Linux 5.18.19
Greg Kroah-Hartman
maintainerNote, this is the LAST 5.18.y kernel to be released. This branch is now end-of-life. Please move to 5.19.y at this point in time.
I'm announcing the release of the 5.18.19 kernel.
All users of the 5.18 kernel series must upgrade.
The updated 5.18.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.18.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 - arch/arm64/kernel/kexec_image.c | 11 ----- arch/x86/kernel/kexec-bzimage64.c | 20 ---------- drivers/tee/tee_shm.c | 3 + fs/btrfs/raid56.c | 74 +++++++++++++++++++++++++++++--------- include/linux/kexec.h | 7 +++ kernel/kexec_file.c | 17 ++++++++ net/sched/cls_route.c | 10 +++++ 8 files changed, 97 insertions(+), 47 deletions(-)
Coiby Xu (2):
kexec, KEYS: make the code in bzImage64_verify_sig generic
arm64: kexec_file: use more system keyrings to verify kernel image signature
Greg Kroah-Hartman (1):
Linux 5.18.19
Jamal Hadi Salim (1):
net_sched: cls_route: disallow handle of 0
Jens Wiklander (1):
tee: add overflow check in register_shm_helper()
Qu Wenruo (2):
btrfs: only write the sectors in the vertical stripe which has data stripes
btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 18 -SUBLEVEL = 18 +SUBLEVEL = 19 EXTRAVERSION = NAME = Superb Owl
arch/arm64/kernel/kexec_image.c +1 -10
@@ -14,7 +14,6 @@#include <linux/kexec.h> #include <linux/pe.h> #include <linux/string.h> -#include <linux/verification.h> #include <asm/byteorder.h> #include <asm/cpufeature.h> #include <asm/image.h>
@@ -130,18 +129,10 @@ static void *image_load(struct kimage *image,return NULL ; } -#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG -static int image_verify_sig (const char *kernel,unsigned long kernel_len) -{ -return verify_pefile_signature (kernel, kernel_len,NULL , -VERIFYING_KEXEC_PE_SIGNATURE ); -} -#endif -const struct kexec_file_ops kexec_image_ops = { .probe = image_probe, .load = image_load, #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG - .verify_sig = image_verify_sig, + .verify_sig = kexec_kernel_verify_pe_sig, #endif };
arch/x86/kernel/kexec-bzimage64.c +1 -19
@@ -17,7 +17,6 @@#include <linux/kernel.h> #include <linux/mm.h> #include <linux/efi.h> -#include <linux/verification.h> #include <asm/bootparam.h> #include <asm/setup.h>
@@ -528,28 +527,11 @@ static int bzImage64_cleanup(void *loader_data)return 0 ; } -#ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG -static int bzImage64_verify_sig (const char *kernel,unsigned long kernel_len) -{ -int ret; - - ret =verify_pefile_signature (kernel, kernel_len, -VERIFY_USE_SECONDARY_KEYRING , -VERIFYING_KEXEC_PE_SIGNATURE ); -if (ret == -ENOKEY &&IS_ENABLED (CONFIG_INTEGRITY_PLATFORM_KEYRING )) { - ret =verify_pefile_signature (kernel, kernel_len, -VERIFY_USE_PLATFORM_KEYRING , -VERIFYING_KEXEC_PE_SIGNATURE ); - } -return ret; -} -#endif -const struct kexec_file_ops kexec_bzImage64_ops = { .probe = bzImage64_probe, .load = bzImage64_load, .cleanup = bzImage64_cleanup, #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG - .verify_sig = bzImage64_verify_sig, + .verify_sig = kexec_kernel_verify_pe_sig, #endif };
drivers/tee/tee_shm.c +3 -0
@@ -311,6 +311,9 @@ struct tee_shm *tee_shm_register_user_buf(struct tee_context *ctx,void *ret;int id; +if (!access_ok ((void __user *)addr, length)) +return ERR_PTR (-EFAULT ); +mutex_lock (&teedev->mutex); id =idr_alloc (&teedev->idr,NULL ,1 ,0 ,GFP_KERNEL );mutex_unlock (&teedev->mutex);
fs/btrfs/raid56.c +57 -17
135 lines not on this page · raw message
include/linux/kexec.h +7 -0
@@ -19,6 +19,7 @@#include <asm/io.h> #include <uapi/linux/kexec.h> +#include <linux/verification.h> /* Location of a reserved region to hold the crash kernel. */
@@ -212,6 +213,12 @@ static inline void *arch_kexec_kernel_image_load(struct kimage *image) }#endif +#ifdef CONFIG_KEXEC_SIG +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION +int kexec_kernel_verify_pe_sig (const char *kernel,unsigned long kernel_len); +#endif +#endif +extern int kexec_add_buffer (struct kexec_buf *kbuf);int kexec_locate_mem_hole (struct kexec_buf *kbuf);
kernel/kexec_file.c +17 -0
@@ -123,6 +123,23 @@ void kimage_file_post_load_cleanup(struct kimage *image) }#ifdef CONFIG_KEXEC_SIG +#ifdef CONFIG_SIGNED_PE_FILE_VERIFICATION +int kexec_kernel_verify_pe_sig (const char *kernel,unsigned long kernel_len) +{ +int ret; + + ret =verify_pefile_signature (kernel, kernel_len, +VERIFY_USE_SECONDARY_KEYRING , +VERIFYING_KEXEC_PE_SIGNATURE ); +if (ret == -ENOKEY &&IS_ENABLED (CONFIG_INTEGRITY_PLATFORM_KEYRING )) { + ret =verify_pefile_signature (kernel, kernel_len, +VERIFY_USE_PLATFORM_KEYRING , +VERIFYING_KEXEC_PE_SIGNATURE ); + } +return ret; +} +#endif +static int kexec_image_verify_sig (struct kimage *image,void *buf,unsigned long buf_len) {
net/sched/cls_route.c +10 -0
@@ -424,6 +424,11 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp,return -EINVAL ; } +if (!nhandle) { +NL_SET_ERR_MSG (extack,"Replacing with handle of 0 is invalid" ); +return -EINVAL ; + } + h1 =to_hash (nhandle); b =rtnl_dereference (head->table[h1]);if (!b) {
@@ -477,6 +482,11 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,int err;bool new = true; +if (!handle) { +NL_SET_ERR_MSG (extack,"Creating with handle of 0 is invalid" ); +return -EINVAL ; + } +if (opt ==NULL )return handle ? -EINVAL :0 ;