Update Linux CVE patches

Patches/Linux_CVEs/CVE-2016-10044/ANY/0.patch

@@ -0,0 +1,12 @@
+diff --git a/fs/aio.c b/fs/aio.c
+index d991255..3eec984 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -229,6 +229,7 @@
+ 	aio_mnt = kern_mount(&aio_fs);
+ 	if (IS_ERR(aio_mnt))
+ 		panic("Failed to create aio fs mount.");
++	aio_mnt->mnt_flags |= MNT_NOEXEC;
+ 
+ 	if (bdi_init(&aio_fs_backing_dev_info))
+ 		panic("Failed to init aio fs backing dev info.");

Patches/Linux_CVEs/CVE-2016-10044/ANY/0.patch.base64

@@ -0,0 +1 @@
+ZGlmZiAtLWdpdCBhL2ZzL2Fpby5jIGIvZnMvYWlvLmMKaW5kZXggZDk5MTI1NS4uM2VlYzk4NCAxMDA2NDQKLS0tIGEvZnMvYWlvLmMKKysrIGIvZnMvYWlvLmMKQEAgLTIyOSw2ICsyMjksNyBAQAogCWFpb19tbnQgPSBrZXJuX21vdW50KCZhaW9fZnMpOwogCWlmIChJU19FUlIoYWlvX21udCkpCiAJCXBhbmljKCJGYWlsZWQgdG8gY3JlYXRlIGFpbyBmcyBtb3VudC4iKTsKKwlhaW9fbW50LT5tbnRfZmxhZ3MgfD0gTU5UX05PRVhFQzsKIAogCWlmIChiZGlfaW5pdCgmYWlvX2ZzX2JhY2tpbmdfZGV2X2luZm8pKQogCQlwYW5pYygiRmFpbGVkIHRvIGluaXQgYWlvIGZzIGJhY2tpbmcgZGV2IGluZm8uIik7Cg==

Patches/Linux_CVEs/CVE-2016-10044/ANY/1.patch

@@ -0,0 +1,22 @@
+diff --git a/fs/aio.c b/fs/aio.c
+index 9798d4e..0f2c38f 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -35,6 +35,7 @@
+ #include <linux/eventfd.h>
+ #include <linux/blkdev.h>
+ #include <linux/compat.h>
++#include <linux/personality.h>
+ 
+ #include <asm/kmap_types.h>
+ #include <asm/uaccess.h>
+@@ -153,6 +154,9 @@
+ 	unsigned long size, populate;
+ 	int nr_pages;
+ 
++	if (current->personality & READ_IMPLIES_EXEC)
++		return -EPERM;
++
+ 	/* Compensate for the ring buffer's head/tail overlap entry */
+ 	nr_events += 2;	/* 1 is required, 2 for good luck */
+ 

Patches/Linux_CVEs/CVE-2016-10044/ANY/1.patch.base64

@@ -0,0 +1 @@
+ZGlmZiAtLWdpdCBhL2ZzL2Fpby5jIGIvZnMvYWlvLmMKaW5kZXggOTc5OGQ0ZS4uMGYyYzM4ZiAxMDA2NDQKLS0tIGEvZnMvYWlvLmMKKysrIGIvZnMvYWlvLmMKQEAgLTM1LDYgKzM1LDcgQEAKICNpbmNsdWRlIDxsaW51eC9ldmVudGZkLmg+CiAjaW5jbHVkZSA8bGludXgvYmxrZGV2Lmg+CiAjaW5jbHVkZSA8bGludXgvY29tcGF0Lmg+CisjaW5jbHVkZSA8bGludXgvcGVyc29uYWxpdHkuaD4KIAogI2luY2x1ZGUgPGFzbS9rbWFwX3R5cGVzLmg+CiAjaW5jbHVkZSA8YXNtL3VhY2Nlc3MuaD4KQEAgLTE1Myw2ICsxNTQsOSBAQAogCXVuc2lnbmVkIGxvbmcgc2l6ZSwgcG9wdWxhdGU7CiAJaW50IG5yX3BhZ2VzOwogCisJaWYgKGN1cnJlbnQtPnBlcnNvbmFsaXR5ICYgUkVBRF9JTVBMSUVTX0VYRUMpCisJCXJldHVybiAtRVBFUk07CisKIAkvKiBDb21wZW5zYXRlIGZvciB0aGUgcmluZyBidWZmZXIncyBoZWFkL3RhaWwgb3ZlcmxhcCBlbnRyeSAqLwogCW5yX2V2ZW50cyArPSAyOwkvKiAxIGlzIHJlcXVpcmVkLCAyIGZvciBnb29kIGx1Y2sgKi8KIAo=

Patches/Linux_CVEs/CVE-2016-10044/ANY/2.patch

@@ -0,0 +1,66 @@
+From 22f6b4d34fcf039c63a94e7670e0da24f8575a5a Mon Sep 17 00:00:00 2001
+From: Jann Horn <jann@thejh.net>
+Date: Fri, 16 Sep 2016 00:31:22 +0200
+Subject: aio: mark AIO pseudo-fs noexec
+
+This ensures that do_mmap() won't implicitly make AIO memory mappings
+executable if the READ_IMPLIES_EXEC personality flag is set.  Such
+behavior is problematic because the security_mmap_file LSM hook doesn't
+catch this case, potentially permitting an attacker to bypass a W^X
+policy enforced by SELinux.
+
+I have tested the patch on my machine.
+
+To test the behavior, compile and run this:
+
+    #define _GNU_SOURCE
+    #include <unistd.h>
+    #include <sys/personality.h>
+    #include <linux/aio_abi.h>
+    #include <err.h>
+    #include <stdlib.h>
+    #include <stdio.h>
+    #include <sys/syscall.h>
+
+    int main(void) {
+        personality(READ_IMPLIES_EXEC);
+        aio_context_t ctx = 0;
+        if (syscall(__NR_io_setup, 1, &ctx))
+            err(1, "io_setup");
+
+        char cmd[1000];
+        sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
+            (int)getpid());
+        system(cmd);
+        return 0;
+    }
+
+In the output, "rw-s" is good, "rwxs" is bad.
+
+Signed-off-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ fs/aio.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index fb8e45b..4fe81d1 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
+ 	static const struct dentry_operations ops = {
+ 		.d_dname	= simple_dname,
+ 	};
+-	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
++	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
++					   AIO_RING_MAGIC);
++
++	if (!IS_ERR(root))
++		root->d_sb->s_iflags |= SB_I_NOEXEC;
++	return root;
+ }
+ 
+ /* aio_setup
+-- 
+cgit v1.1
+