Adding overwrapping VMA security fix, bug #72452.

4 files changed, 292 insertions, 18 deletions

diff --git a/sys-kernel/ac-sources/ChangeLog b/sys-kernel/ac-sources/ChangeLog
index ed3eb763c395..e73bcfec95e0 100644
--- a/sys-kernel/ac-sources/ChangeLog
+++ b/sys-kernel/ac-sources/ChangeLog
@@ -1,6 +1,10 @@
 # ChangeLog for sys-kernel/ac-sources
 # Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/ac-sources/ChangeLog,v 1.44 2004/11/28 00:12:39 lostlogic Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/ac-sources/ChangeLog,v 1.45 2004/12/03 20:11:26 plasmaroo Exp $
+
+  03 Dec 2004; <plasmaroo@gentoo.org> ac-sources-2.6.9-r12.ebuild,
+  +files/ac-sources-2.6.9.vma.patch:
+  Adding overwrapping VMA security fix, bug #72452.
 
 *ac-sources-2.6.9-r12 (27 Nov 2004)
 
diff --git a/sys-kernel/ac-sources/Manifest b/sys-kernel/ac-sources/Manifest
index 58731ce157f0..86ce8f99b2e8 100644
--- a/sys-kernel/ac-sources/Manifest
+++ b/sys-kernel/ac-sources/Manifest
@@ -1,22 +1,23 @@
-MD5 20608da4d63e3871e5bd144722bba374 ac-sources-2.6.9-r12.ebuild 1047
-MD5 c0c053ed0824614431987101ab4bf24d ac-sources-2.6.9-r6.ebuild 1046
+MD5 1d12419e42afe9f2d5bf44c396df9d87 ChangeLog 1692
+MD5 bdfad395e5db0239947540c7c97da8c1 ac-sources-2.6.9-r10.ebuild 1047
 MD5 2d0ac3655d40b781c84031301a780024 ac-sources-2.6.9-r1.ebuild 1091
 MD5 7b1073a9db1f527fe9a3395daedbc635 ac-sources-2.6.9-r8.ebuild 1046
-MD5 4112cf99cee9056a4e23fe5d5e075f3a ac-sources-2.6.9-r5.ebuild 1046
-MD5 3d01c0d70363ac20f04b6e16b3669550 ac-sources-2.6.9-r7.ebuild 1083
 MD5 2ce96c96088db3544980dcad624fa8f1 ac-sources-2.6.9-r2.ebuild 1046
-MD5 02668c9321fff84fc25dc90cd7035748 ChangeLog 1535
-MD5 2b0cfdcefc398952a818684668e808f1 metadata.xml 384
-MD5 bdfad395e5db0239947540c7c97da8c1 ac-sources-2.6.9-r10.ebuild 1047
 MD5 e502ce25770e74e2b621c08b6357ddbf ac-sources-2.6.9-r9.ebuild 1046
-MD5 508c49456dcb30096fe21b4619e9e8aa files/digest-ac-sources-2.6.9-r1 129
-MD5 cd09c274efab61c5d471a09ff36ff6af files/digest-ac-sources-2.6.9-r2 129
-MD5 1276cffcc9f684ea99c242316f8f4c0b files/digest-ac-sources-2.6.9-r5 129
-MD5 c615cce31b3bce3e255e497291bcd76f files/digest-ac-sources-2.6.9-r6 129
-MD5 ab11de7d3a6b41dc2d9889a0094c0012 files/digest-ac-sources-2.6.9-r7 129
-MD5 2d7e3663eacd4f3e8e96b6645e97ed91 files/digest-ac-sources-2.6.9-r8 129
+MD5 2b0cfdcefc398952a818684668e808f1 metadata.xml 384
+MD5 a371765079c2f571c1c90e1d33871d70 ac-sources-2.6.9-r12.ebuild 1075
+MD5 c0c053ed0824614431987101ab4bf24d ac-sources-2.6.9-r6.ebuild 1046
+MD5 4112cf99cee9056a4e23fe5d5e075f3a ac-sources-2.6.9-r5.ebuild 1046
+MD5 3d01c0d70363ac20f04b6e16b3669550 ac-sources-2.6.9-r7.ebuild 1083
+MD5 2c667e2fa7172f460e6e9c2699acded2 files/2.6.9-ac1-fix-extraversion.patch 1288
 MD5 57db481c11c638064759462051c41af6 files/digest-ac-sources-2.6.9-r9 129
+MD5 c615cce31b3bce3e255e497291bcd76f files/digest-ac-sources-2.6.9-r6 129
+MD5 0262502f5f3933de605488011f3b8211 files/digest-ac-sources-2.6.9-r12 131
+MD5 42b42f2a4f260fad2fef264b82aff2ae files/ac-sources-2.6.9.vma.patch 8952
 MD5 d9127fc038c80114d40b69d761803ed2 files/ac-sources-2.6.9.binfmt_elf.patch 1929
-MD5 2c667e2fa7172f460e6e9c2699acded2 files/2.6.9-ac1-fix-extraversion.patch 1288
+MD5 cd09c274efab61c5d471a09ff36ff6af files/digest-ac-sources-2.6.9-r2 129
 MD5 88135e20957a282cf6212fd5b09f0593 files/digest-ac-sources-2.6.9-r10 131
-MD5 0262502f5f3933de605488011f3b8211 files/digest-ac-sources-2.6.9-r12 131
+MD5 508c49456dcb30096fe21b4619e9e8aa files/digest-ac-sources-2.6.9-r1 129
+MD5 ab11de7d3a6b41dc2d9889a0094c0012 files/digest-ac-sources-2.6.9-r7 129
+MD5 2d7e3663eacd4f3e8e96b6645e97ed91 files/digest-ac-sources-2.6.9-r8 129
+MD5 1276cffcc9f684ea99c242316f8f4c0b files/digest-ac-sources-2.6.9-r5 129
diff --git a/sys-kernel/ac-sources/ac-sources-2.6.9-r12.ebuild b/sys-kernel/ac-sources/ac-sources-2.6.9-r12.ebuild
index 1b1d44b94e5c..bbe09219f96a 100644
--- a/sys-kernel/ac-sources/ac-sources-2.6.9-r12.ebuild
+++ b/sys-kernel/ac-sources/ac-sources-2.6.9-r12.ebuild
@@ -1,8 +1,9 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/ac-sources/ac-sources-2.6.9-r12.ebuild,v 1.1 2004/11/28 00:12:39 lostlogic Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/ac-sources/ac-sources-2.6.9-r12.ebuild,v 1.2 2004/12/03 20:11:26 plasmaroo Exp $
 
-UNIPATCH_LIST="${DISTDIR}/patch-${KV}.bz2"
+UNIPATCH_LIST="${DISTDIR}/patch-${KV}.bz2
+	${FILESDIR}/${P}.vma.patch"
 K_PREPATCHED="yes"
 UNIPATCH_STRICTORDER="yes"
 
diff --git a/sys-kernel/ac-sources/files/ac-sources-2.6.9.vma.patch b/sys-kernel/ac-sources/files/ac-sources-2.6.9.vma.patch
new file mode 100644
index 000000000000..a335bfc2e269
--- /dev/null
+++ b/sys-kernel/ac-sources/files/ac-sources-2.6.9.vma.patch
@@ -0,0 +1,268 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/11/25 16:00:28-08:00 nanhai.zou@intel.com 
+#   [PATCH] ia64/x86_64/s390 overlapping vma fix
+#   
+#   IA64 is also vulnerable to the huge-vma-in-executable bug in 64 bit elf
+#   support, it just insert a vma of zero page without checking overlap, so user
+#   can construct a elf with section begin from 0x0 to trigger this BUGON().
+#   
+#   However, I think it's safe to check overlap before we actually insert a vma
+#   into vma list.  And I also feel check vma overlap everywhere is unnecessary,
+#   because invert_vm_struct will check it again, so the check is duplicated.
+#   It's better to have invert_vm_struct return a value then let caller check if
+#   it successes.  Here is a patch against 2.6.10.rc2-mm3 I have tested it on
+#   i386, x86_64 and ia64 machines.
+#   
+#   Signed-off-by: Tony Luck <tony.luck@intel.com>
+#   Signed-off-by: Zou Nan hai <Nanhai.zou@intel.com>
+#   Signed-off-by: Andrew Morton <akpm@osdl.org>
+#   Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+# 
+# arch/ia64/ia32/binfmt_elf32.c
+#   2004/11/24 22:42:43-08:00 nanhai.zou@intel.com +21 -5
+#   ia64/x86_64/s390 overlapping vma fix
+# 
+# arch/ia64/mm/init.c
+#   2004/11/24 22:42:43-08:00 nanhai.zou@intel.com +14 -2
+#   ia64/x86_64/s390 overlapping vma fix
+# 
+# arch/s390/kernel/compat_exec.c
+#   2004/11/24 22:42:43-08:00 nanhai.zou@intel.com +6 -2
+#   ia64/x86_64/s390 overlapping vma fix
+# 
+# arch/x86_64/ia32/ia32_binfmt.c
+#   2004/11/24 22:42:43-08:00 nanhai.zou@intel.com +6 -2
+#   ia64/x86_64/s390 overlapping vma fix
+# 
+# fs/exec.c
+#   2004/11/24 22:42:43-08:00 nanhai.zou@intel.com +3 -6
+#   ia64/x86_64/s390 overlapping vma fix
+# 
+# include/linux/mm.h
+#   2004/11/24 22:42:43-08:00 nanhai.zou@intel.com +1 -1
+#   ia64/x86_64/s390 overlapping vma fix
+# 
+# mm/mmap.c
+#   2004/11/24 22:42:43-08:00 nanhai.zou@intel.com +3 -2
+#   ia64/x86_64/s390 overlapping vma fix
+# 
+diff -Nru a/arch/ia64/ia32/binfmt_elf32.c b/arch/ia64/ia32/binfmt_elf32.c
+--- a/arch/ia64/ia32/binfmt_elf32.c	2004-12-03 12:01:20 -08:00
++++ b/arch/ia64/ia32/binfmt_elf32.c	2004-12-03 12:01:20 -08:00
+@@ -100,7 +100,11 @@
+ 		vma->vm_ops = &ia32_shared_page_vm_ops;
+ 		down_write(&current->mm->mmap_sem);
+ 		{
+-			insert_vm_struct(current->mm, vma);
++			if (insert_vm_struct(current->mm, vma)) {
++				kmem_cache_free(vm_area_cachep, vma);
++				up_write(&current->mm->mmap_sem);
++				return;
++			}
+ 		}
+ 		up_write(&current->mm->mmap_sem);
+ 	}
+@@ -123,7 +127,11 @@
+ 		vma->vm_ops = &ia32_gate_page_vm_ops;
+ 		down_write(&current->mm->mmap_sem);
+ 		{
+-			insert_vm_struct(current->mm, vma);
++			if (insert_vm_struct(current->mm, vma)) {
++				kmem_cache_free(vm_area_cachep, vma);
++				up_write(&current->mm->mmap_sem);
++				return;
++			}
+ 		}
+ 		up_write(&current->mm->mmap_sem);
+ 	}
+@@ -142,7 +150,11 @@
+ 		vma->vm_flags = VM_READ|VM_WRITE|VM_MAYREAD|VM_MAYWRITE;
+ 		down_write(&current->mm->mmap_sem);
+ 		{
+-			insert_vm_struct(current->mm, vma);
++			if (insert_vm_struct(current->mm, vma)) {
++				kmem_cache_free(vm_area_cachep, vma);
++				up_write(&current->mm->mmap_sem);
++				return;
++			}
+ 		}
+ 		up_write(&current->mm->mmap_sem);
+ 	}
+@@ -190,7 +202,7 @@
+ 	unsigned long stack_base;
+ 	struct vm_area_struct *mpnt;
+ 	struct mm_struct *mm = current->mm;
+-	int i;
++	int i, ret;
+ 
+ 	stack_base = IA32_STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
+ 	mm->arg_start = bprm->p + stack_base;
+@@ -225,7 +237,11 @@
+ 			mpnt->vm_flags = VM_STACK_FLAGS;
+ 		mpnt->vm_page_prot = (mpnt->vm_flags & VM_EXEC)?
+ 					PAGE_COPY_EXEC: PAGE_COPY;
+-		insert_vm_struct(current->mm, mpnt);
++		if ((ret = insert_vm_struct(current->mm, mpnt))) {
++			up_write(&current->mm->mmap_sem);
++			kmem_cache_free(vm_area_cachep, mpnt);
++			return ret;
++		}
+ 		current->mm->stack_vm = current->mm->total_vm = vma_pages(mpnt);
+ 	}
+ 
+diff -Nru a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
+--- a/arch/ia64/mm/init.c	2004-12-03 12:01:20 -08:00
++++ b/arch/ia64/mm/init.c	2004-12-03 12:01:20 -08:00
+@@ -131,7 +131,13 @@
+ 		vma->vm_end = vma->vm_start + PAGE_SIZE;
+ 		vma->vm_page_prot = protection_map[VM_DATA_DEFAULT_FLAGS & 0x7];
+ 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS | VM_GROWSUP;
+-		insert_vm_struct(current->mm, vma);
++		down_write(&current->mm->mmap_sem);
++		if (insert_vm_struct(current->mm, vma)) {
++			up_write(&current->mm->mmap_sem);
++			kmem_cache_free(vm_area_cachep, vma);
++			return;
++		}
++		up_write(&current->mm->mmap_sem);
+ 	}
+ 
+ 	/* map NaT-page at address zero to speed up speculative dereferencing of NULL: */
+@@ -143,7 +149,13 @@
+ 			vma->vm_end = PAGE_SIZE;
+ 			vma->vm_page_prot = __pgprot(pgprot_val(PAGE_READONLY) | _PAGE_MA_NAT);
+ 			vma->vm_flags = VM_READ | VM_MAYREAD | VM_IO | VM_RESERVED;
+-			insert_vm_struct(current->mm, vma);
++			down_write(&current->mm->mmap_sem);
++			if (insert_vm_struct(current->mm, vma)) {
++				up_write(&current->mm->mmap_sem);
++				kmem_cache_free(vm_area_cachep, vma);
++				return;
++			}
++			up_write(&current->mm->mmap_sem);
+ 		}
+ 	}
+ }
+diff -Nru a/arch/s390/kernel/compat_exec.c b/arch/s390/kernel/compat_exec.c
+--- a/arch/s390/kernel/compat_exec.c	2004-12-03 12:01:20 -08:00
++++ b/arch/s390/kernel/compat_exec.c	2004-12-03 12:01:20 -08:00
+@@ -39,7 +39,7 @@
+ 	unsigned long stack_base;
+ 	struct vm_area_struct *mpnt;
+ 	struct mm_struct *mm = current->mm;
+-	int i;
++	int i, ret;
+ 
+ 	stack_base = STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
+ 	mm->arg_start = bprm->p + stack_base;
+@@ -68,7 +68,11 @@
+ 		/* executable stack setting would be applied here */
+ 		mpnt->vm_page_prot = PAGE_COPY;
+ 		mpnt->vm_flags = VM_STACK_FLAGS;
+-		insert_vm_struct(mm, mpnt);
++		if ((ret = insert_vm_struct(mm, mpnt))) {
++			up_write(&mm->mmap_sem);
++			kmem_cache_free(vm_area_cachep, mpnt);
++			return ret;
++		}
+ 		mm->stack_vm = mm->total_vm = vma_pages(mpnt);
+ 	} 
+ 
+diff -Nru a/arch/x86_64/ia32/ia32_binfmt.c b/arch/x86_64/ia32/ia32_binfmt.c
+--- a/arch/x86_64/ia32/ia32_binfmt.c	2004-12-03 12:01:20 -08:00
++++ b/arch/x86_64/ia32/ia32_binfmt.c	2004-12-03 12:01:20 -08:00
+@@ -334,7 +334,7 @@
+ 	unsigned long stack_base;
+ 	struct vm_area_struct *mpnt;
+ 	struct mm_struct *mm = current->mm;
+-	int i;
++	int i, ret;
+ 
+ 	stack_base = IA32_STACK_TOP - MAX_ARG_PAGES * PAGE_SIZE;
+ 	mm->arg_start = bprm->p + stack_base;
+@@ -368,7 +368,11 @@
+ 			mpnt->vm_flags = VM_STACK_FLAGS;
+  		mpnt->vm_page_prot = (mpnt->vm_flags & VM_EXEC) ? 
+  			PAGE_COPY_EXEC : PAGE_COPY;
+-		insert_vm_struct(mm, mpnt);
++		if ((ret = insert_vm_struct(mm, mpnt))) {
++			up_write(&mm->mmap_sem);
++			kmem_cache_free(vm_area_cachep, mpnt);
++			return ret;
++		}
+ 		mm->stack_vm = mm->total_vm = vma_pages(mpnt);
+ 	} 
+ 
+diff -Nru a/fs/exec.c b/fs/exec.c
+--- a/fs/exec.c	2004-12-03 12:01:20 -08:00
++++ b/fs/exec.c	2004-12-03 12:01:20 -08:00
+@@ -342,7 +342,7 @@
+ 	unsigned long stack_base;
+ 	struct vm_area_struct *mpnt;
+ 	struct mm_struct *mm = current->mm;
+-	int i;
++	int i, ret;
+ 	long arg_size;
+ 
+ #ifdef CONFIG_STACK_GROWSUP
+@@ -413,7 +413,6 @@
+ 
+ 	down_write(&mm->mmap_sem);
+ 	{
+-		struct vm_area_struct *vma;
+ 		mpnt->vm_mm = mm;
+ #ifdef CONFIG_STACK_GROWSUP
+ 		mpnt->vm_start = stack_base;
+@@ -434,13 +433,11 @@
+ 			mpnt->vm_flags = VM_STACK_FLAGS;
+ 		mpnt->vm_flags |= mm->def_flags;
+ 		mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7];
+-		vma = find_vma(mm, mpnt->vm_start);
+-		if (vma) {
++		if ((ret = insert_vm_struct(mm, mpnt))) {
+ 			up_write(&mm->mmap_sem);
+ 			kmem_cache_free(vm_area_cachep, mpnt);
+-			return -ENOMEM;
++			return ret;
+ 		}
+-		insert_vm_struct(mm, mpnt);
+ 		mm->stack_vm = mm->total_vm = vma_pages(mpnt);
+ 	}
+ 
+diff -Nru a/include/linux/mm.h b/include/linux/mm.h
+--- a/include/linux/mm.h	2004-12-03 12:01:20 -08:00
++++ b/include/linux/mm.h	2004-12-03 12:01:20 -08:00
+@@ -675,7 +675,7 @@
+ extern struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *);
+ extern int split_vma(struct mm_struct *,
+ 	struct vm_area_struct *, unsigned long addr, int new_below);
+-extern void insert_vm_struct(struct mm_struct *, struct vm_area_struct *);
++extern int insert_vm_struct(struct mm_struct *, struct vm_area_struct *);
+ extern void __vma_link_rb(struct mm_struct *, struct vm_area_struct *,
+ 	struct rb_node **, struct rb_node *);
+ extern struct vm_area_struct *copy_vma(struct vm_area_struct **,
+diff -Nru a/mm/mmap.c b/mm/mmap.c
+--- a/mm/mmap.c	2004-12-03 12:01:20 -08:00
++++ b/mm/mmap.c	2004-12-03 12:01:20 -08:00
+@@ -1871,7 +1871,7 @@
+  * and into the inode's i_mmap tree.  If vm_file is non-NULL
+  * then i_mmap_lock is taken here.
+  */
+-void insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
++int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
+ {
+ 	struct vm_area_struct * __vma, * prev;
+ 	struct rb_node ** rb_link, * rb_parent;
+@@ -1894,8 +1894,9 @@
+ 	}
+ 	__vma = find_vma_prepare(mm,vma->vm_start,&prev,&rb_link,&rb_parent);
+ 	if (__vma && __vma->vm_start < vma->vm_end)
+-		BUG();
++		return -ENOMEM;
+ 	vma_link(mm, vma, prev, rb_link, rb_parent);
++	return 0;
+ }
+ 
+ /*