android_kernel_samsung_msm8976/kernel
Eric W. Biederman 6b7d2f5b6e unshare: Unsharing a thread does not require unsharing a vm
commit 12c641ab8270f787dfcce08b5f20ce8b65008096 upstream.

In the logic in the initial commit of unshare made creating a new
thread group for a process, contingent upon creating a new memory
address space for that process.  That is wrong.  Two separate
processes in different thread groups can share a memory address space
and clone allows creation of such proceses.

This is significant because it was observed that mm_users > 1 does not
mean that a process is multi-threaded, as reading /proc/PID/maps
temporarily increments mm_users, which allows other processes to
(accidentally) interfere with unshare() calls.

Correct the check in check_unshare_flags() to test for
!thread_group_empty() for CLONE_THREAD, CLONE_SIGHAND, and CLONE_VM.
For sighand->count > 1 for CLONE_SIGHAND and CLONE_VM.
For !current_is_single_threaded instead of mm_users > 1 for CLONE_VM.

By using the correct checks in unshare this removes the possibility of
an accidental denial of service attack.

Additionally using the correct checks in unshare ensures that only an
explicit unshare(CLONE_VM) can possibly trigger the slow path of
current_is_single_threaded().  As an explict unshare(CLONE_VM) is
pointless it is not expected there are many applications that make
that call.

Fixes: b2e0d98705 userns: Implement unshare of the user namespace
Reported-by: Ricky Zhou <rickyz@chromium.org>
Reported-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-10-01 12:07:28 +02:00
..
cpu sched, idle: Fix the idle polling state logic 2013-11-29 11:11:42 -08:00
debug kdb: fix incorrect counts in KDB summary command output 2015-03-06 14:40:52 -08:00
events perf: Fix fasync handling on inherited events 2015-09-13 09:07:59 -07:00
gcov
irq genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD 2015-08-10 12:20:30 -07:00
power PM / QoS: remove duplicate call to pm_qos_update_target 2015-03-18 13:22:28 +01:00
sched printk: rename printk_sched to printk_deferred 2014-08-07 14:30:26 -07:00
time ntp: Fixup adjtimex freq validation on 32-bit systems 2015-03-06 14:40:52 -08:00
trace tracing: Have branch tracer use recursive field of task struct 2015-08-03 09:29:45 -07:00
.gitignore
acct.c fs: Fix hang with BSD accounting on frozen filesystem 2013-05-04 14:57:58 -04:00
async.c
audit.c CAPABILITIES: remove undefined caps from all processes 2014-09-17 09:03:57 -07:00
audit.h audit: fix mq_open and mq_unlink to add the MQ root as a hidden parent audit_names record 2013-12-04 10:57:03 -08:00
audit_tree.c audit: keep inode pinned 2014-11-21 09:22:52 -08:00
audit_watch.c
auditfilter.c auditfilter.c: fix kernel-doc warnings 2013-05-24 16:22:52 -07:00
auditsc.c auditsc: audit_krule mask accesses need bounds checking 2014-06-16 13:42:53 -07:00
backtracetest.c
bounds.c
capability.c CAPABILITIES: remove undefined caps from all processes 2014-09-17 09:03:57 -07:00
cgroup.c move d_rcu from overlapping d_child to overlapping d_alias 2015-04-29 10:34:00 +02:00
cgroup_freezer.c
compat.c
configs.c
context_tracking.c Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-06-20 08:18:35 -10:00
cpu.c sched: Fix hotplug vs. set_cpus_allowed_ptr() 2014-06-11 12:03:24 -07:00
cpu_pm.c
cpuset.c cpuset,mempolicy: fix sleeping function called from invalid context 2014-07-17 15:58:00 -07:00
crash_dump.c
cred.c
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c introduce for_each_thread() to replace the buggy while_each_thread() 2014-10-05 14:54:15 -07:00
extable.c
fork.c unshare: Unsharing a thread does not require unsharing a vm 2015-10-01 12:07:28 +02:00
freezer.c freezer: Do not freeze tasks killed by OOM killer 2014-11-14 08:47:58 -08:00
futex.c futex: Make lookup_pi_state more robust 2014-06-07 13:25:41 -07:00
futex_compat.c
groups.c userns: Don't allow setgroups until a gid mapping has been setablished 2015-01-08 09:58:16 -08:00
hrtimer.c hrtimer: Set expiry time before switch_hrtimer_base() 2014-06-07 13:25:31 -07:00
hung_task.c
irq_work.c
itimer.c
jump_label.c
kallsyms.c
kcmp.c kcmp: fix standard comparison bug 2014-10-05 14:54:13 -07:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks locking/mutex: Disable optimistic spinning on some architectures 2014-07-28 08:00:07 -07:00
Kconfig.preempt
kexec.c PCI: Disable Bus Master only on kexec reboot 2013-12-20 07:45:08 -08:00
kmod.c usermodehelper: check subprocess_info->path != NULL 2013-05-16 12:01:11 -07:00
kprobes.c kprobes: Fix to free gone and unused optprobes 2013-05-28 10:37:59 +02:00
ksysfs.c
kthread.c
latencytop.c
lglock.c
lockdep.c Merge branch 'for-3.10/drivers' of git://git.kernel.dk/linux-block 2013-05-08 11:51:05 -07:00
lockdep_internals.h
lockdep_proc.c
lockdep_states.h
Makefile We get rid of the general module prefix confusion with a binary config option, 2013-05-05 10:58:06 -07:00
modsign_certificate.S
modsign_pubkey.c
module-internal.h
module.c modules, lock around setting of MODULE_STATE_UNFORMED 2014-11-14 08:47:55 -08:00
module_signing.c
mutex-debug.c
mutex-debug.h
mutex.c
mutex.h
notifier.c
nsproxy.c proc: Split the namespace stuff out into linux/proc_ns.h 2013-05-01 17:29:39 -04:00
padata.c
panic.c
params.c
pid.c exit: pidns: alloc_pid() leaks pid_namespace if child_reaper is exiting 2015-01-08 09:58:17 -08:00
pid_namespace.c pid_namespace: pidns_get() should check task_active_pid_ns() != NULL 2014-04-26 17:15:34 -07:00
posix-cpu-timers.c
posix-timers.c posix-timers: Fix stack info leak in timer_create() 2014-11-14 08:48:00 -08:00
printk.c console: Fix console name size mismatch 2015-04-19 10:10:51 +02:00
profile.c
ptrace.c __ptrace_may_access() should not deny sub-threads 2015-07-03 19:48:08 -07:00
range.c range: Do not add new blank slot with add_range_with_merge 2013-06-18 11:32:10 -05:00
rcu.h
rcupdate.c
rcutiny.c
rcutiny_plugin.h
rcutorture.c
rcutree.c rcu: Fix deadlock with CPU hotplug, RCU GP init, and timer migration 2013-06-10 13:37:12 -07:00
rcutree.h rcu: Don't call wakeup() with rcu_node structure ->lock held 2013-06-10 13:37:11 -07:00
rcutree_plugin.h rcu: Don't allocate bootmem from rcu_init() 2013-05-15 10:41:12 -07:00
rcutree_trace.c rcutrace: single_open() leaks 2013-05-05 00:16:35 -04:00
relay.c Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block 2013-05-08 10:13:35 -07:00
res_counter.c
resource.c
rtmutex-debug.c
rtmutex-debug.h rtmutex: Handle deadlock detection smarter 2014-07-17 15:58:04 -07:00
rtmutex-tester.c
rtmutex.c rtmutex: Plug slow unlock race 2014-07-17 15:58:04 -07:00
rtmutex.h rtmutex: Handle deadlock detection smarter 2014-07-17 15:58:04 -07:00
rtmutex_common.h
rwsem.c
seccomp.c
semaphore.c
signal.c signal: fix information leak in copy_siginfo_from_user32 2015-08-16 20:51:42 -07:00
smp.c kernel/smp.c:on_each_cpu_cond(): fix warning in fallback path 2014-09-17 09:03:57 -07:00
smpboot.c smpboot: Add missing get_online_cpus() in smpboot_register_percpu_thread() 2015-02-11 14:48:17 +08:00
smpboot.h
softirq.c revert "softirq: Add support for triggering softirq work on softirqs" 2015-05-17 09:51:33 -07:00
spinlock.c
srcu.c
stacktrace.c
stop_machine.c
sys.c reboot: rigrate shutdown/reboot to boot cpu 2013-06-12 16:29:44 -07:00
sys_ni.c unify compat fanotify_mark(2), switch to COMPAT_SYSCALL_DEFINE 2013-05-09 13:46:38 -04:00
sysctl.c perf: Enforce 1 as lower limit for perf_event_max_sample_rate 2014-06-11 12:03:27 -07:00
sysctl_binary.c switch compat_sys_sysctl to COMPAT_SYSCALL_DEFINE 2013-05-09 14:53:20 -04:00
task_work.c
taskstats.c
test_kprobes.c
time.c time: settimeofday: Validate the values of tv from user 2015-01-29 17:40:56 -08:00
timeconst.bc
timer.c timer: Prevent overflow in apply_slack 2014-06-07 13:25:30 -07:00
tracepoint.c tracepoint: Do not waste memory on mods with no tracepoints 2014-05-30 21:52:11 -07:00
tsacct.c
uid16.c groups: Consolidate the setgroups permission checks 2015-01-08 09:58:16 -08:00
up.c
user-return-notifier.c
user.c userns: Add a knob to disable setgroups on a per user namespace basis 2015-01-08 09:58:16 -08:00
user_namespace.c userns: Allow setting gid_maps without privilege when setgroups is disabled 2015-01-08 09:58:17 -08:00
utsname.c proc: Split the namespace stuff out into linux/proc_ns.h 2013-05-01 17:29:39 -04:00
utsname_sysctl.c
wait.c
watchdog.c
workqueue.c workqueue: fix hang involving racing cancel[_delayed]_work_sync()'s for PREEMPT_NONE 2015-03-26 15:00:58 +01:00
workqueue_internal.h