upgpkg: libre/linux-libre 5.0.2_gnu-1

Signed-off-by: David P <megver83@parabola.nu>

5 files changed, 144 insertions, 62 deletions

diff --git a/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch b/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
index c271a555b..c6b567471 100644
--- a/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
+++ b/libre/linux-libre/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
@@ -1,4 +1,4 @@
-From daf814968caf9f6b6b9f208964d2accdae8a0ea9 Mon Sep 17 00:00:00 2001
+From e71668257d1353a7bd428ec90f0871b038db813b Mon Sep 17 00:00:00 2001
 From: Serge Hallyn <serge.hallyn@canonical.com>
 Date: Fri, 31 May 2013 19:12:12 +0100
 Subject: [PATCH 1/2] add sysctl to disallow unprivileged CLONE_NEWUSER by
diff --git a/libre/linux-libre/0002-exec-Fix-mem-leak-in-kernel_read_file.patch b/libre/linux-libre/0002-exec-Fix-mem-leak-in-kernel_read_file.patch
deleted file mode 100644
index dd68baeab..000000000
--- a/libre/linux-libre/0002-exec-Fix-mem-leak-in-kernel_read_file.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 991d1205762f0ad463c54190242a8b421879f7d3 Mon Sep 17 00:00:00 2001
-From: YueHaibing <yuehaibing@huawei.com>
-Date: Tue, 19 Feb 2019 10:10:38 +0800
-Subject: [PATCH 2/2] exec: Fix mem leak in kernel_read_file
-
-syzkaller report this:
-BUG: memory leak
-unreferenced object 0xffffc9000488d000 (size 9195520):
-  comm "syz-executor.0", pid 2752, jiffies 4294787496 (age 18.757s)
-  hex dump (first 32 bytes):
-    ff ff ff ff ff ff ff ff a8 00 00 00 01 00 00 00  ................
-    02 00 00 00 00 00 00 00 80 a1 7a c1 ff ff ff ff  ..........z.....
-  backtrace:
-    [<000000000863775c>] __vmalloc_node mm/vmalloc.c:1795 [inline]
-    [<000000000863775c>] __vmalloc_node_flags mm/vmalloc.c:1809 [inline]
-    [<000000000863775c>] vmalloc+0x8c/0xb0 mm/vmalloc.c:1831
-    [<000000003f668111>] kernel_read_file+0x58f/0x7d0 fs/exec.c:924
-    [<000000002385813f>] kernel_read_file_from_fd+0x49/0x80 fs/exec.c:993
-    [<0000000011953ff1>] __do_sys_finit_module+0x13b/0x2a0 kernel/module.c:3895
-    [<000000006f58491f>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
-    [<00000000ee78baf4>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
-    [<00000000241f889b>] 0xffffffffffffffff
-
-It should goto 'out_free' lable to free allocated buf while kernel_read
-fails.
-
-Fixes: 39d637af5aa7 ("vfs: forbid write access when reading a file into memory")
-Signed-off-by: YueHaibing <yuehaibing@huawei.com>
-Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
----
- fs/exec.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/fs/exec.c b/fs/exec.c
-index fb72d36f7823..bcf383730bea 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -932,7 +932,7 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size,
- 		bytes = kernel_read(file, *buf + pos, i_size - pos, &pos);
- 		if (bytes < 0) {
- 			ret = bytes;
--			goto out;
-+			goto out_free;
- 		}
- 
- 		if (bytes == 0)
--- 
-2.21.0
-
diff --git a/libre/linux-libre/0002-netfilter-nf_tables-fix-set-double-free-in-abort-pat.patch b/libre/linux-libre/0002-netfilter-nf_tables-fix-set-double-free-in-abort-pat.patch
new file mode 100644
index 000000000..c092a69cb
--- /dev/null
+++ b/libre/linux-libre/0002-netfilter-nf_tables-fix-set-double-free-in-abort-pat.patch
@@ -0,0 +1,131 @@
+From 7a6c88347cc6dd3b0ade3be5e45cb932a07cec82 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 8 Mar 2019 00:58:53 +0100
+Subject: [PATCH 2/2] netfilter: nf_tables: fix set double-free in abort path
+
+The abort path can cause a double-free of an anonymous set.
+Added-and-to-be-aborted rule looks like this:
+
+udp dport { 137, 138 } drop
+
+The to-be-aborted transaction list looks like this:
+
+newset
+newsetelem
+newsetelem
+rule
+
+This gets walked in reverse order, so first pass disables the rule, the
+set elements, then the set.
+
+After synchronize_rcu(), we then destroy those in same order: rule, set
+element, set element, newset.
+
+Problem is that the anonymous set has already been bound to the rule, so
+the rule (lookup expression destructor) already frees the set, when then
+cause use-after-free when trying to delete the elements from this set,
+then try to free the set again when handling the newset expression.
+
+Rule releases the bound set in first place from the abort path, this
+causes the use-after-free on set element removal when undoing the new
+element transactions. To handle this, skip new element transaction if
+set is bound from the abort path.
+
+This is still causes the use-after-free on set element removal.  To
+handle this, remove transaction from the list when the set is already
+bound.
+
+Joint work with Florian Westphal.
+
+Fixes: f6ac85858976 ("netfilter: nf_tables: unbind set in rule from commit path")
+Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1325
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ include/net/netfilter/nf_tables.h |  6 ++----
+ net/netfilter/nf_tables_api.c     | 17 +++++++++++------
+ 2 files changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index b4984bbbe157..3d58acf94dd2 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -416,7 +416,8 @@ struct nft_set {
+ 	unsigned char			*udata;
+ 	/* runtime data below here */
+ 	const struct nft_set_ops	*ops ____cacheline_aligned;
+-	u16				flags:14,
++	u16				flags:13,
++					bound:1,
+ 					genmask:2;
+ 	u8				klen;
+ 	u8				dlen;
+@@ -1329,15 +1330,12 @@ struct nft_trans_rule {
+ struct nft_trans_set {
+ 	struct nft_set			*set;
+ 	u32				set_id;
+-	bool				bound;
+ };
+ 
+ #define nft_trans_set(trans)	\
+ 	(((struct nft_trans_set *)trans->data)->set)
+ #define nft_trans_set_id(trans)	\
+ 	(((struct nft_trans_set *)trans->data)->set_id)
+-#define nft_trans_set_bound(trans)	\
+-	(((struct nft_trans_set *)trans->data)->bound)
+ 
+ struct nft_trans_chain {
+ 	bool				update;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 4893f248dfdc..e1724f9d8b9d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -127,7 +127,7 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
+ 	list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
+ 		if (trans->msg_type == NFT_MSG_NEWSET &&
+ 		    nft_trans_set(trans) == set) {
+-			nft_trans_set_bound(trans) = true;
++			set->bound = true;
+ 			break;
+ 		}
+ 	}
+@@ -6617,8 +6617,7 @@ static void nf_tables_abort_release(struct nft_trans *trans)
+ 		nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
+ 		break;
+ 	case NFT_MSG_NEWSET:
+-		if (!nft_trans_set_bound(trans))
+-			nft_set_destroy(nft_trans_set(trans));
++		nft_set_destroy(nft_trans_set(trans));
+ 		break;
+ 	case NFT_MSG_NEWSETELEM:
+ 		nft_set_elem_destroy(nft_trans_elem_set(trans),
+@@ -6691,8 +6690,11 @@ static int __nf_tables_abort(struct net *net)
+ 			break;
+ 		case NFT_MSG_NEWSET:
+ 			trans->ctx.table->use--;
+-			if (!nft_trans_set_bound(trans))
+-				list_del_rcu(&nft_trans_set(trans)->list);
++			if (nft_trans_set(trans)->bound) {
++				nft_trans_destroy(trans);
++				break;
++			}
++			list_del_rcu(&nft_trans_set(trans)->list);
+ 			break;
+ 		case NFT_MSG_DELSET:
+ 			trans->ctx.table->use++;
+@@ -6700,8 +6702,11 @@ static int __nf_tables_abort(struct net *net)
+ 			nft_trans_destroy(trans);
+ 			break;
+ 		case NFT_MSG_NEWSETELEM:
++			if (nft_trans_elem_set(trans)->bound) {
++				nft_trans_destroy(trans);
++				break;
++			}
+ 			te = (struct nft_trans_elem *)trans->data;
+-
+ 			te->set->ops->remove(net, te->set, &te->elem);
+ 			atomic_dec(&te->set->nelems);
+ 			break;
+-- 
+2.21.0
+
diff --git a/libre/linux-libre/PKGBUILD b/libre/linux-libre/PKGBUILD
index dab364f68..299a7aec7 100644
--- a/libre/linux-libre/PKGBUILD
+++ b/libre/linux-libre/PKGBUILD
@@ -11,8 +11,8 @@
 
 pkgbase=linux-libre         # Build stock kernel
 #pkgbase=linux-libre-custom # Build kernel with a different name
-_srcbasever=4.20-gnu
-_srcver=5.0-gnu
+_srcbasever=5.0-gnu
+_srcver=5.0.2-gnu
 
 _replacesarchkernel=('linux%') # '%' gets replaced with _kernelname
 _replacesoldkernels=() # '%' gets replaced with _kernelname
@@ -58,15 +58,15 @@ source=(
   0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch
   0002-fix-Atmel-maXTouch-touchscreen-support.patch
   0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-  0002-exec-Fix-mem-leak-in-kernel_read_file.patch
+  0002-netfilter-nf_tables-fix-set-double-free-in-abort-pat.patch
 )
 validpgpkeys=(
   '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva
   '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78' # David P.
 )
-sha512sums=('a4a0a25fd490c051deb32ff84ba51e8807bfc8db1ad46c22c7807e9be2e5db5e1c22c211e47fca2509d5d75d64626fb28e9bbc8ccadc565f27fe9c8e47e12dc4'
+sha512sums=('56b8e77eb445c92c3e0ec0dc45fa5fb09641cad18003b79991652b83cf1d96cc1651750dfa9eec15652108a1b8aff1781c4f8ec5f92784b8542e59e0605922d9'
             'SKIP'
-            'ef6ec083f67f2a44110b904798e4263e03dccce38b7a2d1a574ce06cc7db870a37e8f27eba7ef86743eef504f4876eae26c3f96d80b020a2412a28fb96c4feae'
+            '2eee919805705709ef5493e0a0e1f7baeb71fed20da7ee06c09546c8976046568447422fc4f0b70178a645840a5a3d46946b4573ea42c025182916cb13bb849a'
             'SKIP'
             '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3'
             'SKIP'
@@ -76,7 +76,7 @@ sha512sums=('a4a0a25fd490c051deb32ff84ba51e8807bfc8db1ad46c22c7807e9be2e5db5e1c2
             'SKIP'
             '70776ba8c99c778acd48e22d1396ef5e6419a6f78828776067b32081e345ba82510f05bae2d4cf07a2cb8b00406c607c38097425ff9cad9dabac6ff9c3f7feeb'
             'd676726b536ea6bf255e5fd70ed0dbd97fa24ec29b6a6a36f438705b2be4c842127b2f5bd7b5270d99588fa75e3d3674d28113defcd665f11feb518022f032a3'
-            '492c39f1ffe45cb5baac7de7aa825b22974aa0982d38d57defa956af7bcbbfa98a01bfa3b209a75bbd173625329d418a976d5fa1c0097686da6f21e5322121e1'
+            '9f528e1549eb3acf46efa58ff24f00d76e26d4656e0472ab1fa950c7afec1b1f5f097874eb19a5b6ef4c53f0d6bdf527414cec664ebbdd0bb1611be895f337a7'
             '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a'
             '2718b58dbbb15063bacb2bde6489e5b3c59afac4c0e0435b97fe720d42c711b6bcba926f67a8687878bd51373c9cf3adb1915a11666d79ccb220bf36e0788ab7'
             '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf'
@@ -96,8 +96,8 @@ sha512sums=('a4a0a25fd490c051deb32ff84ba51e8807bfc8db1ad46c22c7807e9be2e5db5e1c2
             '17b09c80b0c235a5395c350c2b1acfda1c549c5bb6017f6a7056a84686fe23d7983a40f416cfc1da075523ad87d39ff4ff7b4057a275705679830db15b621991'
             '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af'
             'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168'
-            '6e8710c5f243ec44406730bab11581ff9e4386203c22997d6b13e7f43f8fb99073fa1b7aee4bd8598478e0f4652975ae156e92c5be3f21efefff06345078e703'
-            'f8d47cb9e4cbc3f050afc7a8a364526445439a0e7d64b4182496fa6da056afbc0381d04ee872b3794fe6fa05af38a7ed532549304c919b2c91250554f75997b9')
+            '0016e750127728458ab23ef445f92a8b52064806f235c03dd92e699a8bfb397d6274f6ba484a99af19ed729f6c63bab714bd350c7e7ed82c30a4b62b29857ff7'
+            '8348ecfeec519a41c68f1a97ec4b6007b3ed5ed61c271733d562ae22c6c85e4e217eb6c367bb53f3c53ad72f311360bd3aa57d09fba7cda358748c2bdd0416c2')
 
 _kernelname=${pkgbase#linux-libre}
 _replacesarchkernel=("${_replacesarchkernel[@]/\%/${_kernelname}}")
@@ -142,7 +142,7 @@ prepare() {
 
   # add Arch patches
   patch -p1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
-  patch -p1 -i ../0002-exec-Fix-mem-leak-in-kernel_read_file.patch
+  patch -p1 -i ../0002-netfilter-nf_tables-fix-set-double-free-in-abort-pat.patch
 
   # maintain the TTY over USB disconnects
   # http://www.coreboot.org/EHCI_Gadget_Debug
diff --git a/libre/linux-libre/config.armv7h b/libre/linux-libre/config.armv7h
index e63afbc01..ce0fcfeda 100644
--- a/libre/linux-libre/config.armv7h
+++ b/libre/linux-libre/config.armv7h
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm 5.0.0-gnu Kernel Configuration
+# Linux/arm 5.0.2-gnu Kernel Configuration
 #
 
 #
@@ -3668,8 +3668,8 @@ CONFIG_SERIAL_SAMSUNG_UARTS_4=y
 CONFIG_SERIAL_SAMSUNG_UARTS=4
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
 CONFIG_SERIAL_TEGRA=y
-# CONFIG_SERIAL_MAX3100 is not set
-# CONFIG_SERIAL_MAX310X is not set
+CONFIG_SERIAL_MAX3100=m
+CONFIG_SERIAL_MAX310X=m
 CONFIG_SERIAL_IMX=y
 CONFIG_SERIAL_IMX_CONSOLE=y
 # CONFIG_SERIAL_UARTLITE is not set