Mathieu Desnoyers 1a4fb51a8b kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() ... I found the following pattern that leads in to interesting findings: grep -r "ret.*|=.*__put_user" * grep -r "ret.*|=.*__get_user" * grep -r "ret.*|=.*__copy" * The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat, since those appear in compat code, we could probably expect the kernel addresses not to be reachable in the lower 32-bit range, so I think they might not be exploitable. For the "__get_user" cases, I don't think those are exploitable: the worse that can happen is that the kernel will copy kernel memory into in-kernel buffers, and will fail immediately afterward. The alpha csum_partial_copy_from_user() seems to be missing the access_ok() check entirely. The fix is inspired from x86. This could lead to information leak on alpha. I also noticed that many architectures map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I wonder if the latter is performing the access checks on every architectures. Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Matt Turner <mattst88@gmail.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Oleg Nesterov <oleg@redhat.com> Cc: David Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2019-07-27 22:10:26 +02:00
..
cpu	sched/idle: Add missing checks to the exit condition of cpu_idle_poll()	2019-07-27 21:50:45 +02:00
debug	mm: per-thread vma caching	2019-07-27 22:08:06 +02:00
events	perf/core: Fix impossible ring-buffer sizes warning	2019-07-27 22:10:22 +02:00
gcov	…
irq	This is the 3.10.99 stable release	2017-04-18 17:17:46 +02:00
locking	locking/lockdep: Use for_each_process_thread() for debug_show_all_locks()	2019-07-27 22:09:22 +02:00
power	PM: convert do_each_thread to for_each_process_thread	2019-07-27 22:09:18 +02:00
rcu	rcu: Don't disable CPU hotplug during OOM notifiers	2016-01-06 23:11:06 -08:00
sched	sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup	2019-07-27 22:10:10 +02:00
time	nohz: Fix local_timer_softirq_pending()	2019-07-27 21:52:58 +02:00
trace	tracing: kdb: Fix ftdump to not sleep	2019-07-27 22:10:01 +02:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	Import latest Samsung release	2017-04-18 03:43:52 +02:00
Kconfig.preempt	…
Makefile	UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing	2016-05-18 14:36:10 +05:30
acct.c	…
async.c	kernel/async.c: revert "async: simplify lowest_in_progress()"	2019-07-27 21:49:48 +02:00
audit.c	BACKPORT: audit: consistently record PIDs with task_tgid_nr()	2019-07-27 21:50:56 +02:00
audit.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
audit_tree.c	…
audit_watch.c	audit: fix use-after-free in audit_add_watch	2019-07-27 21:51:40 +02:00
auditfilter.c	…
auditsc.c	BACKPORT: audit: consistently record PIDs with task_tgid_nr()	2019-07-27 21:50:56 +02:00
backtracetest.c	…
bounds.c	…
capability.c	…
cgroup.c	cgroup: prefer %pK to %p	2016-12-06 09:24:09 -08:00
cgroup_freezer.c	…
compat.c	…
configs.c	…
context_tracking.c	…
cpu.c	cpu: send KOBJ_ONLINE event when enabling cpus	2017-07-24 01:09:04 -07:00
cpu_pm.c	…
cpuset.c	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs	2019-07-27 22:08:19 +02:00
crash_dump.c	…
cred.c	…
delayacct.c	…
dma.c	…
elfcore.c	…
exec_domain.c	ANDROID: exec_domains: Disable request_module() call for personalities	2016-05-18 14:34:40 +05:30
exit.c	wait/ptrace: assume __WALL if the child is traced	2019-07-27 22:09:56 +02:00
extable.c	kernel/extable.c: mark core_kernel_text notrace	2019-07-27 21:44:25 +02:00
fork.c	Revert "android/lowmemorykiller: Ignore tasks with freed mm"	2019-07-27 22:09:48 +02:00
freezer.c	freezer: set PF_SUSPEND_TASK flag on tasks that call freeze_processes	2019-07-27 22:09:18 +02:00
futex.c	futex: Ensure that futex address is aligned in handle_futex_death()	2019-07-27 22:08:53 +02:00
futex_compat.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 11:57:47 -08:00
groups.c	kernel: make groups_sort calling a responsibility group_info allocators	2019-07-27 21:46:18 +02:00
hrtimer.c	hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)	2019-07-27 21:49:51 +02:00
hung_task.c	kernel/hung_task.c: change hung_task.c to use for_each_process_thread()	2019-07-27 22:09:21 +02:00
irq_work.c	irq_work: Remove BUG_ON in irq_work_run()	2016-01-07 00:42:12 -08:00
itimer.c	…
jump_label.c	…
kallsyms.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
kcmp.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 11:57:47 -08:00
kexec.c	…
kmod.c	…
kprobes.c	…
ksysfs.c	…
kthread.c	kthread: Fix the race condition when kthread is parked	2015-06-04 17:43:41 -07:00
latencytop.c	…
modsign_pubkey.c	…
module-internal.h	UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing	2016-05-18 14:36:10 +05:30
module.c	module: Invalidate signatures on force-loaded modules	2019-07-27 21:42:00 +02:00
module_signing.c	UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing	2016-05-18 14:36:10 +05:30
notifier.c	…
nsproxy.c	…
padata.c	padata: avoid race in reordering	2019-07-27 21:44:05 +02:00
panic.c	printk: do cond_resched() between lines while outputting to consoles	2019-07-27 21:41:46 +02:00
params.c	kernel/params.c: align add_sysfs_param documentation with code	2019-07-27 21:45:35 +02:00
pid.c	BACKPORT: FROMLIST: pids: make task_tgid_nr_ns() safe	2018-05-26 00:39:33 +02:00
pid_namespace.c	…
posix-cpu-timers.c	posix-timers: Sanitize overrun handling	2019-07-27 21:53:21 +02:00
posix-timers.c	posix-timers: Sanitize overrun handling	2019-07-27 21:53:21 +02:00
printk.c	printk: use rcuidle console tracepoint	2019-07-27 21:44:09 +02:00
profile.c	…
ptrace.c	ptrace: revert "Prepare to fix racy accesses on task breakpoints"	2019-07-27 22:09:55 +02:00
range.c	…
relay.c	treewide: Fix typo in Documentation/DocBook	2019-07-27 22:10:20 +02:00
res_counter.c	…
resource.c	/proc/iomem: only expose physical resource addresses to privileged users	2019-07-27 22:05:58 +02:00
seccomp.c	UPSTREAM: seccomp: always propagate NO_NEW_PRIVS on tsync	2019-07-27 21:51:01 +02:00
signal.c	kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user()	2019-07-27 22:10:26 +02:00
smp.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
smpboot.c	…
smpboot.h	…
softirq.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
stacktrace.c	…
stop_machine.c	…
sys.c	exit.c: unexport __set_special_pids()	2019-07-27 22:09:28 +02:00
sys_ni.c	…
sysctl.c	kernel/sysctl.c: fix out-of-bounds access when setting file-max	2019-07-27 22:10:11 +02:00
sysctl_binary.c	…
system_certificates.S	UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing	2016-05-18 14:36:10 +05:30
system_keyring.c	UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing	2016-05-18 14:36:10 +05:30
task_work.c	…
taskstats.c	…
test_kprobes.c	…
time.c	time: Make sure jiffies_to_msecs() preserves non-zero time periods	2019-07-27 21:52:48 +02:00
timeconst.bc	…
timer.c	timers: Use proper base migration in add_timer_on()	2019-07-27 21:42:23 +02:00
tracepoint.c	tracing: syscall_regfunc() should not skip kernel threads	2019-07-27 22:09:17 +02:00
tsacct.c	…
uid16.c	kernel: make groups_sort calling a responsibility group_info allocators	2019-07-27 21:46:18 +02:00
up.c	…
user-return-notifier.c	…
user.c	…
user_namespace.c	userns: move user access out of the mutex	2019-07-27 21:51:26 +02:00
utsname.c	…
utsname_sysctl.c	…
watchdog.c	…
workqueue.c	workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq	2019-07-27 21:45:23 +02:00
workqueue_internal.h	…