Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/kernel
History
Eric W. Biederman 8b2fd5dcdf signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO 
[ Upstream commit f6e2aa91a46d2bc79fce9b93a988dbe7655c90c0 ]

Recently syzbot in conjunction with KMSAN reported that
ptrace_peek_siginfo can copy an uninitialized siginfo to userspace.
Inspecting ptrace_peek_siginfo confirms this.

The problem is that off when initialized from args.off can be
initialized to a negaive value.  At which point the "if (off >= 0)"
test to see if off became negative fails because off started off
negative.

Prevent the core problem by adding a variable found that is only true
if a siginfo is found and copied to a temporary in preparation for
being copied to userspace.

Prevent args.off from being truncated when being assigned to off by
testing that off is <= the maximum possible value of off.  Convert off
to an unsigned long so that we should not have to truncate args.off,
we have well defined overflow behavior so if we add another check we
won't risk fighting undefined compiler behavior, and so that we have a
type whose maximum value is easy to test for.

Cc: Andrei Vagin <avagin@gmail.com>
Cc: stable@vger.kernel.org
Reported-by: syzbot+0d602a1b0d8c95bdf299@syzkaller.appspotmail.com
Fixes: 84c751bd4a ("ptrace: add ability to retrieve signals without removing from a queue (v4)")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2019-07-27 22:11:17 +02:00
..
cpu sched/idle: Add missing checks to the exit condition of cpu_idle_poll() 2019-07-27 21:50:45 +02:00
debug mm: per-thread vma caching 2019-07-27 22:08:06 +02:00
events perf/core: Fix impossible ring-buffer sizes warning 2019-07-27 22:10:22 +02:00
gcov
…
irq This is the 3.10.99 stable release 2017-04-18 17:17:46 +02:00
locking locking/lockdep: Use for_each_process_thread() for debug_show_all_locks() 2019-07-27 22:09:22 +02:00
power workqueues: Introduce new flag WQ_POWER_EFFICIENT for power oriented workqueues 2019-07-27 22:11:01 +02:00
rcu rcu: Move SRCU grace period work to power efficient workqueue 2019-07-27 22:11:07 +02:00
sched sched/rt: Reduce rq lock contention by eliminating locking of non-feasible target 2019-07-27 22:11:08 +02:00
time timekeeping: Move clock sync work to power efficient workqueue 2019-07-27 22:11:06 +02:00
trace trace: Fix preempt_enable_no_resched() abuse 2019-07-27 22:10:40 +02:00
.gitignore
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks Import latest Samsung release 2017-04-18 03:43:52 +02:00
Kconfig.preempt
…
Makefile UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing 2016-05-18 14:36:10 +05:30
acct.c
…
async.c kernel/async.c: revert "async: simplify lowest_in_progress()" 2019-07-27 21:49:48 +02:00
audit.c BACKPORT: audit: consistently record PIDs with task_tgid_nr() 2019-07-27 21:50:56 +02:00
audit.h Import latest Samsung release 2017-04-18 03:43:52 +02:00
audit_tree.c
…
audit_watch.c audit: fix use-after-free in audit_add_watch 2019-07-27 21:51:40 +02:00
auditfilter.c
…
auditsc.c BACKPORT: audit: consistently record PIDs with task_tgid_nr() 2019-07-27 21:50:56 +02:00
backtracetest.c
…
bounds.c
…
capability.c
…
cgroup.c cgroup: prefer %pK to %p 2016-12-06 09:24:09 -08:00
cgroup_freezer.c
…
compat.c
…
configs.c
…
context_tracking.c
…
cpu.c cpu: send KOBJ_ONLINE event when enabling cpus 2017-07-24 01:09:04 -07:00
cpu_pm.c
…
cpuset.c sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs 2019-07-27 22:08:19 +02:00
crash_dump.c
…
cred.c
…
delayacct.c
…
dma.c
…
elfcore.c
…
exec_domain.c ANDROID: exec_domains: Disable request_module() call for personalities 2016-05-18 14:34:40 +05:30
exit.c wait/ptrace: assume __WALL if the child is traced 2019-07-27 22:09:56 +02:00
extable.c kernel/extable.c: mark core_kernel_text notrace 2019-07-27 21:44:25 +02:00
fork.c fork: Allow CLONE_PARENT after setns(CLONE_NEWPID) 2019-07-27 22:10:35 +02:00
freezer.c freezer: set PF_SUSPEND_TASK flag on tasks that call freeze_processes 2019-07-27 22:09:18 +02:00
futex.c futex: Ensure that futex address is aligned in handle_futex_death() 2019-07-27 22:08:53 +02:00
futex_compat.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2016-02-25 11:57:47 -08:00
groups.c kernel: make groups_sort calling a responsibility group_info allocators 2019-07-27 21:46:18 +02:00
hrtimer.c hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) 2019-07-27 21:49:51 +02:00
hung_task.c kernel/hung_task.c: change hung_task.c to use for_each_process_thread() 2019-07-27 22:09:21 +02:00
irq_work.c irq_work: Remove BUG_ON in irq_work_run() 2016-01-07 00:42:12 -08:00
itimer.c
…
jump_label.c
…
kallsyms.c kernel: use macros from compiler.h instead of __attribute__((...)) 2019-07-27 22:10:27 +02:00
kcmp.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2016-02-25 11:57:47 -08:00
kexec.c kernel: use macros from compiler.h instead of __attribute__((...)) 2019-07-27 22:10:27 +02:00
kmod.c
…
kprobes.c
…
ksysfs.c kernel: use macros from compiler.h instead of __attribute__((...)) 2019-07-27 22:10:27 +02:00
kthread.c kthread: Fix the race condition when kthread is parked 2015-06-04 17:43:41 -07:00
latencytop.c
…
modsign_pubkey.c
…
module-internal.h UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing 2016-05-18 14:36:10 +05:30
module.c param: hand arguments after -- straight to init 2019-07-27 22:10:44 +02:00
module_signing.c UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing 2016-05-18 14:36:10 +05:30
notifier.c
…
nsproxy.c Rename nsproxy.pid_ns to nsproxy.pid_ns_for_children 2019-07-27 22:10:33 +02:00
padata.c padata: avoid race in reordering 2019-07-27 21:44:05 +02:00
panic.c printk: do cond_resched() between lines while outputting to consoles 2019-07-27 21:41:46 +02:00
params.c param: hand arguments after -- straight to init 2019-07-27 22:10:44 +02:00
pid.c kernel/fork.c:copy_process(): don't add the uninitialized child to thread/task/pid lists 2019-07-27 22:10:32 +02:00
pid_namespace.c Rename nsproxy.pid_ns to nsproxy.pid_ns_for_children 2019-07-27 22:10:33 +02:00
posix-cpu-timers.c posix-timers: Sanitize overrun handling 2019-07-27 21:53:21 +02:00
posix-timers.c posix-timers: Sanitize overrun handling 2019-07-27 21:53:21 +02:00
printk.c printk: use rcuidle console tracepoint 2019-07-27 21:44:09 +02:00
profile.c
…
ptrace.c signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO 2019-07-27 22:11:17 +02:00
range.c
…
relay.c treewide: Fix typo in Documentation/DocBook 2019-07-27 22:10:20 +02:00
res_counter.c
…
resource.c /proc/iomem: only expose physical resource addresses to privileged users 2019-07-27 22:05:58 +02:00
seccomp.c UPSTREAM: seccomp: always propagate NO_NEW_PRIVS on tsync 2019-07-27 21:51:01 +02:00
signal.c kernel: use macros from compiler.h instead of __attribute__((...)) 2019-07-27 22:10:27 +02:00
smp.c Import latest Samsung release 2017-04-18 03:43:52 +02:00
smpboot.c smpboot: use kmemleak_not_leak for smpboot_thread_data 2015-05-11 17:07:29 +05:30
smpboot.h
…
softirq.c Import latest Samsung release 2017-04-18 03:43:52 +02:00
stacktrace.c
…
stop_machine.c
…
sys.c exit.c: unexport __set_special_pids() 2019-07-27 22:09:28 +02:00
sys_ni.c seccomp: add "seccomp" syscall 2015-03-19 14:52:50 -07:00
sysctl.c kernel/sysctl.c: fix out-of-bounds access when setting file-max 2019-07-27 22:10:11 +02:00
sysctl_binary.c
…
system_certificates.S UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing 2016-05-18 14:36:10 +05:30
system_keyring.c UPSTREAM: KEYS: Separate the kernel signature checking keyring from module signing 2016-05-18 14:36:10 +05:30
task_work.c
…
taskstats.c
…
test_kprobes.c
…
time.c time: Make sure jiffies_to_msecs() preserves non-zero time periods 2019-07-27 21:52:48 +02:00
timeconst.bc
…
timer.c timers: Use proper base migration in add_timer_on() 2019-07-27 21:42:23 +02:00
tracepoint.c tracing: syscall_regfunc() should not skip kernel threads 2019-07-27 22:09:17 +02:00
tsacct.c
…
uid16.c kernel: make groups_sort calling a responsibility group_info allocators 2019-07-27 21:46:18 +02:00
up.c
…
user-return-notifier.c
…
user.c
…
user_namespace.c userns: move user access out of the mutex 2019-07-27 21:51:26 +02:00
utsname.c
…
utsname_sysctl.c
…
watchdog.c
…
workqueue.c workqueue: Add system wide power_efficient workqueues 2019-07-27 22:11:01 +02:00
workqueue_internal.h
…