kernel_samsung_sm7125

jenna

History

Amanieu d'Antras 3c00cb5e68 signal: fix information leak in copy_siginfo_from_user32 This function can leak kernel stack data when the user siginfo_t has a positive si_code value. The top 16 bits of si_code descibe which fields in the siginfo_t union are active, but they are treated inconsistently between copy_siginfo_from_user32, copy_siginfo_to_user32 and copy_siginfo_to_user. copy_siginfo_from_user32 is called from rt_sigqueueinfo and rt_tgsigqueueinfo in which the user has full control overthe top 16 bits of si_code. This fixes the following information leaks: x86: 8 bytes leaked when sending a signal from a 32-bit process to itself. This leak grows to 16 bytes if the process uses x32. (si_code = __SI_CHLD) x86: 100 bytes leaked when sending a signal from a 32-bit process to a 64-bit process. (si_code = -1) sparc: 4 bytes leaked when sending a signal from a 32-bit process to a 64-bit process. (si_code = any) parsic and s390 have similar bugs, but they are not vulnerable because rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code to a different process. These bugs are also fixed for consistency. Signed-off-by: Amanieu d'Antras <amanieu@gmail.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Russell King <rmk@arm.linux.org.uk> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Chris Metcalf <cmetcalf@ezchip.com> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		10 years ago
..
vdso32	powerpc: 32 bit getcpu VDSO function uses 64 bit instructions	10 years ago
vdso64	…
.gitignore	…
Makefile	Devicetree changes for v4.2	10 years ago
align.c	powerpc: Remove double braces in alignment code.	10 years ago
asm-offsets.c	powerpc/kernel: Rename PACA_DSCR to PACA_DSCR_DEFAULT	10 years ago
audit.c	…
btext.c	…
cacheinfo.c	powerpc: Fix missing L2 cache size in /sys/devices/system/cpu	10 years ago
cacheinfo.h	…
compat_audit.c	…
cpu_setup_6xx.S	…
cpu_setup_44x.S	…
cpu_setup_fsl_booke.S	…
cpu_setup_pa6t.S	…
cpu_setup_power.S	powerpc/book3s: Fix flush_tlb cpu_spec hook to take a generic argument.	10 years ago
cpu_setup_ppc970.S	…
cputable.c	powerpc/tm: Abort syscalls in active transactions	10 years ago
crash.c	…
crash_dump.c	powerpc: Remove superfluous bootmem includes	10 years ago
dbell.c	powerpc/powernv: Fixes for hypervisor doorbell handling	10 years ago
dma-iommu.c	powerpc/iommu: Rename iommu_[un]map_sg functions	10 years ago
dma-swiotlb.c	powerpc: fsl_pci, swiotlb: Move controller ops from ppc_md to controller_ops	10 years ago
dma.c	powerpc/pci: add dma_set_mask to pci_controller_ops	10 years ago
eeh.c	powerpc/eeh/ioda2: Use device::iommu_group to check IOMMU group	10 years ago
eeh_cache.c	powerpc/eeh: fix start/end/flags type in struct pci_io_addr_range{}	10 years ago
eeh_dev.c	powerpc/eeh: Create eeh_dev from pci_dn instead of device_node	10 years ago
eeh_driver.c	powerpc/eeh: fix comment for wait_state()	10 years ago
eeh_event.c	…
eeh_pe.c	powerpc/eeh: Fix PE#0 check in eeh_add_to_parent_pe()	10 years ago
eeh_sysfs.c	powerpc/eeh: Fix PE state format	10 years ago
entry_32.S	powerpc: Remove old compile time disabled syscall tracing code	10 years ago
entry_64.S	powerpc/tm: Abort syscalls in active transactions	10 years ago
epapr_hcalls.S	…
epapr_paravirt.c	…
exceptions-64e.S	…
exceptions-64s.S	powerpc: Non relocatable system call doesn't need a trampoline	10 years ago
fadump.c	powerpc/fadump: Fix endianess issues in firmware assisted dump handling	10 years ago
firmware.c	…
fpu.S	…
fsl_booke_entry_mapping.S	…
ftrace.c	powerpc updates for 3.19	10 years ago
head_8xx.S	powerpc/8xx: Implementation of PAGE_EXEC	10 years ago
head_32.S	…
head_40x.S	…
head_44x.S	…
head_64.S	…
head_booke.h	…
head_fsl_booke.S	…
hw_breakpoint.c	powerpc: Replace __get_cpu_var uses	10 years ago
ibmebus.c	…
idle.c	…
idle_6xx.S	…
idle_book3e.S	…
idle_e500.S	powerpc/e500mc: Remove dead L2 flushing code in idle_e500.S	10 years ago
idle_power4.S	…
idle_power7.S	powerpc/powernv: Fix race in updating core_idle_state	10 years ago
io-workarounds.c	powerpc/mm/thp: Make page table walk safe against thp split/collapse	10 years ago
io.c	…
iomap.c	…
iommu.c	powerpc/iommu/powernv: Release replaced TCE	10 years ago
irq.c	powerpc: Remove superfluous bootmem includes	10 years ago
isa-bridge.c	…
jump_label.c	…
kgdb.c	powerpc: Replace __get_cpu_var uses	10 years ago
kprobes.c	powerpc: Replace __get_cpu_var uses	10 years ago
kvm.c	…
kvm_emul.S	…
l2cr_6xx.S	…
legacy_serial.c	…
machine_kexec.c	…
machine_kexec_32.c	…
machine_kexec_64.c	kexec: add IND_FLAGS macro	10 years ago
mce.c	powerpc/mce: fix off by one errors in mce event handling	10 years ago
mce_power.c	powerpc/book3s: Fix flush_tlb cpu_spec hook to take a generic argument.	10 years ago
misc.S	…
misc_32.S	…
misc_64.S	…
module.c	…
module_32.c	…
module_64.c	…
msi.c	powerpc: Remove MSI-related PCI controller ops from ppc_md	10 years ago
nvram_64.c	powerpc/rtas: Make timestamp related code y2038-safe	10 years ago
of_platform.c	powerpc/eeh: Do probe on pci_dn	10 years ago
paca.c	powerpc/kernel: Avoid memory corruption at early stage	10 years ago
pci-common.c	powerpc/pci: Add pcibios_disable_device() hook	10 years ago
pci-hotplug.c	powerpc/pci: Add release_device() hook to phb ops	10 years ago
pci_32.c	powerpc: Remove more traces of bootmem	10 years ago
pci_64.c	powerpc updates for 3.19	10 years ago
pci_dn.c	powerpc/powernv: Shift VF resource with an offset	10 years ago
pci_of_scan.c	powerpc: Remove shims for pci_controller_ops operations	10 years ago
pmc.c	…
ppc32.h	…
ppc_ksyms.c	…
ppc_ksyms_32.c	…
ppc_save_regs.S	…
proc_powerpc.c	…
process.c	powerpc/kernel: Remove the unused extern dscr_default	10 years ago
prom.c	arm64 updates for 4.2, mostly refactoring/clean-up:	10 years ago
prom_init.c	PCI: Remove unnecessary #includes of <asm/pci.h>	10 years ago
prom_init_check.sh	…
prom_parse.c	…
ptrace.c	…
ptrace32.c	…
reloc_32.S	…
reloc_64.S	…
rtas-proc.c	powerpc: LLVM complains about forward declaration of struct rtas_sensors	10 years ago
rtas-rtc.c	…
rtas.c	powerpc: Replace mem_init_done with slab_is_available()	10 years ago
rtas_flash.c	…
rtas_pci.c	powerpc: move find_and_init_phbs() to pSeries specific code	10 years ago
rtasd.c	…
setup-common.c	powerpc: Convert power off logic to pm_power_off	10 years ago
setup_32.c	powerpc: Remove unused vgacon_remap_base & fix build break	10 years ago
setup_64.c	powerpc/mmu: Add userspace-to-physical addresses translation cache	10 years ago
signal.c	…
signal.h	…
signal_32.c	signal: fix information leak in copy_siginfo_from_user32	10 years ago
signal_64.c	all arches, signal: move restart_block to struct task_struct	10 years ago
smp-tbsync.c	…
smp.c	powerpc/smp: Wait until secondaries are active & online	10 years ago
stacktrace.c	…
suspend.c	…
swsusp.c	…
swsusp_32.S	…
swsusp_64.c	…
swsusp_asm64.S	…
swsusp_booke.S	…
sys_ppc32.c	…
syscalls.c	powerpc: Add a proper syscall for switching endianness	10 years ago
sysfs.c	powerpc/dscr: Add some in-code documentation	10 years ago
systbl.S	powerpc: Add a proper syscall for switching endianness	10 years ago
systbl_chk.c	powerpc: Add a proper syscall for switching endianness	10 years ago
systbl_chk.sh	…
tau_6xx.c	…
time.c	powerpc: use device_initcall for registering rtc devices	10 years ago
tm.S	powerpc/kernel: Rename PACA_DSCR to PACA_DSCR_DEFAULT	10 years ago
traps.c	powerpc: Set the correct kernel taint on machine check errors.	10 years ago
udbg.c	powerpc: Remove the celleb support	10 years ago
udbg_16550.c	powerpc: Fix bad NULL pointer check in udbg_uart_getc_poll()	10 years ago
uprobes.c	…
vdso.c	powerpc/vdso: Disable building the 32-bit VDSO on little endian	10 years ago
vecemu.c	…
vector.S	powerpc: Change vrX register defines to vX to match gcc and glibc	10 years ago
vio.c	powerpc: use for_each_sg()	10 years ago
vmlinux.lds.S	powerpc: Align TOC to 256 bytes	10 years ago