nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-30 17:43:42 +00:00
Code Issues Packages Projects Releases Wiki Activity
ba9275da88
nixpkgs/pkgs/os-specific/linux/kernel/patches.nix

160 lines
4.5 KiB
Nix
Raw Normal View History

linux: Add patch to fix CVE-2016-5829 (#16824) Fixed for all available 4.x series kernels. From CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
2016-07-12 18:56:50 +00:00
{ stdenv, fetchurl, fetchpatch, pkgs }:
* Use the kernel config generator for Linux 2.6.27. * Move kernel patches out of all-packages.nix to os-specific/linux/kernel/patches.nix. * Make the kernel config available under $out/config (it's also in $out/lib/modules/$version/build/.config, but that's kind of hard to find). svn path=/nixpkgs/branches/kernel-config/; revision=18937
2009-12-14 15:28:55 +00:00
let
Adding tuxonice for some recent kernels. svn path=/nixpkgs/trunk/; revision=26447
2011-03-21 15:53:22 +00:00
makeTuxonicePatch = { version, kernelVersion, sha256,
TuxOnIce: Add a 3.10 linux kernel with the TuxOnIce hibernation patch
2013-11-19 20:36:55 +00:00
url ? "http://tuxonice.nigelcunningham.com.au/downloads/all/tuxonice-for-linux-${kernelVersion}-${version}.patch.bz2" }:
Adding tuxonice for some recent kernels. svn path=/nixpkgs/trunk/; revision=26447
2011-03-21 15:53:22 +00:00
{ name = "tuxonice-${kernelVersion}";
patch = stdenv.mkDerivation {
name = "tuxonice-${version}-for-${kernelVersion}.patch";
src = fetchurl {
inherit url sha256;
};
phases = [ "installPhase" ];
installPhase = ''
source $stdenv/setup
bunzip2 -c $src > $out
'';
};
};
* Use the kernel config generator for Linux 2.6.27. * Move kernel patches out of all-packages.nix to os-specific/linux/kernel/patches.nix. * Make the kernel config available under $out/config (it's also in $out/lib/modules/$version/build/.config, but that's kind of hard to find). svn path=/nixpkgs/branches/kernel-config/; revision=18937
2009-12-14 15:28:55 +00:00
in
Suffixed cifs timeout patch with kernel version. Currently suffixed with 2.6.32. This pre-patch prepares the landing of several versions of this patch to support other Linux kernel versions. svn path=/nixpkgs/trunk/; revision=27709
2011-07-11 13:59:40 +00:00
rec {
* Use the kernel config generator for Linux 2.6.27. * Move kernel patches out of all-packages.nix to os-specific/linux/kernel/patches.nix. * Make the kernel config available under $out/config (it's also in $out/lib/modules/$version/build/.config, but that's kind of hard to find). svn path=/nixpkgs/branches/kernel-config/; revision=18937
2009-12-14 15:28:55 +00:00
linux_{4_8,grsec_nixos}: patch to fix build failure crypto/rsa_helper.c:18:28: fatal error: rsapubkey-asn1.h: No such file or directory
2016-12-13 12:25:46 +00:00
multithreaded_rsapubkey =
{
name = "multithreaded-rsapubkey-asn1.patch";
patch = ./multithreaded-rsapubkey-asn1.patch;
};
kernel: Fix path to stp bridge helper
2015-01-13 23:49:14 +00:00
bridge_stp_helper =
{ name = "bridge-stp-helper";
patch = ./bridge-stp-helper.patch;
};
kernel: fix 9p issues [tuomas: rename the patch from 9p-hacks to something slighly more meaningful] Signed-off-by: Tuomas Tynkkynen <tuomas@tuxera.com>
2017-03-20 23:24:54 +00:00
p9_fixes =
{ name = "p9-fixes";
patch = ./p9-fixes.patch;
};
kernel: Fix path to stp bridge helper
2015-01-13 23:49:14 +00:00
* Apply a patch that is apparently required to make the kernel work properly on Amazon EC2. * Always apply the CIFS timeout patch. It's rather annoying to have to build a separate kernel for the VM tests. svn path=/nixpkgs/trunk/; revision=22630
2010-07-18 21:10:46 +00:00
no_xsave =
{ name = "no-xsave";
Linux no-xsave.patch: commit patch into Nixpkgs since fetchurl no longer works Patch submitted by Jan Malakhovski <oxij@oxij.org>.
2012-07-02 14:16:27 +00:00
patch = ./no-xsave.patch;
* Apply a patch that is apparently required to make the kernel work properly on Amazon EC2. * Always apply the CIFS timeout patch. It's rather annoying to have to build a separate kernel for the VM tests. svn path=/nixpkgs/trunk/; revision=22630
2010-07-18 21:10:46 +00:00
features.noXsave = true;
* In the VM tests, apply a patch to increase the 15s timeout on CIFS operations to 120s. This is necessary if the host is heavily loaded. For instance, in the Hydra build farm, if there are many concurrent jobs, VM builds often fail because they hit the timeout. svn path=/nixpkgs/trunk/; revision=22347
2010-06-20 20:52:08 +00:00
};
* Ensure that the dell-bluetooth device does not stay in the "hard blocked" state. svn path=/nixpkgs/branches/x-updates/; revision=22730
2010-07-25 12:15:59 +00:00
Adding two kernel patches for mips, that make the life easier on loongson2f (less sigill, less sigbus). Related to bad handling of FPU instructions. I apply them only to linux 3.4, although I think they can apply to many older kernels too. svn path=/nixpkgs/trunk/; revision=34522
2012-06-16 10:49:03 +00:00
mips_fpureg_emu =
{ name = "mips-fpureg-emulation";
patch = ./mips-fpureg-emulation.patch;
};
mips_fpu_sigill =
{ name = "mips-fpu-sigill";
patch = ./mips-fpu-sigill.patch;
};
mips linux: Adding a patch to fix an ext3 bug in 3.5 and 3.6 I made it apply to all Mips, although the bug works only for n32 and o32 ABIs. We don't support any n64 by now.
2012-11-05 23:16:13 +00:00
mips_ext3_n32 =
{ name = "mips-ext3-n32";
patch = ./mips-ext3-n32.patch;
};
linux-testing: Fix arg list too long in modinst With the default kernel and thus with the build I have tested in 74ec94bfa2e57e2c0beeee0e469de58391d04a7b, we get an error during modules_install: make[2]: execvp: /nix/store/.../bin/bash: Argument list too long I haven't noticed this build until I actually tried booting using this kernel because make didn't fail here. The reason this happens within Nix and probably didn't yet surface in other distros is that programs only have a limited amount of memory available for storing the environment and the arguments. Environment variables however are quite common on Nix and thus we stumble on problems like this way earlier - in this case Linux 4.8 - but I have noticed this in 4.7-next as well already. The fix is far from perfect and suffers performance overhead because we now run grep for every *.mod file instead of passing all *.mod files into one single invocation of grep. But comparing the performance overhead (around 1s on my machine) with the overall build time of the kernel I think the overhead really is neglicible. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-08-30 04:26:12 +00:00
modinst_arg_list_too_long =
{ name = "modinst-arglist-too-long";
patch = ./modinst-arg-list-too-long.patch;
};
fan-networking: updated patches from Ubuntu This pulls in updated Fan Networking patches from Ubuntu. (https://wiki.ubuntu.com/FanNetworking) closes #14328
2016-04-09 23:36:02 +00:00
ubuntu_fan_4_4 =
nixos: add support for Ubuntu Fan Networking This provides support for Ubuntu Fan Networking [1]. This includes: * The fanctl package, and a corresponding NixOS service. * iproute patches. * kernel patches. closes #9188 1: https://wiki.ubuntu.com/FanNetworking
2015-08-09 23:13:40 +00:00
{ name = "ubuntu-fan";
fan-networking: updated patches from Ubuntu This pulls in updated Fan Networking patches from Ubuntu. (https://wiki.ubuntu.com/FanNetworking) closes #14328
2016-04-09 23:36:02 +00:00
patch = ./ubuntu-fan-4.4.patch;
nixos: add support for Ubuntu Fan Networking This provides support for Ubuntu Fan Networking [1]. This includes: * The fanctl package, and a corresponding NixOS service. * iproute patches. * kernel patches. closes #9188 1: https://wiki.ubuntu.com/FanNetworking
2015-08-09 23:13:40 +00:00
};
Unprivileged overlayfs mounts kernel patch from ubuntu This allows to create overlayfs mounts by unprivileged containers (i.e. in user and mount namespace). It's super-useful for containers. The patch is trivial as I understand from the patch description it's does not have security implications (on top of what user namespaces already have). And it's enabled in ubuntu long time ago. Here is a proof: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1357025
2015-09-25 21:42:16 +00:00
ubuntu_unprivileged_overlayfs =
{ name = "ubuntu-unprivileged-overlayfs";
patch = ./ubuntu-unprivileged-overlayfs.patch;
};
TuxOnIce: Add a 3.10 linux kernel with the TuxOnIce hibernation patch
2013-11-19 20:36:55 +00:00
tuxonice_3_10 = makeTuxonicePatch {
version = "2013-11-07";
kernelVersion = "3.10.18";
sha256 = "00b1rqgd4yr206dxp4mcymr56ymbjcjfa4m82pxw73khj032qw3j";
};
grsecurity: discontinue support Upstream has decided to make -testing patches private, effectively ceasing free support for grsecurity/PaX [1]. Consequently, we can no longer responsibly support grsecurity on NixOS. This patch turns the kernel and patch expressions into build errors and adds a warning to the manual, but retains most of the infrastructure, in an effort to make the transition smoother. For 17.09 all of it should probably be pruned. [1]: https://grsecurity.net/passing_the_baton.php
2017-04-27 18:42:23 +00:00
grsecurity_testing = throw ''
Upstream has ceased free support for grsecurity/PaX.
See https://grsecurity.net/passing_the_baton.php
and https://grsecurity.net/passing_the_baton_faq.php
for more information.
'';
linuxPackages_grsec_4_5: init at 3.1-4.5.2-201604290633
2016-05-02 05:06:36 +00:00
linux_3_{10,12,14}: fix upstream regression, fixes #6231 Some modules wouldn't load crc32c dependency due to module renaming.
2015-02-10 12:45:20 +00:00
crc_regression =
{ name = "crc-backport-regression";
patch = ./crc-regression.patch;
};
kernel: add patch to fix btrfs deadlocks to affected kernels
2015-04-08 12:13:42 +00:00
linux_chromiumos_3_18: init at 3.18.0 Co-authored-by: Nikolay Amiantov <ab@fmap.me>
2016-01-10 19:07:45 +00:00
genksyms_fix_segfault =
{ name = "genksyms-fix-segfault";
patch = ./genksyms-fix-segfault.patch;
};
chromiumos_Kconfig_fix_entries_3_18 =
{ name = "Kconfig_fix_entries_3_18";
patch = ./chromiumos-patches/fix-double-Kconfig-entry-3.18.patch;
};
chromiumos_no_link_restrictions =
{ name = "chromium-no-link-restrictions";
patch = ./chromiumos-patches/no-link-restrictions.patch;
};
linux_chromiumos_3_14: init at 3.14.0 Co-authored-by: Nikolay Amiantov <ab@fmap.me>
2016-01-10 19:10:11 +00:00
chromiumos_mfd_fix_dependency =
{ name = "mfd_fix_dependency";
patch = ./chromiumos-patches/mfd-fix-dependency.patch;
};
linux: Add patch to fix CVE-2016-5829 (#16824) Fixed for all available 4.x series kernels. From CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
2016-07-12 18:56:50 +00:00
hiddev_CVE_2016_5829 =
{ name = "hiddev_CVE_2016_5829";
patch = fetchpatch {
url = "https://sources.debian.net/data/main/l/linux/4.6.3-1/debian/patches/bugfix/all/HID-hiddev-validate-num_values-for-HIDIOCGUSAGES-HID.patch";
sha256 = "14rm1qr87p7a5prz8g5fwbpxzdp3ighj095x8rvhm8csm20wspyy";
};
};
Add initial patches for CPU Controller on Control Group v2
2016-08-25 17:01:40 +00:00
cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
linux-3.10: fix build by upstream patch
2016-09-28 16:45:55 +00:00
lguest_entry-linkage =
{ name = "lguest-asmlinkage.patch";
patch = fetchpatch {
url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git"
+ "/patch/drivers/lguest/x86/core.c?id=cdd77e87eae52";
sha256 = "04xlx6al10cw039av6jkby7gx64zayj8m1k9iza40sw0fydcfqhc";
linux: add patch to fix CVE-2016-8655 See https://lwn.net/Articles/708319/ for more information.
2016-12-10 16:08:42 +00:00
};
};
packet_fix_race_condition_CVE_2016_8655 =
{ name = "packet_fix_race_condition_CVE_2016_8655.patch";
patch = fetchpatch {
url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=84ac7260236a49c79eede91617700174c2c19b0c";
sha256 = "19viqjjgq8j8jiz5yhgmzwhqvhwv175q645qdazd1k69d25nv2ki";
};
linux-3.10: fix build by upstream patch
2016-09-28 16:45:55 +00:00
};
linux_4_8: add patch to fix CVE-2016-9919
2016-12-26 13:56:15 +00:00
panic_on_icmp6_frag_CVE_2016_9919 = rec
{ name = "panic_on_icmp6_frag_CVE_2016_9919.patch";
patch = fetchpatch {
inherit name;
url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2";
sha256 = "0mps33r4mnwiy0bmgrzgqkrk59yya17v6kzpv9024g4xlz61rk8p";
};
};
Revert "Revert "linux kernels: patch against DCCP double free (CVE-2017-6074)"" This reverts commit 53a2baabbeb29ce0180b0353deb623139f1808bd.
2017-02-24 00:23:29 +00:00
DCCP_double_free_vulnerability_CVE-2017-6074 = rec
{ name = "DCCP_double_free_vulnerability_CVE-2017-6074.patch";
patch = fetchpatch {
inherit name;
url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4";
sha256 = "10dmv3d3gj8rvj9h40js4jh8xbr5wyaqiy0kd819mya441mj8ll2";
};
};
* Use the kernel config generator for Linux 2.6.27. * Move kernel patches out of all-packages.nix to os-specific/linux/kernel/patches.nix. * Make the kernel config available under $out/config (it's also in $out/lib/modules/$version/build/.config, but that's kind of hard to find). svn path=/nixpkgs/branches/kernel-config/; revision=18937
2009-12-14 15:28:55 +00:00
}
Reference in New Issue Copy Permalink