1. 14 6月, 2017 1 次提交
  2. 15 4月, 2017 2 次提交
  3. 25 12月, 2016 1 次提交
  4. 16 11月, 2016 1 次提交
  5. 05 6月, 2015 1 次提交
    • H
      compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap() · 9b7b819c
      Helge Deller 提交于
      In the functions compat_get_bitmap() and compat_put_bitmap() the
      variable nr_compat_longs stores how many compat_ulong_t words should be
      copied in a loop.
      
      The copy loop itself is this:
        if (nr_compat_longs-- > 0) {
            if (__get_user(um, umask)) return -EFAULT;
        } else {
            um = 0;
        }
      
      Since nr_compat_longs gets unconditionally decremented in each loop and
      since it's type is unsigned this could theoretically lead to out of
      bounds accesses to userspace if nr_compat_longs wraps around to
      (unsigned)(-1).
      
      Although the callers currently do not trigger out-of-bounds accesses, we
      should better implement the loop in a safe way to completely avoid such
      warp-arounds.
      Signed-off-by: NHelge Deller <deller@gmx.de>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      9b7b819c
  6. 13 2月, 2015 1 次提交
    • A
      all arches, signal: move restart_block to struct task_struct · f56141e3
      Andy Lutomirski 提交于
      If an attacker can cause a controlled kernel stack overflow, overwriting
      the restart block is a very juicy exploit target.  This is because the
      restart_block is held in the same memory allocation as the kernel stack.
      
      Moving the restart block to struct task_struct prevents this exploit by
      making the restart_block harder to locate.
      
      Note that there are other fields in thread_info that are also easy
      targets, at least on some architectures.
      
      It's also a decent simplification, since the restart code is more or less
      identical on all architectures.
      
      [james.hogan@imgtec.com: metag: align thread_info::supervisor_stack]
      Signed-off-by: NAndy Lutomirski <luto@amacapital.net>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: "H. Peter Anvin" <hpa@zytor.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: David Miller <davem@davemloft.net>
      Acked-by: NRichard Weinberger <richard@nod.at>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
      Cc: Matt Turner <mattst88@gmail.com>
      Cc: Vineet Gupta <vgupta@synopsys.com>
      Cc: Russell King <rmk@arm.linux.org.uk>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Cc: Haavard Skinnemoen <hskinnemoen@gmail.com>
      Cc: Hans-Christian Egtvedt <egtvedt@samfundet.no>
      Cc: Steven Miao <realmz6@gmail.com>
      Cc: Mark Salter <msalter@redhat.com>
      Cc: Aurelien Jacquiot <a-jacquiot@ti.com>
      Cc: Mikael Starvik <starvik@axis.com>
      Cc: Jesper Nilsson <jesper.nilsson@axis.com>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Richard Kuo <rkuo@codeaurora.org>
      Cc: "Luck, Tony" <tony.luck@intel.com>
      Cc: Geert Uytterhoeven <geert@linux-m68k.org>
      Cc: Michal Simek <monstr@monstr.eu>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: Jonas Bonn <jonas@southpole.se>
      Cc: "James E.J. Bottomley" <jejb@parisc-linux.org>
      Cc: Helge Deller <deller@gmx.de>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
      Tested-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Chen Liqin <liqin.linux@gmail.com>
      Cc: Lennox Wu <lennox.wu@gmail.com>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
      Cc: Chris Zankel <chris@zankel.net>
      Cc: Max Filippov <jcmvbkbc@gmail.com>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      f56141e3
  7. 06 9月, 2014 1 次提交
  8. 05 6月, 2014 1 次提交
  9. 06 3月, 2014 2 次提交
  10. 03 2月, 2014 2 次提交
    • H
      compat: Fix sparse address space warnings · dce44e03
      H. Peter Anvin 提交于
      In compat_sys_old_getrlimit() we pass a kernel pointer to
      sys_old_getrlimit() inside a set_fs() bracket.  This is okay, so we
      can safely cast the affected pointer to __user.
      
      In compat_clock_nanosleep_restart(), the variable "rmtp" holds a user
      pointer.  Annotate it as such.
      
      Both of these warnings are ancient, but were reported by Fengguang
      Wu's test system due to other changes.
      Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
      Cc: Toyo Abe <toyoa@mvista.com>
      Link: http://lkml.kernel.org/n/tip-507h7cq5e45eg6ygtykon3bf@git.kernel.org
      dce44e03
    • H
      compat: Get rid of (get|put)_compat_time(val|spec) · 81993e81
      H. Peter Anvin 提交于
      We have two APIs for compatiblity timespec/val, with confusingly
      similar names.  compat_(get|put)_time(val|spec) *do* handle the case
      where COMPAT_USE_64BIT_TIME is set, whereas
      (get|put)_compat_time(val|spec) do not.  This is an accident waiting
      to happen.
      
      Clean it up by favoring the full-service version; the limited version
      is replaced with double-underscore versions static to kernel/compat.c.
      
      A common pattern is to convert a struct timespec to kernel format in
      an allocation on the user stack.  Unfortunately it is open-coded in
      several places.  Since this allocation isn't actually needed if
      COMPAT_USE_64BIT_TIME is true (since user format == kernel format)
      encapsulate that whole pattern into the function
      compat_convert_timespec().  An equivalent function should be written
      for struct timeval if it is needed in the future.
      
      Finally, get rid of compat_(get|put)_timeval_convert(): each was only
      used once, and the latter was not even doing what the function said
      (no conversion actually was being done.)  Moving the conversion into
      compat_sys_settimeofday() itself makes the code much more similar to
      sys_settimeofday() itself.
      
      v3: Remove unused compat_convert_timeval().
      
      v2: Drop bogus "const" in the destination argument for
          compat_convert_time*().
      
      Cc: Mauro Carvalho Chehab <m.chehab@samsung.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Hans Verkuil <hans.verkuil@cisco.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Manfred Spraul <manfred@colorfullife.com>
      Cc: Mateusz Guzik <mguzik@redhat.com>
      Cc: Rafael Aquini <aquini@redhat.com>
      Cc: Davidlohr Bueso <davidlohr@hp.com>
      Cc: Stephen Rothwell <sfr@canb.auug.org.au>
      Cc: Dan Carpenter <dan.carpenter@oracle.com>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Will Deacon <will.deacon@arm.com>
      Tested-by: NH.J. Lu <hjl.tools@gmail.com>
      Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
      81993e81
  11. 01 5月, 2013 1 次提交
  12. 04 3月, 2013 1 次提交
  13. 22 2月, 2013 1 次提交
  14. 04 2月, 2013 7 次提交
  15. 26 12月, 2012 3 次提交
    • A
      x32: fix sigtimedwait · b2ddedcd
      Al Viro 提交于
      It needs 64bit timespec.  As it is, we end up truncating the timeout
      to whole seconds; usually it doesn't matter, but for having all
      sub-second timeouts truncated to one jiffy is visibly wrong.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      b2ddedcd
    • A
      x32: fix waitid() · a566c288
      Al Viro 提交于
      It needs 64bit rusage and 32bit siginfo.  glibc never calls it with
      non-NULL rusage pointer, or we would've seen breakage already...
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      a566c288
    • A
      switch compat_sys_wait4() and compat_sys_waitid() to COMPAT_SYSCALL_DEFINE · 8d9807b1
      Al Viro 提交于
      Strictly speaking, ppc64 needs it for C ABI compliance.  Realistically
      I would be very surprised if e.g. passing 0xffffffff as 'options'
      argument to waitid() from 32bit task would cause problems, but yes,
      it puts us into undefined behaviour territory.  ppc64 expects int
      argument to be passed in 64bit register with bits 31..63 containing
      the same value.  SYSCALL_DEFINE on ppc provides a wrapper that normalizes
      the value passed from userland; so does COMPAT_SYSCALL_DEFINE.  Plain
      declaration of compat_sys_something() with an int argument obviously
      doesn't.  Again, for wait4 and waitid I would be extremely surprised
      if gcc started to produce code depending on that value having been
      properly sign-extended - the argument(s) in question end up passed
      blindly to sys_wait4 and sys_waitid resp. and normalization for native
      syscalls takes care of their use there.  Still, better to use
      COMPAT_SYSCALL_DEFINE here than worry about nasal daemons...
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      8d9807b1
  16. 18 12月, 2012 1 次提交
  17. 22 5月, 2012 1 次提交
  18. 10 5月, 2012 1 次提交
    • J
      compat: Fix RT signal mask corruption via sigprocmask · b7dafa0e
      Jan Kiszka 提交于
      compat_sys_sigprocmask reads a smaller signal mask from userspace than
      sigprogmask accepts for setting.  So the high word of blocked.sig[0]
      will be cleared, releasing any potentially blocked RT signal.
      
      This was discovered via userspace code that relies on get/setcontext.
      glibc's i386 versions of those functions use sigprogmask instead of
      rt_sigprogmask to save/restore signal mask and caused RT signal
      unblocking this way.
      
      As suggested by Linus, this replaces the sys_sigprocmask based compat
      version with one that open-codes the required logic, including the merge
      of the existing blocked set with the new one provided on SIG_SETMASK.
      Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      b7dafa0e
  19. 21 2月, 2012 1 次提交
    • H
      compat: Add helper functions to read/write struct timeval, timespec · 6684ba20
      H. Peter Anvin 提交于
      Add helper functions to read and write struct timeval and struct
      timespec from userspace.  We already had helper functions for reading
      and writing struct compat_timespec; add a set of functions to do the
      same with struct timeval, and add a second suite of functions which
      can be sensitive to COMPAT_USE_64BIT_TIME and access either 32- or
      64-bit time structures.
      
      This also exports these helper functions to modules.
      
      Rename the existing inlines for converting between struct
      compat_timeval and native struct timespec so we can have a saner
      naming convention for the exported functions.
      Suggested-by: NLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: NH. Peter Anvin <hpa@zytor.com>
      6684ba20
  20. 01 11月, 2011 1 次提交
  21. 28 7月, 2011 2 次提交
  22. 12 7月, 2011 1 次提交
    • A
      KVM: Add compat ioctl for KVM_SET_SIGNAL_MASK · 1dda606c
      Alexander Graf 提交于
      KVM has an ioctl to define which signal mask should be used while running
      inside VCPU_RUN. At least for big endian systems, this mask is different
      on 32-bit and 64-bit systems (though the size is identical).
      
      Add a compat wrapper that converts the mask to whatever the kernel accepts,
      allowing 32-bit kvm user space to set signal masks.
      
      This patch fixes qemu with --enable-io-thread on ppc64 hosts when running
      32-bit user land.
      Signed-off-by: NAlexander Graf <agraf@suse.de>
      Signed-off-by: NAvi Kivity <avi@redhat.com>
      1dda606c
  23. 13 5月, 2011 1 次提交
    • C
      compat: fixes to allow working with tile arch · be84cb43
      Chris Metcalf 提交于
      The existing <asm-generic/unistd.h> mechanism doesn't really provide
      enough to create the 64-bit "compat" ABI properly in a generic way,
      since the compat ABI is a mix of things were you can re-use the 64-bit
      versions of syscalls and things where you need a compat wrapper.
      
      To provide this in the most direct way possible, I added two new macros
      to go along with the existing __SYSCALL and __SC_3264 macros: __SC_COMP
      and SC_COMP_3264.  These macros take an additional argument, typically a
      "compat_sys_xxx" function, which is passed to __SYSCALL if you define
      __SYSCALL_COMPAT when including the header, resulting in a pointer to
      the compat function being placed in the generated syscall table.
      
      The change also adds some missing definitions to <linux/compat.h> so that
      it actually has declarations for all the compat syscalls, since the
      "[nr] = ##call" approach requires proper C declarations for all the
      functions included in the syscall table.
      
      Finally, compat.c defines compat_sys_sigpending() and
      compat_sys_sigprocmask() even if the underlying architecture doesn't
      request it, which tries to pull in undefined compat_old_sigset_t defines.
      We need to guard those compat syscall definitions with appropriate
      __ARCH_WANT_SYS_xxx ifdefs.
      Acked-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NChris Metcalf <cmetcalf@tilera.com>
      be84cb43
  24. 28 4月, 2011 2 次提交
  25. 02 2月, 2011 2 次提交
  26. 15 9月, 2010 1 次提交
    • H
      compat: Make compat_alloc_user_space() incorporate the access_ok() · c41d68a5
      H. Peter Anvin 提交于
      compat_alloc_user_space() expects the caller to independently call
      access_ok() to verify the returned area.  A missing call could
      introduce problems on some architectures.
      
      This patch incorporates the access_ok() check into
      compat_alloc_user_space() and also adds a sanity check on the length.
      The existing compat_alloc_user_space() implementations are renamed
      arch_compat_alloc_user_space() and are used as part of the
      implementation of the new global function.
      
      This patch assumes NULL will cause __get_user()/__put_user() to either
      fail or access userspace on all architectures.  This should be
      followed by checking the return value of compat_access_user_space()
      for NULL in the callers, at which time the access_ok() in the callers
      can also be removed.
      Reported-by: NBen Hawkes <hawkes@sota.gen.nz>
      Signed-off-by: NH. Peter Anvin <hpa@linux.intel.com>
      Acked-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
      Acked-by: NChris Metcalf <cmetcalf@tilera.com>
      Acked-by: NDavid S. Miller <davem@davemloft.net>
      Acked-by: NIngo Molnar <mingo@elte.hu>
      Acked-by: NThomas Gleixner <tglx@linutronix.de>
      Acked-by: NTony Luck <tony.luck@intel.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Fenghua Yu <fenghua.yu@intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
      Cc: Helge Deller <deller@gmx.de>
      Cc: James Bottomley <jejb@parisc-linux.org>
      Cc: Kyle McMartin <kyle@mcmartin.ca>
      Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: <stable@kernel.org>
      c41d68a5