Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity
android_kernel_google_msm/fs
History
Ben Hutchings eca06b4558 pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic 
pipe_iov_copy_{from,to}_user() may be tried twice with the same iovec,
the first time atomically and the second time not.  The second attempt
needs to continue from the iovec position, pipe buffer offset and
remaining length where the first attempt failed, but currently the
pipe buffer offset and remaining length are reset.  This will corrupt
the piped data (possibly also leading to an information leak between
processes) and may also corrupt kernel memory.

This was fixed upstream by commits f0d1bec9d5 ("new helper:
copy_page_from_iter()") and 637b58c288 ("switch pipe_read() to
copy_page_to_iter()"), but those aren't suitable for stable.  This fix
for older kernel versions was made by Seth Jennings for RHEL and I
have extracted it from their update.

CVE-2015-1805

Bug: 27275324

Change-Id: I459adb9076fcd50ff1f1c557089c4e421b036ec4
References: https://bugzilla.redhat.com/show_bug.cgi?id=1202855
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 85c34d007116f8a8aafb173966a605fb03532f45)
2016-03-17 13:53:10 -07:00
..
9p 9p changes for the 3.4 merge window 2012-03-28 09:58:38 -07:00
adfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
affs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
afs Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-03-21 13:36:41 -07:00
autofs4 autofs: make the autofsv5 packet file descriptor use a packetized pipe 2012-04-29 13:30:08 -07:00
befs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
bfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
btrfs Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs 2012-05-06 10:20:07 -07:00
cachefiles switch touch_atime to struct path 2012-03-20 21:29:41 -04:00
ceph Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 2012-03-28 10:01:29 -07:00
cifs freezer: add unsafe versions of freezable helpers for CIFS 2013-07-12 14:22:55 -07:00
coda Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
configfs make configfs_pin_fs() return root dentry on success 2012-03-20 21:29:48 -04:00
cramfs Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-03-21 13:36:41 -07:00
debugfs simple_open: automatically convert to simple_open() 2012-04-05 15:25:50 -07:00
devpts Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-03-21 13:36:41 -07:00
dlm dlm fixes for 3.4 2012-04-23 18:22:42 -07:00
ecryptfs ecryptfs: make register_filesystem() the last potential failure exit 2012-03-20 21:29:49 -04:00
efs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
exofs Merge branch 'for-linus' of git://git.open-osd.org/linux-open-osd 2012-03-28 20:04:27 -07:00
exportfs
ext2 migrate ext2_fs.h guts to fs/ext2/ext2.h 2012-03-31 16:03:16 -04:00
ext3 ext3: move headers to fs/ext3/ 2012-03-31 16:03:16 -04:00
ext4 ext4: protect group inode free counting with group lock 2013-04-18 16:07:55 -07:00
fat fs: fat: rate limit the kernel messages 2013-02-20 02:49:28 -08:00
freevxfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
fscache
fuse fs: introduce inode operation ->update_time 2015-07-13 11:17:49 -07:00
gfs2 GFS2: Instruct DLM to avoid queue convert slowdown 2012-04-24 13:26:50 +01:00
hfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
hfsplus hfsplus: Fix potential buffer overflows 2012-05-04 17:11:24 -07:00
hostfs Merge branch 'for-linus-3.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml 2012-03-27 18:29:53 -07:00
hpfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
hppfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
hugetlbfs hugetlbfs: lockdep annotate root inode properly 2012-04-25 21:26:34 -07:00
isofs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
jbd Power management updates for 3.4 2012-03-21 10:15:51 -07:00
jbd2 jbd2: use GFP_NOFS for blkdev_issue_flush 2012-04-23 21:43:41 -04:00
jffs2 jffs2: Fix lock acquisition order bug in gc path 2012-05-07 20:30:14 +01:00
jfs jfs: mising cleanup on register_filesystem() failure 2012-03-20 21:29:48 -04:00
lockd lockd: fix the endianness bug 2012-04-13 13:50:52 -04:00
logfs Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-03-21 13:36:41 -07:00
minix Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-03-21 13:36:41 -07:00
ncpfs fs: introduce inode operation ->update_time 2015-07-13 11:17:49 -07:00
nfs freezer: add unsafe versions of freezable helpers for NFS 2013-07-12 14:22:55 -07:00
nfs_common
nfsd nfsd: fix nfs4recover.c printk format warning 2012-04-30 12:28:48 -07:00
nilfs2 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-03-21 13:36:41 -07:00
nls
notify fs/notify/notification.c: make subsys_initcall function static 2012-03-23 16:58:31 -07:00
ntfs fs: introduce inode operation ->update_time 2015-07-13 11:17:49 -07:00
ocfs2 ocfs2: ->e_leaf_clusters endianness breakage 2012-04-13 12:31:43 -04:00
omfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
openpromfs switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
proc BACKPORT: pagemap: do not leak physical addresses to non-privileged userspace 2016-01-12 17:15:28 -05:00
pstore Merge branch 'akpm' (Andrew's patch-bomb) 2012-04-05 15:30:34 -07:00
qnx4 qnx4: new helper - try_extent() 2012-03-20 21:29:52 -04:00
qnx6 fs: initial qnx6fs addition 2012-03-20 21:29:38 -04:00
quota Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 2012-03-28 10:00:14 -07:00
ramfs tidy up after d_make_root() conversion 2012-03-20 21:29:37 -04:00
reiserfs Disintegrate and delete asm/system.h 2012-03-28 15:58:21 -07:00
romfs MTD merge for 3.4 2012-03-30 17:31:56 -07:00
squashfs Add an extra mount time sanity check, plus some code cleanups and bug fixes. 2012-03-28 18:05:54 -07:00
sysfs sysfs: handle 'parent deleted before child added' 2012-04-10 14:48:51 -07:00
sysv switch open-coded instances of d_make_root() to new helper 2012-03-20 21:29:35 -04:00
ubifs ubifs: Fix compiler warning 2013-02-27 18:10:47 -08:00
udf Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 2012-03-28 10:00:14 -07:00
ufs Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
xfs fs: introduce inode operation ->update_time 2015-07-13 11:17:49 -07:00
yaffs2 fs: yaffs2: Add null pointer check before dereferencing inode 2013-02-27 18:19:17 -08:00
aio.c kill mm argument of vm_munmap() 2012-04-21 01:58:20 -04:00
anon_inodes.c anon_inodes: move allocation of anon_inode into ->mount() 2012-03-20 21:29:45 -04:00
attr.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
bad_inode.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
binfmt_aout.c VM: add "vm_mmap()" helper function 2012-04-20 17:29:13 -07:00
binfmt_elf.c VM: add "vm_mmap()" helper function 2012-04-20 17:29:13 -07:00
binfmt_elf_fdpic.c VM: add "vm_mmap()" helper function 2012-04-20 17:29:13 -07:00
binfmt_em86.c __register_binfmt() made void 2012-03-20 21:29:46 -04:00
binfmt_flat.c VM: add "vm_mmap()" helper function 2012-04-20 17:29:13 -07:00
binfmt_misc.c magic.h: move some FS magic numbers into magic.h 2012-03-23 16:58:31 -07:00
binfmt_script.c __register_binfmt() made void 2012-03-20 21:29:46 -04:00
binfmt_som.c VM: add "vm_mmap()" helper function 2012-04-20 17:29:13 -07:00
bio-integrity.c fs: remove the second argument of k[un]map_atomic() 2012-03-20 21:48:21 +08:00
bio.c bio allocation failure due to bio_get_nr_vecs() 2012-05-11 16:45:12 +02:00
block_dev.c block: don't mark buffers beyond end of disk as mapped 2012-05-11 16:42:14 +02:00
buffer.c block: fix infinite loop in __getblk_slow 2013-03-15 17:09:41 -07:00
char_dev.c
compat.c Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-03-29 18:12:23 -07:00
compat_binfmt_elf.c
compat_ioctl.c net: bluetooth: ioctl entry to modify auth info. 2013-02-25 11:37:16 -08:00
dcache.c get rid of ->mnt_longterm 2015-07-13 11:17:44 -07:00
dcookies.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
direct-io.c Restore direct_io / truncate locking API 2012-02-23 15:56:21 -08:00
drop_caches.c
eventfd.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
eventpoll.c epoll: use freezable blocking call 2013-07-12 14:22:57 -07:00
exec.c seccomp: implement SECCOMP_FILTER_FLAG_TSYNC 2014-10-31 19:46:31 -07:00
fcntl.c Wrap accesses to the fd_sets in struct fdtable 2012-02-19 10:30:52 -08:00
fhandle.c
fifo.c
file.c Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-03-29 18:12:23 -07:00
file_table.c brlocks/lglocks: API cleanups 2015-07-13 11:17:41 -07:00
filesystems.c
fs-writeback.c ext4: fix potential deadlock in ext4_nonda_switch() 2013-03-15 17:09:42 -07:00
fs_struct.c get rid of ->mnt_longterm 2015-07-13 11:17:44 -07:00
generic_acl.c
inode.c fs: introduce inode operation ->update_time 2015-07-13 11:17:49 -07:00
internal.h get rid of ->mnt_longterm 2015-07-13 11:17:44 -07:00
ioctl.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
ioprio.c block: strip out locking optimization in put_io_context() 2012-02-07 07:51:30 +01:00
Kconfig fs: yaffs: Import yaffs from Thu Dec 23 13:31:37 2010 +1300 2012-04-09 13:57:46 -07:00
Kconfig.binfmt
libfs.c dentry leak in simple_fill_super() failure exit 2012-04-09 01:39:22 -04:00
locks.c CIFS: Fix VFS lock usage for oplocked files 2012-04-01 13:54:27 -05:00
Makefile fs: yaffs: Import yaffs from Thu Dec 23 13:31:37 2010 +1300 2012-04-09 13:57:46 -07:00
mbcache.c
mount.h proc: Usable inode numbers for the namespace file descriptors. 2015-07-13 11:18:01 -07:00
mpage.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
namei.c VFS: Comment mount following code 2015-07-13 11:17:48 -07:00
namespace.c proc: Usable inode numbers for the namespace file descriptors. 2015-07-13 11:18:01 -07:00
no-block.c
open.c vfs: check if f_count is 0 or negative 2014-12-04 13:01:58 -08:00
pipe.c pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic 2016-03-17 13:53:10 -07:00
pnode.c VFS: Make clone_mnt()/copy_tree()/collect_mounts() return errors 2015-07-13 11:17:46 -07:00
pnode.h vfs: Only support slave subtrees across different user namespaces 2015-07-13 11:17:56 -07:00
posix_acl.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
proc_namespace.c get rid of magic in proc_namespace.c 2015-07-13 11:17:45 -07:00
read_write.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
read_write.h
readdir.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
select.c select: use freezable blocking call 2013-07-12 14:22:58 -07:00
seq_file.c fs/seq_file: Use vmalloc by default for allocations > PAGE_SIZE 2014-11-18 15:13:24 -08:00
signalfd.c epoll: ep_unregister_pollwait() can use the freed pwq->whead 2012-02-24 11:42:50 -08:00
splice.c fs: introduce inode operation ->update_time 2015-07-13 11:17:49 -07:00
stack.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
stat.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
statfs.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
super.c The following text was taken from the original review request: 2012-03-24 10:24:31 -07:00
sync.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
timerfd.c
utimes.c
xattr.c fs/xattr.c:setxattr(): improve handling of allocation failures 2012-04-05 15:25:50 -07:00
xattr_acl.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00