Linux v4.4.14
This commit is contained in:
Laura Abbott
parent
db62170ee0
commit
f340e962e7
|
|
@ -1,142 +0,0 @@
|
|||
From 6a480a7842545ec520a91730209ec0bae41694c1 Mon Sep 17 00:00:00 2001
|
||||
From: Al Viro <viro@zeniv.linux.org.uk>
|
||||
Date: Wed, 4 May 2016 14:04:13 -0400
|
||||
Subject: [PATCH] ecryptfs: fix handling of directory opening
|
||||
|
||||
First of all, trying to open them r/w is idiocy; it's guaranteed to fail.
|
||||
Moreover, assigning ->f_pos and assuming that everything will work is
|
||||
blatantly broken - try that with e.g. tmpfs as underlying layer and watch
|
||||
the fireworks. There may be a non-trivial amount of state associated with
|
||||
current IO position, well beyond the numeric offset. Using the single
|
||||
struct file associated with underlying inode is really not a good idea;
|
||||
we ought to open one for each ecryptfs directory struct file.
|
||||
|
||||
Additionally, file_operations both for directories and non-directories are
|
||||
full of pointless methods; non-directories should *not* have ->iterate(),
|
||||
directories should not have ->flush(), ->fasync() and ->splice_read().
|
||||
|
||||
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
||||
---
|
||||
fs/ecryptfs/file.c | 71 ++++++++++++++++++++++++++++++++++++++++++------------
|
||||
1 file changed, 55 insertions(+), 16 deletions(-)
|
||||
|
||||
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
|
||||
index feef8a9c4de7..f02404052b7b 100644
|
||||
--- a/fs/ecryptfs/file.c
|
||||
+++ b/fs/ecryptfs/file.c
|
||||
@@ -112,7 +112,6 @@ static int ecryptfs_readdir(struct file *file, struct dir_context *ctx)
|
||||
.sb = inode->i_sb,
|
||||
};
|
||||
lower_file = ecryptfs_file_to_lower(file);
|
||||
- lower_file->f_pos = ctx->pos;
|
||||
rc = iterate_dir(lower_file, &buf.ctx);
|
||||
ctx->pos = buf.ctx.pos;
|
||||
if (rc < 0)
|
||||
@@ -223,14 +222,6 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
|
||||
}
|
||||
ecryptfs_set_file_lower(
|
||||
file, ecryptfs_inode_to_private(inode)->lower_file);
|
||||
- if (d_is_dir(ecryptfs_dentry)) {
|
||||
- ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
|
||||
- mutex_lock(&crypt_stat->cs_mutex);
|
||||
- crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
|
||||
- mutex_unlock(&crypt_stat->cs_mutex);
|
||||
- rc = 0;
|
||||
- goto out;
|
||||
- }
|
||||
rc = read_or_initialize_metadata(ecryptfs_dentry);
|
||||
if (rc)
|
||||
goto out_put;
|
||||
@@ -247,6 +238,45 @@ out:
|
||||
return rc;
|
||||
}
|
||||
|
||||
+/**
|
||||
+ * ecryptfs_dir_open
|
||||
+ * @inode: inode speciying file to open
|
||||
+ * @file: Structure to return filled in
|
||||
+ *
|
||||
+ * Opens the file specified by inode.
|
||||
+ *
|
||||
+ * Returns zero on success; non-zero otherwise
|
||||
+ */
|
||||
+static int ecryptfs_dir_open(struct inode *inode, struct file *file)
|
||||
+{
|
||||
+ struct dentry *ecryptfs_dentry = file->f_path.dentry;
|
||||
+ /* Private value of ecryptfs_dentry allocated in
|
||||
+ * ecryptfs_lookup() */
|
||||
+ struct ecryptfs_file_info *file_info;
|
||||
+ struct file *lower_file;
|
||||
+
|
||||
+ /* Released in ecryptfs_release or end of function if failure */
|
||||
+ file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
|
||||
+ ecryptfs_set_file_private(file, file_info);
|
||||
+ if (unlikely(!file_info)) {
|
||||
+ ecryptfs_printk(KERN_ERR,
|
||||
+ "Error attempting to allocate memory\n");
|
||||
+ return -ENOMEM;
|
||||
+ }
|
||||
+ lower_file = dentry_open(ecryptfs_dentry_to_lower_path(ecryptfs_dentry),
|
||||
+ file->f_flags, current_cred());
|
||||
+ if (IS_ERR(lower_file)) {
|
||||
+ printk(KERN_ERR "%s: Error attempting to initialize "
|
||||
+ "the lower file for the dentry with name "
|
||||
+ "[%pd]; rc = [%ld]\n", __func__,
|
||||
+ ecryptfs_dentry, PTR_ERR(lower_file));
|
||||
+ kmem_cache_free(ecryptfs_file_info_cache, file_info);
|
||||
+ return PTR_ERR(lower_file);
|
||||
+ }
|
||||
+ ecryptfs_set_file_lower(file, lower_file);
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
static int ecryptfs_flush(struct file *file, fl_owner_t td)
|
||||
{
|
||||
struct file *lower_file = ecryptfs_file_to_lower(file);
|
||||
@@ -267,6 +297,19 @@ static int ecryptfs_release(struct inode *inode, struct file *file)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static int ecryptfs_dir_release(struct inode *inode, struct file *file)
|
||||
+{
|
||||
+ fput(ecryptfs_file_to_lower(file));
|
||||
+ kmem_cache_free(ecryptfs_file_info_cache,
|
||||
+ ecryptfs_file_to_private(file));
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static loff_t ecryptfs_dir_llseek(struct file *file, loff_t offset, int whence)
|
||||
+{
|
||||
+ return vfs_llseek(ecryptfs_file_to_lower(file), offset, whence);
|
||||
+}
|
||||
+
|
||||
static int
|
||||
ecryptfs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
|
||||
{
|
||||
@@ -346,20 +389,16 @@ const struct file_operations ecryptfs_dir_fops = {
|
||||
#ifdef CONFIG_COMPAT
|
||||
.compat_ioctl = ecryptfs_compat_ioctl,
|
||||
#endif
|
||||
- .open = ecryptfs_open,
|
||||
- .flush = ecryptfs_flush,
|
||||
- .release = ecryptfs_release,
|
||||
+ .open = ecryptfs_dir_open,
|
||||
+ .release = ecryptfs_dir_release,
|
||||
.fsync = ecryptfs_fsync,
|
||||
- .fasync = ecryptfs_fasync,
|
||||
- .splice_read = generic_file_splice_read,
|
||||
- .llseek = default_llseek,
|
||||
+ .llseek = ecryptfs_dir_llseek,
|
||||
};
|
||||
|
||||
const struct file_operations ecryptfs_main_fops = {
|
||||
.llseek = generic_file_llseek,
|
||||
.read_iter = ecryptfs_read_update_atime,
|
||||
.write_iter = generic_file_write_iter,
|
||||
- .iterate = ecryptfs_readdir,
|
||||
.unlocked_ioctl = ecryptfs_unlocked_ioctl,
|
||||
#ifdef CONFIG_COMPAT
|
||||
.compat_ioctl = ecryptfs_compat_ioctl,
|
||||
--
|
||||
2.5.5
|
||||
|
||||
|
|
@ -1,59 +0,0 @@
|
|||
From 2f36db71009304b3f0b95afacd8eba1f9f046b87 Mon Sep 17 00:00:00 2001
|
||||
From: Jann Horn <jannh@google.com>
|
||||
Date: Wed, 1 Jun 2016 11:55:06 +0200
|
||||
Subject: [PATCH] ecryptfs: forbid opening files without mmap handler
|
||||
|
||||
This prevents users from triggering a stack overflow through a recursive
|
||||
invocation of pagefault handling that involves mapping procfs files into
|
||||
virtual memory.
|
||||
|
||||
Signed-off-by: Jann Horn <jannh@google.com>
|
||||
Acked-by: Tyler Hicks <tyhicks@canonical.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
fs/ecryptfs/kthread.c | 13 +++++++++++--
|
||||
1 file changed, 11 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
|
||||
index 866bb18efefe..e818f5ac7a26 100644
|
||||
--- a/fs/ecryptfs/kthread.c
|
||||
+++ b/fs/ecryptfs/kthread.c
|
||||
@@ -25,6 +25,7 @@
|
||||
#include <linux/slab.h>
|
||||
#include <linux/wait.h>
|
||||
#include <linux/mount.h>
|
||||
+#include <linux/file.h>
|
||||
#include "ecryptfs_kernel.h"
|
||||
|
||||
struct ecryptfs_open_req {
|
||||
@@ -147,7 +148,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
|
||||
flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
|
||||
(*lower_file) = dentry_open(&req.path, flags, cred);
|
||||
if (!IS_ERR(*lower_file))
|
||||
- goto out;
|
||||
+ goto have_file;
|
||||
if ((flags & O_ACCMODE) == O_RDONLY) {
|
||||
rc = PTR_ERR((*lower_file));
|
||||
goto out;
|
||||
@@ -165,8 +166,16 @@ int ecryptfs_privileged_open(struct file **lower_file,
|
||||
mutex_unlock(&ecryptfs_kthread_ctl.mux);
|
||||
wake_up(&ecryptfs_kthread_ctl.wait);
|
||||
wait_for_completion(&req.done);
|
||||
- if (IS_ERR(*lower_file))
|
||||
+ if (IS_ERR(*lower_file)) {
|
||||
rc = PTR_ERR(*lower_file);
|
||||
+ goto out;
|
||||
+ }
|
||||
+have_file:
|
||||
+ if ((*lower_file)->f_op->mmap == NULL) {
|
||||
+ fput(*lower_file);
|
||||
+ *lower_file = NULL;
|
||||
+ rc = -EMEDIUMTYPE;
|
||||
+ }
|
||||
out:
|
||||
return rc;
|
||||
}
|
||||
--
|
||||
2.5.5
|
||||
|
||||
23
kernel.spec
23
kernel.spec
|
|
@ -52,7 +52,7 @@ Summary: The Linux kernel
|
|||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 13
|
||||
%define stable_update 14
|
||||
# Set rpm version accordingly
|
||||
%if 0%{?stable_update}
|
||||
%define stablerev %{stable_update}
|
||||
|
|
@ -638,21 +638,12 @@ Patch716: ALSA-timer-Fix-leak-in-events-via-snd_timer_user_tin.patch
|
|||
#CVE-2016-0758 rhbz 1300257 1335386
|
||||
Patch717: KEYS-Fix-ASN.1-indefinite-length-object-parsing.patch
|
||||
|
||||
#CVE-2016-4951 rhbz 1338625 1338626
|
||||
Patch720: tipc-check-nl-sock-before-parsing-nested-attributes.patch
|
||||
|
||||
#CVE-2016-5243 rhbz 1343338 1343335
|
||||
Patch721: tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch
|
||||
|
||||
#CVE-2016-5244 rhbz 1343338 1343337
|
||||
Patch722: rds-fix-an-infoleak-in-rds_inc_info_copy.txt
|
||||
|
||||
#CVE-2016-1583 rhbz 1344721 1344722
|
||||
Patch723: proc-prevent-stacking-filesystems-on-top.patch
|
||||
Patch724: ecryptfs-fix-handling-of-directory-opening.patch
|
||||
Patch725: ecryptfs-forbid-opening-files-without-mmap-handler.patch
|
||||
Patch726: sched-panic-on-corrupted-stack-end.patch
|
||||
|
||||
#CVE-2016-4470 rhbz 1341716 1346626
|
||||
Patch727: KEYS-potential-uninitialized-variable.patch
|
||||
|
||||
|
|
@ -1358,21 +1349,12 @@ ApplyPatch ALSA-timer-Fix-leak-in-events-via-snd_timer_user_tin.patch
|
|||
#CVE-2016-0758 rhbz 1300257 1335386
|
||||
ApplyPatch KEYS-Fix-ASN.1-indefinite-length-object-parsing.patch
|
||||
|
||||
#CVE-2016-4951 rhbz 1338625 1338626
|
||||
ApplyPatch tipc-check-nl-sock-before-parsing-nested-attributes.patch
|
||||
|
||||
#CVE-2016-5243 rhbz 1343338 1343335
|
||||
ApplyPatch tipc-fix-an-infoleak-in-tipc_nl_compat_link_dump.patch
|
||||
|
||||
#CVE-2016-5244 rhbz 1343338 1343337
|
||||
ApplyPatch rds-fix-an-infoleak-in-rds_inc_info_copy.txt
|
||||
|
||||
#CVE-2016-1583 rhbz 1344721 1344722
|
||||
ApplyPatch proc-prevent-stacking-filesystems-on-top.patch
|
||||
ApplyPatch ecryptfs-fix-handling-of-directory-opening.patch
|
||||
ApplyPatch ecryptfs-forbid-opening-files-without-mmap-handler.patch
|
||||
ApplyPatch sched-panic-on-corrupted-stack-end.patch
|
||||
|
||||
#CVE-2016-4470 rhbz 1341716 1346626
|
||||
ApplyPatch KEYS-potential-uninitialized-variable.patch
|
||||
|
||||
|
|
@ -2228,6 +2210,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Fri Jun 24 2016 Laura Abbott <labbott@fedoraproject.org> - 4.4.14-200
|
||||
- Linux v4.4.14
|
||||
|
||||
* Wed Jun 15 2016 Laura Abbott <labbott@fedoraproject.org>
|
||||
- hp-wmi: fix wifi cannot be hard-unblock (rhbz 1338025)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
Subject: [PATCH nf] netfilter: x_tables: deal with bogus nextoffset values
|
||||
From: Florian Westphal <fw () strlen ! de>
|
||||
Date: 2016-03-10 0:56:02
|
||||
From 36d815b56409ca2fb562bb7aec5b17d08db25d8e Mon Sep 17 00:00:00 2001
|
||||
From: Florian Westphal <fw () strlen ! de>
|
||||
Date: Thu, 10 Mar 2016 00:56:02 -0800
|
||||
Subject: [PATCH] netfilter: x_tables: deal with bogus nextoffset values
|
||||
|
||||
Ben Hawkes says:
|
||||
|
||||
|
|
@ -28,10 +29,10 @@ Signed-off-by: Florian Westphal <fw@strlen.de>
|
|||
3 files changed, 22 insertions(+), 22 deletions(-)
|
||||
|
||||
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
|
||||
index b488cac..5a0b591 100644
|
||||
index 6e3e0e8..42b87c7 100644
|
||||
--- a/net/ipv4/netfilter/arp_tables.c
|
||||
+++ b/net/ipv4/netfilter/arp_tables.c
|
||||
@@ -437,6 +437,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
|
||||
@@ -449,6 +449,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
|
||||
|
||||
/* Move along one */
|
||||
size = e->next_offset;
|
||||
|
|
@ -41,8 +42,8 @@ index b488cac..5a0b591 100644
|
|||
+
|
||||
e = (struct arpt_entry *)
|
||||
(entry0 + pos + size);
|
||||
e->counters.pcnt = pos;
|
||||
@@ -447,14 +451,6 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (pos + size >= newinfo->size)
|
||||
@@ -461,14 +465,6 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (strcmp(t->target.u.user.name,
|
||||
XT_STANDARD_TARGET) == 0 &&
|
||||
newpos >= 0) {
|
||||
|
|
@ -57,9 +58,9 @@ index b488cac..5a0b591 100644
|
|||
/* This a jump; chase it. */
|
||||
duprintf("Jump rule %u -> %u\n",
|
||||
pos, newpos);
|
||||
@@ -462,6 +458,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
|
||||
/* ... this is a fallthru */
|
||||
newpos = pos + e->next_offset;
|
||||
@@ -482,6 +478,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (newpos >= newinfo->size)
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+ if (newpos > newinfo->size - sizeof(*e))
|
||||
|
|
@ -69,10 +70,10 @@ index b488cac..5a0b591 100644
|
|||
(entry0 + newpos);
|
||||
e->counters.pcnt = pos;
|
||||
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
|
||||
index b99affa..ceb995f 100644
|
||||
index a399c54..b08e186 100644
|
||||
--- a/net/ipv4/netfilter/ip_tables.c
|
||||
+++ b/net/ipv4/netfilter/ip_tables.c
|
||||
@@ -519,6 +519,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
@@ -530,6 +530,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
|
||||
/* Move along one */
|
||||
size = e->next_offset;
|
||||
|
|
@ -82,8 +83,8 @@ index b99affa..ceb995f 100644
|
|||
+
|
||||
e = (struct ipt_entry *)
|
||||
(entry0 + pos + size);
|
||||
e->counters.pcnt = pos;
|
||||
@@ -529,13 +533,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (pos + size >= newinfo->size)
|
||||
@@ -542,13 +546,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (strcmp(t->target.u.user.name,
|
||||
XT_STANDARD_TARGET) == 0 &&
|
||||
newpos >= 0) {
|
||||
|
|
@ -97,9 +98,9 @@ index b99affa..ceb995f 100644
|
|||
/* This a jump; chase it. */
|
||||
duprintf("Jump rule %u -> %u\n",
|
||||
pos, newpos);
|
||||
@@ -543,6 +540,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
/* ... this is a fallthru */
|
||||
newpos = pos + e->next_offset;
|
||||
@@ -562,6 +559,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (newpos >= newinfo->size)
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+ if (newpos > newinfo->size - sizeof(*e))
|
||||
|
|
@ -109,10 +110,10 @@ index b99affa..ceb995f 100644
|
|||
(entry0 + newpos);
|
||||
e->counters.pcnt = pos;
|
||||
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
|
||||
index 99425cf..d88a794 100644
|
||||
index 22f39e0..1b6d4e7 100644
|
||||
--- a/net/ipv6/netfilter/ip6_tables.c
|
||||
+++ b/net/ipv6/netfilter/ip6_tables.c
|
||||
@@ -531,6 +531,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
@@ -542,6 +542,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
|
||||
/* Move along one */
|
||||
size = e->next_offset;
|
||||
|
|
@ -120,8 +121,8 @@ index 99425cf..d88a794 100644
|
|||
+ return 0;
|
||||
e = (struct ip6t_entry *)
|
||||
(entry0 + pos + size);
|
||||
e->counters.pcnt = pos;
|
||||
@@ -541,13 +543,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (pos + size >= newinfo->size)
|
||||
@@ -554,13 +556,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (strcmp(t->target.u.user.name,
|
||||
XT_STANDARD_TARGET) == 0 &&
|
||||
newpos >= 0) {
|
||||
|
|
@ -135,9 +136,9 @@ index 99425cf..d88a794 100644
|
|||
/* This a jump; chase it. */
|
||||
duprintf("Jump rule %u -> %u\n",
|
||||
pos, newpos);
|
||||
@@ -555,6 +550,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
/* ... this is a fallthru */
|
||||
newpos = pos + e->next_offset;
|
||||
@@ -574,6 +569,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
|
||||
if (newpos >= newinfo->size)
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+ if (newpos > newinfo->size - sizeof(*e))
|
||||
|
|
@ -147,4 +148,5 @@ index 99425cf..d88a794 100644
|
|||
(entry0 + newpos);
|
||||
e->counters.pcnt = pos;
|
||||
--
|
||||
2.4.10
|
||||
2.5.5
|
||||
|
||||
|
|
|
|||
|
|
@ -1,41 +0,0 @@
|
|||
From e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9 Mon Sep 17 00:00:00 2001
|
||||
From: Jann Horn <jannh@google.com>
|
||||
Date: Wed, 1 Jun 2016 11:55:05 +0200
|
||||
Subject: [PATCH] proc: prevent stacking filesystems on top
|
||||
|
||||
This prevents stacking filesystems (ecryptfs and overlayfs) from using
|
||||
procfs as lower filesystem. There is too much magic going on inside
|
||||
procfs, and there is no good reason to stack stuff on top of procfs.
|
||||
|
||||
(For example, procfs does access checks in VFS open handlers, and
|
||||
ecryptfs by design calls open handlers from a kernel thread that doesn't
|
||||
drop privileges or so.)
|
||||
|
||||
Signed-off-by: Jann Horn <jannh@google.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
fs/proc/root.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/fs/proc/root.c b/fs/proc/root.c
|
||||
index 361ab4ee42fc..ec649c92d270 100644
|
||||
--- a/fs/proc/root.c
|
||||
+++ b/fs/proc/root.c
|
||||
@@ -121,6 +121,13 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
|
||||
if (IS_ERR(sb))
|
||||
return ERR_CAST(sb);
|
||||
|
||||
+ /*
|
||||
+ * procfs isn't actually a stacking filesystem; however, there is
|
||||
+ * too much magic going on inside it to permit stacking things on
|
||||
+ * top of it
|
||||
+ */
|
||||
+ sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
|
||||
+
|
||||
if (!proc_parse_options(options, ns)) {
|
||||
deactivate_locked_super(sb);
|
||||
return ERR_PTR(-EINVAL);
|
||||
--
|
||||
2.5.5
|
||||
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
From 29d6455178a09e1dc340380c582b13356227e8df Mon Sep 17 00:00:00 2001
|
||||
From: Jann Horn <jannh@google.com>
|
||||
Date: Wed, 1 Jun 2016 11:55:07 +0200
|
||||
Subject: [PATCH] sched: panic on corrupted stack end
|
||||
|
||||
Until now, hitting this BUG_ON caused a recursive oops (because oops
|
||||
handling involves do_exit(), which calls into the scheduler, which in
|
||||
turn raises an oops), which caused stuff below the stack to be
|
||||
overwritten until a panic happened (e.g. via an oops in interrupt
|
||||
context, caused by the overwritten CPU index in the thread_info).
|
||||
|
||||
Just panic directly.
|
||||
|
||||
Signed-off-by: Jann Horn <jannh@google.com>
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
kernel/sched/core.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
|
||||
index d1f7149f8704..11546a6ed5df 100644
|
||||
--- a/kernel/sched/core.c
|
||||
+++ b/kernel/sched/core.c
|
||||
@@ -3047,7 +3047,8 @@ static noinline void __schedule_bug(struct task_struct *prev)
|
||||
static inline void schedule_debug(struct task_struct *prev)
|
||||
{
|
||||
#ifdef CONFIG_SCHED_STACK_END_CHECK
|
||||
- BUG_ON(task_stack_end_corrupted(prev));
|
||||
+ if (task_stack_end_corrupted(prev))
|
||||
+ panic("corrupted stack end detected inside scheduler\n");
|
||||
#endif
|
||||
|
||||
if (unlikely(in_atomic_preempt_off())) {
|
||||
--
|
||||
2.5.5
|
||||
|
||||
2
sources
2
sources
|
|
@ -1,3 +1,3 @@
|
|||
9a78fa2eb6c68ca5a40ed5af08142599 linux-4.4.tar.xz
|
||||
dcbc8fe378a676d5d0dd208cf524e144 perf-man-4.4.tar.gz
|
||||
0985afde06951614f594120d7c8ffad7 patch-4.4.13.xz
|
||||
24bdcde8502d841d58f1e45fc2de217f patch-4.4.14.xz
|
||||
|
|
|
|||
|
|
@ -1,36 +0,0 @@
|
|||
From 45e093ae2830cd1264677d47ff9a95a71f5d9f9c Mon Sep 17 00:00:00 2001
|
||||
From: Richard Alpe <richard.alpe@ericsson.com>
|
||||
Date: Mon, 16 May 2016 11:14:54 +0200
|
||||
Subject: [PATCH] tipc: check nl sock before parsing nested attributes
|
||||
|
||||
Make sure the socket for which the user is listing publication exists
|
||||
before parsing the socket netlink attributes.
|
||||
|
||||
Prior to this patch a call without any socket caused a NULL pointer
|
||||
dereference in tipc_nl_publ_dump().
|
||||
|
||||
Tested-and-reported-by: Baozeng Ding <sploving1@gmail.com>
|
||||
Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
|
||||
Acked-by: Jon Maloy <jon.maloy@ericsson.cm>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/tipc/socket.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
|
||||
index 12628890c219..3b7a79991d55 100644
|
||||
--- a/net/tipc/socket.c
|
||||
+++ b/net/tipc/socket.c
|
||||
@@ -2853,6 +2853,9 @@ int tipc_nl_publ_dump(struct sk_buff *skb, struct netlink_callback *cb)
|
||||
if (err)
|
||||
return err;
|
||||
|
||||
+ if (!attrs[TIPC_NLA_SOCK])
|
||||
+ return -EINVAL;
|
||||
+
|
||||
err = nla_parse_nested(sock, TIPC_NLA_SOCK_MAX,
|
||||
attrs[TIPC_NLA_SOCK],
|
||||
tipc_nl_sock_policy);
|
||||
--
|
||||
2.5.5
|
||||
|
||||
Loading…
Reference in New Issue