Re: CVE-2016-10229: MSG_PEEK - URGENT patch needed

On Thu, 18 May 2017 17:41:58 -0500
Corey Wright <[email protected]> wrote:

> On Thu, 18 May 2017 21:42:57 +0100
> Ben Green <[email protected]> wrote:
> 
> > Quoting Ben Green <[email protected]>:
> > 
> > > I'm compiling 3.18.53-vs2.3.7.5 now.
> > >
> > > My scripts take care of [2] automatically, so I dropped in at no  
> > > errors other than offsets.
> > >
> > > Cheers,
> > > Ben
> > 
> > 3.18.53-vs2.3.7.5 is now in the repositories.
> > 
> > I'm also trying to build 4.1.39, but there's errors (build log attached).
> 
> based upon my initial investigation, it appears that the problem is
> that patch-4.1.36-37.xz did:
> 
> -int inode_change_ok(const struct inode *inode, struct iattr *attr)
> +int setattr_prepare(struct dentry *dentry, struct iattr *attr)
> 
> see
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.1.y&id=cb8e1eef351b640cfdb1a753ef44494fbf59186d
> for details.
> 
> the linux-vserver patch needs to be modified to use setattr_prepare()
> instead of inode_change_ok() and pass it dentry instead of inode
> (which is readily available being passed into __vc_set_iattr()).

patch attached to correct linux-4.1.39-vs2.3.8.5.2 source.

1. tar -xf linux-4.1.39.tar.xz
2. patch -d linux-4.1.39 -p1 <patch-4.1.35-vs2.3.8.5.2.diff
3. mv linux-4.1.39{,-vs2.3.8.5.2}
4. patch -d linux-4.1.39 -p1 <patch-4.1.35-37-vs2.3.8.5.2.diff
5. cd linux-4.1.39-vs2.3.8.5.2
6. make config
7. make

resulting kernel tested as per my usual process:
* testme.sh
* testfs.sh
* start, enter, & stop vserver guest
* start, enter (ie lxc-console & lxc-attach), & stop lxc guest
* run ansible playbook to install security updates in guests

corey
--
[email protected]

> corey
> --
> [email protected]
> 
> > Cheers,
> > Ben
>

Adjust to Linux 4.1.37 renaming inode_change_ok() to setattr_prepare()
and passing a dentry instead of an inode.

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.1.y&id=cb8e1eef351b640cfdb1a753ef44494fbf59186d
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.1.y&id=de42b9559d0c540152260d484dbc70b3e81f8738

diff -urNpd a/kernel/vserver/inode.c b/kernel/vserver/inode.c
--- a/kernel/vserver/inode.c	2017-05-18 18:04:18.257740191 -0500
+++ b/kernel/vserver/inode.c	2017-05-18 19:21:37.037799478 -0500
@@ -225,7 +225,7 @@ static int __vc_set_iattr(struct dentry
 		if (in->i_op && in->i_op->setattr)
 			error = in->i_op->setattr(de, &attr);
 		else {
-			error = inode_change_ok(in, &attr);
+			error = setattr_prepare(de, &attr);
 			if (!error) {
 				setattr_copy(in, &attr);
 				mark_inode_dirty(in);