aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "BACKPORT: [UPSTREAM] mbcache2: reimplement mbcache"Mister Oyster2017-05-113-410/+1
| | | | This reverts commit 20ccd1e3ce3323d66ab29bf71cd75b337b2667a1.
* Revert "BACKPORT: [UPSTREAM] mm: new shrinker API"Mister Oyster2017-05-112-69/+29
| | | | This reverts commit db537c9914552c3472bd5c75ffe72327e9076f76.
* net: ping: check minimum size on ICMP header lengthKees Cook2017-05-101-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 0eab121ef8750a5c8637d51534d5e9143fb0633f upstream. Prior to commit c0371da6047a ("put iov_iter into msghdr") in v3.19, there was no check that the iovec contained enough bytes for an ICMP header, and the read loop would walk across neighboring stack contents. Since the iov_iter conversion, bad arguments are noticed, but the returned error is EFAULT. Returning EINVAL is a clearer error and also solves the problem prior to v3.19. This was found using trinity with KASAN on v3.18: BUG: KASAN: stack-out-of-bounds in memcpy_fromiovec+0x60/0x114 at addr ffffffc071077da0 Read of size 8 by task trinity-c2/9623 page:ffffffbe034b9a08 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x0() page dumped because: kasan: bad access detected CPU: 0 PID: 9623 Comm: trinity-c2 Tainted: G BU 3.18.0-dirty #15 Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT) Call trace: [<ffffffc000209c98>] dump_backtrace+0x0/0x1ac arch/arm64/kernel/traps.c:90 [<ffffffc000209e54>] show_stack+0x10/0x1c arch/arm64/kernel/traps.c:171 [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffc000f18dc4>] dump_stack+0x7c/0xd0 lib/dump_stack.c:50 [< inline >] print_address_description mm/kasan/report.c:147 [< inline >] kasan_report_error mm/kasan/report.c:236 [<ffffffc000373dcc>] kasan_report+0x380/0x4b8 mm/kasan/report.c:259 [< inline >] check_memory_region mm/kasan/kasan.c:264 [<ffffffc00037352c>] __asan_load8+0x20/0x70 mm/kasan/kasan.c:507 [<ffffffc0005b9624>] memcpy_fromiovec+0x5c/0x114 lib/iovec.c:15 [< inline >] memcpy_from_msg include/linux/skbuff.h:2667 [<ffffffc000ddeba0>] ping_common_sendmsg+0x50/0x108 net/ipv4/ping.c:674 [<ffffffc000dded30>] ping_v4_sendmsg+0xd8/0x698 net/ipv4/ping.c:714 [<ffffffc000dc91dc>] inet_sendmsg+0xe0/0x12c net/ipv4/af_inet.c:749 [< inline >] __sock_sendmsg_nosec net/socket.c:624 [< inline >] __sock_sendmsg net/socket.c:632 [<ffffffc000cab61c>] sock_sendmsg+0x124/0x164 net/socket.c:643 [< inline >] SYSC_sendto net/socket.c:1797 [<ffffffc000cad270>] SyS_sendto+0x178/0x1d8 net/socket.c:1761 CVE-2016-8399 Change-Id: I94349a8ff097843782048f9976712ad1c364d127 Reported-by: Qidan He <i@flanker017.me> Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David S. Miller <davem@davemloft.net> [bwh: Backported to 3.2: only ICMPv4 is supported] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
* Revert "net: ping: Fix stack buffer overflow in ping_common_sendmsg()"Mister Oyster2017-05-101-1/+1
| | | | This reverts commit db613b132bfc21191fc8741c4f201ddc818824f4.
* ping: implement proper lockingEric Dumazet2017-05-101-2/+3
| | | | | | | | | | | | | | | | | | | We got a report of yet another bug in ping http://www.openwall.com/lists/oss-security/2017/03/24/6 ->disconnect() is not called with socket lock held. Fix this by acquiring ping rwlock earlier. Thanks to Daniel, Alexander and Andrey for letting us know this problem. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Daniel Jiang <danieljiang0415@gmail.com> Reported-by: Solar Designer <solar@openwall.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* lmk: remove duplicate includeMister Oyster2017-05-101-1/+0
|
* android: fiq_debugger: restrict access to critical commands.Mark Salyzyn2017-05-103-34/+57
| | | | | | | | | | | | | | | | | | Sysrq must be enabled via /proc/sys/kernel/sysrq as a security measure to enable various critical fiq debugger commands that either leak information or can be used as a system attack. Default disabled, this will leave the reboot, reset, irqs, sleep, nosleep, console and ps commands. Reboot and reset commands will be restricted from taking any parameters. We will also switch to showing the limited command set in this mode. Signed-off-by: Mark Salyzyn <salyzyn@google.com> Bug: 32402555 Change-Id: I3f74b1ff5e4971d619bcb37a911fed68fbb538d5 Git-repo: https://android.googlesource.com/kernel/msm Git-commit: 1031836c0895f1f5a05c25efec83bfa11aa08ca9 Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
* CHROMIUM: usb: gadget: configfs: Fix KASAN use-after-freeJim Lin2017-05-101-5/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When gadget is disconnected, running sequence is like this. . composite_disconnect . Call trace: usb_string_copy+0xd0/0x128 gadget_config_name_configuration_store+0x4 gadget_config_name_attr_store+0x40/0x50 configfs_write_file+0x198/0x1f4 vfs_write+0x100/0x220 SyS_write+0x58/0xa8 . configfs_composite_unbind . configfs_composite_bind In configfs_composite_bind, it has "cn->strings.s = cn->configuration;" When usb_string_copy is invoked. it would allocate memory, copy input string, release previous pointed memory space, and use new allocated memory. When gadget is connected, host sends down request to get information. Call trace: usb_gadget_get_string+0xec/0x168 lookup_string+0x64/0x98 composite_setup+0xa34/0x1ee8 If gadget is disconnected and connected quickly, in the failed case, cn->configuration memory has been released by usb_string_copy kfree but configfs_composite_bind hasn't been run in time to assign new allocated "cn->configuration" pointer to "cn->strings.s". When "strlen(s->s) of usb_gadget_get_string is being executed, the dangling memory is accessed, "BUG: KASAN: use-after-free" error occurs. BUG=chrome-os-partner:58412 TEST=After smaug device was connected to ubuntu PC host, detached and attached type-C cable quickly several times without seeing "BUG: KASAN: use-after-free in usb_gadget_get_string". Change-Id: I58240ee7c55ae8f8fb8597d14f09c5ac07abb032 Signed-off-by: Jim Lin <jilin@nvidia.com> Reviewed-on: https://chromium-review.googlesource.com/428059 Commit-Ready: Jim Lin <jilin%nvidia.com@gtempaccount.com> Tested-by: Jim Lin <jilin%nvidia.com@gtempaccount.com> Reviewed-by: Adrian Salido <salidoa@google.com> Reviewed-by: Benson Leung <bleung@chromium.org> Git-repo: https://chromium.googlesource.com/chromiumos/third_party/kernel Git-commit: a7b597d255d70f6f0c6bfdfb7e4e04f67fcebf9d Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
* ANDROID: sdcardfs: Don't iput if we didn't igrabDaniel Roseberg2017-05-101-7/+2
| | | | | | | | | | | If we fail to get top, top is either NULL, or igrab found that we're in the process of freeing that inode, and did not grab it. Either way, we didn't grab it, and have no business putting it. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 38117720 Change-Id: Ie2f587483b9abb5144263156a443e89bc69b767b
* Staging: android: binder: Remove support for old 32 bit binder protocol.Arve Hjønnevåg2017-05-073-26/+0
| | | | | | Change-Id: I371072175a298282254a21ea69503b9d75633dc5 Signed-off-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Mister Oyster <oysterized@gmail.com>
* random: strengthen input validation for RNDADDTOENTCNTTheodore Ts'o2017-05-071-6/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't allow RNDADDTOENTCNT or RNDADDENTROPY to accept a negative entropy value. It doesn't make any sense to subtract from the entropy counter, and it can trigger a warning: random: negative entropy/overflow: pool input count -40000 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 6828 at drivers/char/random.c:670[< none >] credit_entropy_bits+0x21e/0xad0 drivers/char/random.c:670 Modules linked in: CPU: 3 PID: 6828 Comm: a.out Not tainted 4.7.0-rc4+ #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 ffffffff880b58e0 ffff88005dd9fcb0 ffffffff82cc838f ffffffff87158b40 fffffbfff1016b1c 0000000000000000 0000000000000000 ffffffff87158b40 ffffffff83283dae 0000000000000009 ffff88005dd9fcf8 ffffffff8136d27f Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff82cc838f>] dump_stack+0x12e/0x18f lib/dump_stack.c:51 [<ffffffff8136d27f>] __warn+0x19f/0x1e0 kernel/panic.c:516 [<ffffffff8136d48c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:551 [<ffffffff83283dae>] credit_entropy_bits+0x21e/0xad0 drivers/char/random.c:670 [< inline >] credit_entropy_bits_safe drivers/char/random.c:734 [<ffffffff8328785d>] random_ioctl+0x21d/0x250 drivers/char/random.c:1546 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8185316c>] do_vfs_ioctl+0x18c/0xff0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff8185405f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff86a995c0>] entry_SYSCALL_64_fastpath+0x23/0xc1 arch/x86/entry/entry_64.S:207 ---[ end trace 5d4902b2ba842f1f ]--- This was triggered using the test program: // autogenerated by syzkaller (http://github.com/google/syzkaller) int main() { int fd = open("/dev/random", O_RDWR); int val = -5000; ioctl(fd, RNDADDTOENTCNT, &val); return 0; } It's harmless in that (a) only root can trigger it, and (b) after complaining the code never does let the entropy count go negative, but it's better to simply not allow this userspace from passing in a negative entropy value altogether. Google-Bug-Id: #29575089 Reported-By: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: Joe Maples <joe@frap129.org> Signed-off-by: Joe Maples <joe@frap129.org>
* random: print a warning for the first ten uninitialized random usersTheodore Ts'o2017-05-071-4/+8
| | | | | | | | | | | | Since systemd is consistently using /dev/urandom before it is initialized, we can't see the other potentially dangerous users of /dev/urandom immediately after boot. So print the first ten such complaints instead. Cc: stable@kernel.org Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: mydongistiny <jaysonedson@gmail.com> Signed-off-by: Joe Maples <joe@frap129.org>
* defconfig: turn off some debug stuffMoyster2017-05-071-5/+5
|
* mm: Tighten x86 /dev/mem with zeroing readsKees Cook2017-05-072-40/+82
| | | | | | | | | | | | | | | | | | | | | | | | commit a4866aa812518ed1a37d8ea0c881dc946409de94 upstream. Under CONFIG_STRICT_DEVMEM, reading System RAM through /dev/mem is disallowed. However, on x86, the first 1MB was always allowed for BIOS and similar things, regardless of it actually being System RAM. It was possible for heap to end up getting allocated in low 1MB RAM, and then read by things like x86info or dd, which would trip hardened usercopy: usercopy: kernel memory exposure attempt detected from ffff880000090000 (dma-kmalloc-256) (4096 bytes) This changes the x86 exception for the low 1MB by reading back zeros for System RAM areas instead of blindly allowing them. More work is needed to extend this to mmap, but currently mmap doesn't go through usercopy, so hardened usercopy won't Oops the kernel. Change-Id: If63add732b7f654918aded70f5196166416ae905 Reported-by: Tommi Rantala <tommi.t.rantala@nokia.com> Tested-by: Tommi Rantala <tommi.t.rantala@nokia.com> Signed-off-by: Kees Cook <keescook@chromium.org> Cc: Brad Spengler <spender@grsecurity.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* mm/mempolicy.c: fix error handling in set_mempolicy and mbind.Chris Salls2017-05-071-12/+8
| | | | | | | | | | In the case that compat_get_bitmap fails we do not want to copy the bitmap to the user as it will contain uninitialized stack data and leak sensitive data. Change-Id: I188fb5950c9804bd79ef959973108a8519bf04bb Signed-off-by: Chris Salls <salls@cs.ucsb.edu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* KEYS: Change the name of the dead type to ".dead" to prevent user accessDavid Howells2017-05-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | commit c1644fe041ebaf6519f6809146a77c3ead9193af upstream. This fixes CVE-2017-6951. Userspace should not be able to do things with the "dead" key type as it doesn't have some of the helper functions set upon it that the kernel needs. Attempting to use it may cause the kernel to crash. Fix this by changing the name of the type to ".dead" so that it's rejected up front on userspace syscalls by key_get_type_from_user(). Though this doesn't seem to affect recent kernels, it does affect older ones, certainly those prior to: commit c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81 Author: David Howells <dhowells@redhat.com> Date: Tue Sep 16 17:36:06 2014 +0100 KEYS: Remove key_type::match in favour of overriding default by match_preparse which went in before 3.18-rc1. Change-Id: Ie0fe24b5c5f341c152e511976b60d393056e89fb Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* perf: don't leave group_entry on sibling list (use-after-free)John Dias2017-05-071-0/+7
| | | | | | | | | | | | | When perf_group_detach is called on a group leader, it should empty its sibling list. Otherwise, when a sibling is later deallocated, list_del_event() removes the sibling's group_entry from its current list, which can be the now-deallocated group leader's sibling list (use-after-free bug). Bug: 32402548 Change-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1 Signed-off-by: John Dias <joaodias@google.com>
* um: defconfig: use a better defconfig for recent testsMister Oyster2017-05-041-128/+332
|
* um: fix buildMister Oyster2017-05-044-2/+16
|
* um: Remove copy&paste code from init.hRichard Weinberger2017-05-031-21/+1
| | | | | | | | | As we got rid of the __KERNEL__ abuse, we can directly include linux/compiler.h now. This also allows gcc 5 to build UML. Reported-by: Hans-Werner Hilse <hwhilse@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
* um: Stop abusing __KERNEL__Richard Weinberger2017-05-035-10/+11
| | | | | | | | Currently UML is abusing __KERNEL__ to distinguish between kernel and host code (os-Linux). It is better to use a custom define such that existing users of __KERNEL__ don't get confused. Signed-off-by: Richard Weinberger <richard@nod.at>
* locking/mcs: Allow architecture specific asm files to be used for contended caseTim Chen2017-05-0331-0/+157
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows each architecture to add its specific assembly optimized arch_mcs_spin_lock_contended and arch_mcs_spinlock_uncontended for MCS lock and unlock functions. Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> Cc: Scott J Norton <scott.norton@hp.com> Cc: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com> Cc: AswinChandramouleeswaran <aswin@hp.com> Cc: George Spelvin <linux@horizon.com> Cc: Rik vanRiel <riel@redhat.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: MichelLespinasse <walken@google.com> Cc: Peter Hurley <peter@hurleysoftware.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: Alex Shi <alex.shi@linaro.org> Cc: Dave Hansen <dave.hansen@intel.com> Cc: Tim Chen <tim.c.chen@linux.intel.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: "Figo.zhang" <figo1802@gmail.com> Cc: "Paul E.McKenney" <paulmck@linux.vnet.ibm.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Davidlohr Bueso <davidlohr.bueso@hp.com> Cc: Waiman Long <waiman.long@hp.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Will Deacon <will.deacon@arm.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Matthew R Wilcox <matthew.r.wilcox@intel.com> Signed-off-by: Peter Zijlstra <peterz@infradead.org> Link: http://lkml.kernel.org/r/1390347382.3138.67.camel@schen9-DESK Signed-off-by: Ingo Molnar <mingo@kernel.org> Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Git-commit: ddf1d169c0a489d498c1799a7043904a43b0c159 [joonwoop@codeaurora.org: Resolve merge conflicts; we don't have changes for arch other than ARM/ARM64] Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
* locking/mcs: Order the header files in Kbuild of each architecture in ↵Tim Chen2017-05-0313-29/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | alphabetical order We perform a clean up of the Kbuid files in each architecture. We order the files in each Kbuild in alphabetical order by running the below script. for i in arch/*/include/asm/Kbuild do cat $i | gawk '/^generic-y/ { i = 3; do { for (; i <= NF; i++) { if ($i == "\\") { getline; i = 1; continue; } if ($i != "") hdr[$i] = $i; } break; } while (1); next; } // { print $0; } END { n = asort(hdr); for (i = 1; i <= n; i++) print "generic-y += " hdr[i]; }' > ${i}.sorted; mv ${i}.sorted $i; done Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Matthew R Wilcox <matthew.r.wilcox@intel.com> Cc: AswinChandramouleeswaran <aswin@hp.com> Cc: Dave Hansen <dave.hansen@intel.com> Cc: "Paul E.McKenney" <paulmck@linux.vnet.ibm.com> Cc: Scott J Norton <scott.norton@hp.com> Cc: Will Deacon <will.deacon@arm.com> Cc: "Figo.zhang" <figo1802@gmail.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Rik van Riel <riel@redhat.com> Cc: Waiman Long <waiman.long@hp.com> Cc: Peter Hurley <peter@hurleysoftware.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Tim Chen <tim.c.chen@linux.intel.com> Cc: Alex Shi <alex.shi@linaro.org> Cc: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: George Spelvin <linux@horizon.com> Cc: MichelLespinasse <walken@google.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Davidlohr Bueso <davidlohr.bueso@hp.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Peter Zijlstra <peterz@infradead.org> [ Fixed build bug. ] Signed-off-by: Ingo Molnar <mingo@kernel.org> Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Git-commit: b119fa61d440fe0f5af504299ad506637585a8ca [joonwoop@codeaurora.org: resolved conflict due to missing Kbuild files.] Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
* um: Kbuild: Add back generic barrier.hNaveen Ramaraj2017-05-031-0/+1
| | | | | | | | | | | This is needed for building nettest on ARCH=um This fixes multiple instances of "error: implicit declaration of function smp_mb__after_atomic()" for various kernel headers. Change-Id: Icd9db5088a4c38909eaa0b9e789706d17abf1e42 Signed-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>
* um: x86: add relaxed.hMister Oyster2017-05-031-0/+22
|
* Fix compiler warning in UML code.Lorenzo Colitti2017-05-031-1/+2
| | | | | | | | | | Simply putting (void) in front of the function call does not fix the warning in GCC. This is working as intended; see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=25509#c26 Bug: 21631098 Change-Id: I3aff39752242923dab8b837df2b9ea697316165e
* um: siginfo cleanupRichard Weinberger2017-05-034-15/+15
| | | | | | | | | | | | | | Currently we use both struct siginfo and siginfo_t. Let's use struct siginfo internally to avoid ongoing compiler warning. We are allowed to do so because struct siginfo and siginfo_t are equivalent. [cherry-pick of upstream 9a8c1359571c5d5e2fbc43cf457a6486b70a70cb] Bug: 21631098 Change-Id: I564775c9ed515c39ffff7d7d600a85d50291f31d Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
* um: remove dead codeRichard Weinberger2017-05-031-1/+0
| | | | | | | | | | | "me" is not used. [cherry-pick of upstream 9e82d450531c79b18ab18c9b9645cdd9db31ee98] Bug: 21631098 Change-Id: Ifc3550184931dddf8feebd6c3137e60b97f6a0f1 Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
* UPSTREAM: timerfd: Protect the might cancel mechanism properThomas Gleixner2017-05-031-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit 1e38da300e1e395a15048b0af1e5305bd91402f6) The handling of the might_cancel queueing is not properly protected, so parallel operations on the file descriptor can race with each other and lead to list corruptions or use after free. Protect the context for these operations with a seperate lock. The wait queue lock cannot be reused for this because that would create a lock inversion scenario vs. the cancel lock. Replacing might_cancel with an atomic (atomic_t or atomic bit) does not help either because it still can race vs. the actual list operation. Bug: 36266767 Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: "linux-fsdevel@vger.kernel.org" Cc: syzkaller <syzkaller@googlegroups.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1701311521430.3457@nanos Change-Id: I122753e0920e51757d3012cd1a133e823719be51
* defconfig: switch to crypto_lz4 instead of crypto_lzoMister Oyster2017-05-021-2/+2
|
* xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_windowAndy Whitcroft2017-05-021-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a new xfrm state is created during an XFRM_MSG_NEWSA call we validate the user supplied replay_esn to ensure that the size is valid and to ensure that the replay_window size is within the allocated buffer. However later it is possible to update this replay_esn via a XFRM_MSG_NEWAE call. There we again validate the size of the supplied buffer matches the existing state and if so inject the contents. We do not at this point check that the replay_window is within the allocated memory. This leads to out-of-bounds reads and writes triggered by netlink packets. This leads to memory corruption and the potential for priviledge escalation. We already attempt to validate the incoming replay information in xfrm_new_ae() via xfrm_replay_verify_len(). This confirms that the user is not trying to change the size of the replay state buffer which includes the replay_esn. It however does not check the replay_window remains within that buffer. Add validation of the contained replay_window. Additionally Kees Cook has pointed out that xfrm_replay_state_esn_len() is subject to wrapping issues. To ensure we are correctly ensuring that the two ESN structures are the same size compare both the overall size as reported by xfrm_replay_state_esn_len() and the internal length are the same. CVE-2017-7184 ZDI-CAN-4586 Bug: 36565222 Signed-off-by: Andy Whitcroft <apw@canonical.com> Reviewed-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org> Change-Id: I50d2766ab19fb182a5e75adf9e46ff043f2d99ea
* BACKPORT: trace: resolve stack corruption due to string copyAmey Telawane2017-05-021-1/+1
| | | | | | | | | | | Strcpy has no limit on string being copied which causes stack corruption leading to kernel panic. Use strlcpy to resolve the issue by providing length of string to be copied. CRs-fixed: 1048480 Bug: 35399704 Change-Id: Ib290b25f7e0ff96927b8530e5c078869441d409f Signed-off-by: Amey Telawane <ameyt@codeaurora.org>
* tracing: do not leak kernel addressesNick Desaulniers2017-05-021-1/+1
| | | | | | | | This likely breaks tracing tools like trace-cmd. It logs in the same format but now addresses are all 0x0. Bug: 34277115 Change-Id: Ifb0d4d2a184bf0d95726de05b1acee0287a375d9
* android: binder: fix duplicate error return.Riley Andrews2017-04-301-1/+1
| | | | | | | | Duplicate errors can be returned to userspace when the thread error code is left set when the read buffer runs out of space. Change-Id: I921effcb6a7d620841177741a5ad5784acc7a907 Signed-off-by: Riley Andrews <riandrews@google.com>
* defconfig: deadline -> bfqMister Oyster2017-04-301-8/+7
|
* ANDROID: Fix the incompatible goto command in security Fix.Chenbo Feng2017-04-291-2/+2
| | | | | | | | | | | | | The sercurity fix of upstream commit e159332b9af4 ("udf: Verify i_size when loading inode") require a incompatible goto statement which does not exist in 3.10 kernel. It can be simply solved by replacing it with a return statement insdead of cherry-pick all the depending upstream patches. Signed-off-by: Chenbo Feng <fengc@google.com> Bug: 35808154 Change-Id: I67a40ee2b18a9429e5a1e38f5e2cdd8d504ef0ec
* BACKPORT: [UPSTREAM] udf: Check component length before reading itJan Kara2017-04-291-2/+7
| | | | | | | | | | | | | | | | (Cherry-pick from commit e237ec37ec154564f8690c5bd1795339955eeef9) Check that length specified in a component of a symlink fits in the input buffer we are reading. Also properly ignore component length for component types that do not use it. Otherwise we read memory after end of buffer for corrupted udf image. Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no> CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> Bug: 35808154 Change-Id: I1bb9856ab8ae5164291b82065160e17817328c0b
* BACKPORT: [UPSTREAM] udf: Verify i_size when loading inodeJan Kara2017-04-291-0/+14
| | | | | | | | | | | | | | | (Cherry-pick from e159332b9af4b04d882dbcfe1bb0117f0a6d4b58) Verify that inode size is sane when loading inode with data stored in ICB. Otherwise we may get confused later when working with the inode and inode size is too big. CC: stable@vger.kernel.org Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no> Signed-off-by: Jan Kara <jack@suse.cz> Bug: 35808154 Change-Id: I96a40c26875d6efda3c62a27eb6a8b477a57ab4a
* mtk: 3.10 updatesMister Oyster2017-04-2915-102/+95
|
* ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iifCong Wang2017-04-297-16/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As suggested by Julian: Simply, flowi4_iif must not contain 0, it does not look logical to ignore all ip rules with specified iif. because in fib_rule_match() we do: if (rule->iifindex && (rule->iifindex != fl->flowi_iif)) goto out; flowi4_iif should be LOOPBACK_IFINDEX by default. We need to move LOOPBACK_IFINDEX to include/net/flow.h: 1) It is mostly used by flowi_iif 2) Fix the following compile error if we use it in flow.h by the patches latter: In file included from include/linux/netfilter.h:277:0, from include/net/netns/netfilter.h:5, from include/net/net_namespace.h:21, from include/linux/netdevice.h:43, from include/linux/icmpv6.h:12, from include/linux/ipv6.h:61, from include/net/ipv6.h:16, from include/linux/sunrpc/clnt.h:27, from include/linux/nfs_fs.h:30, from init/do_mounts.c:32: include/net/flow.h: In function ‘flowi4_init_output’: include/net/flow.h:84:32: error: ‘LOOPBACK_IFINDEX’ undeclared (first use in this function) [Backport of net-next 6a662719c9868b3d6c7d26b3a085f0cd3cc15e64] Change-Id: Ib7a0a08d78c03800488afa1b2c170cb70e34cfd9 Cc: Eric Biederman <ebiederm@xmission.com> Cc: Julian Anastasov <ja@ssi.bg> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
* defconfig: change quota configMister Oyster2017-04-272-4/+4
|
* arm64: ptrace: add NT_ARM_SYSTEM_CALL regsetAKASHI Takahiro2017-04-272-0/+36
| | | | | | | | | | | | | | | | | | | | This regeset is intended to be used to get and set a system call number while tracing. There was some discussion about possible approaches to do so: (1) modify x8 register with ptrace(PTRACE_SETREGSET) indirectly, and update regs->syscallno later on in syscall_trace_enter(), or (2) define a dedicated regset for this purpose as on s390, or (3) support ptrace(PTRACE_SET_SYSCALL) as on arch/arm Thinking of the fact that user_pt_regs doesn't expose 'syscallno' to tracer as well as that secure_computing() expects a changed syscall number, especially case of -1, to be visible before this function returns in syscall_trace_enter(), (1) doesn't work well. We will take (2) since it looks much cleaner. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Will Deacon <will.deacon@arm.com>
* Android: sdcardfs: Don't do d_add for lower fsDaniel Rosenberg2017-04-271-7/+5
| | | | | | | | | | This reapplies commit ffa75fdb9c408f49b9622b6d55752ed99ff61488. Turns out we just needed the right hash. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 37231161 Change-Id: I6a6de7f7df99ad42b20fa062913b219f64020c31
* ANDROID: sdcardfs: Call lower fs's revalidateDaniel Rosenberg2017-04-271-0/+8
| | | | | | | | | We should be calling the lower filesystem's revalidate inside of sdcardfs's revalidate, as wrapfs does. Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 35766959 Change-Id: I939d1c4192fafc1e21678aeab43fe3d588b8e2f4
* ANDROID: sdcardfs: Avoid setting GIDs outside of valid rangesDaniel Rosenberg2017-04-272-4/+11
| | | | | | | | | | When setting up the ownership of files on the lower filesystem, ensure that these values are in reasonable ranges for apps. If they aren't, default to AID_MEDIA_RW Signed-off-by: Daniel Rosenberg <drosen@google.com> Bug: 37516160 Change-Id: I0bec76a61ac72aff0b993ab1ad04be8382178a00
* ANDROID: sdcardfs: Use filesystem specific hashDaniel Rosenberg2017-04-271-2/+7
| | | | | | | | | | | | We weren't accounting for FS specific hash functions, causing us to miss negative dentries for any FS that had one. Similar to a patch from esdfs commit 75bd25a9476d ("esdfs: support lower's own hash") Signed-off-by: Daniel Rosenberg <drosen@google.com> Change-Id: I32d1ba304d728e0ca2648cacfb4c2e441ae63608
* UPSTREAM: ext4: fix fencepost in s_first_meta_bg validationTheodore Ts'o2017-04-261-1/+1
| | | | | | | | | | | | | | | (cherry-picked from commit 2ba3e6e8afc9b6188b471f27cf2b5e3cf34e7af2) It is OK for s_first_meta_bg to be equal to the number of block group descriptor blocks. (It rarely happens, but it shouldn't cause any problems.) https://bugzilla.kernel.org/show_bug.cgi?id=194567 Fixes: 3a4b77cd47bb837b8557595ec7425f281f2ca1fe Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@vger.kernel.org Change-Id: Ib414feb50f88dcd42dc846429b81df6c72b28136
* UPSTREAM: netfilter: Fix build errors with xt_socket.cDavid S. Miller2017-04-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry pick from commit 1a5bbfc3d6b700178b75743a2ba1fd2e58a8f36f) As reported by Randy Dunlap: ==================== when CONFIG_IPV6=m and CONFIG_NETFILTER_XT_MATCH_SOCKET=y: net/built-in.o: In function `socket_mt6_v1_v2': xt_socket.c:(.text+0x51b55): undefined reference to `udp6_lib_lookup' net/built-in.o: In function `socket_mt_init': xt_socket.c:(.init.text+0x1ef8): undefined reference to `nf_defrag_ipv6_enable' ==================== Like several other modules under net/netfilter/ we have to have a dependency "IPV6 disabled or set compatibly with this module" clause. Reported-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: David S. Miller <davem@davemloft.net> Fix symbol export errors for when CONFIG_MODULES is set. Signed-off-by: Dmitriy Filchenko <dmitriyf@google.com> Change-Id: I9f5a1824a87388da1727f330f97e4982ad7069cd
* Revert "netfilter: have ip*t REJECT set the sock err when an icmp is to be sent"Erik Kline2017-04-254-41/+0
| | | | | | | This reverts commit 6f489c42a92e0e33d4257017d6fd4a3e79f75f79. Bug: 28719525 Change-Id: I77707cc93b3c5f0339e6bce36734027586c639d3
* net: include missing headers in net/net_namespace.hPablo Neira Ayuso2017-04-251-0/+2
| | | | | | | | | | | | | | | | | | Include linux/idr.h and linux/skbuff.h since they are required by objects that are declared in the net structure. struct net { ... struct idr netns_ids; ... struct sk_buff_head wext_nlevents; ... (cherry picked from commit 04c52dec1473c5dff9d07cd39a68c9b23def6c42) Change-Id: I389db375ca5a63e91735a76ef5140dc3b355a831 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-22 17:08:09 +0000