi_pci(boot_params); diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h -index 225b0988043a..90dbfb73e11f 100644 +index 44e6dd7e36a2..3ddf4150bd9e 100644 --- a/arch/x86/include/uapi/asm/bootparam.h +++ b/arch/x86/include/uapi/asm/bootparam.h -@@ -133,7 +133,8 @@ struct boot_params { +@@ -134,7 +134,8 @@ struct boot_params { __u8 eddbuf_entries; /* 0x1e9 */ __u8 edd_mbr_sig_buf_entries; /* 0x1ea */ __u8 kbd_status; /* 0x1eb */ @@ -129,10 +129,10 @@ index 225b0988043a..90dbfb73e11f 100644 * The sentinel is set to a nonzero value (0xff) in header.S. * diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 0a2421cca01f..a3d8174dedf9 100644 +index 98dc9317286e..26741d24797e 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c -@@ -1151,6 +1151,12 @@ void __init setup_arch(char **cmdline_p) +@@ -1165,6 +1165,12 @@ void __init setup_arch(char **cmdline_p) io_delay_init(); diff --git a/Add-sysrq-option-to-disable-secure-boot-mode.patch b/Add-sysrq-option-to-disable-secure-boot-mode.patch index 76b493bb3..a22af8297 100644 --- a/Add-sysrq-option-to-disable-secure-boot-mode.patch +++ b/Add-sysrq-option-to-disable-secure-boot-mode.patch @@ -15,7 +15,7 @@ Upstream-status: Fedora mustard 7 files changed, 65 insertions(+), 10 deletions(-) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 26c5d54124c1..dab298f03a9c 100644 +index 64a123acb97f..2964c69e7c8e 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -70,6 +70,11 @@ @@ -30,7 +30,7 @@ index 26c5d54124c1..dab298f03a9c 100644 #include