Jann Horn 77d745a108 swapfile: fix memory corruption via malformed swapfile ...

commit dd111be691 upstream.

When root activates a swap partition whose header has the wrong
endianness, nr_badpages elements of badpages are swabbed before
nr_badpages has been checked, leading to a buffer overrun of up to 8GB.

This normally is not a security issue because it can only be exploited
by root (more specifically, a process with CAP_SYS_ADMIN or the ability
to modify a swap file/partition), and such a process can already e.g.
modify swapped-out memory of any other userspace process on the system.

Link: http://lkml.kernel.org/r/1477949533-2509-1-git-send-email-jann@thejh.net
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Jerome Marchand <jmarchan@redhat.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

2017-02-23 03:50:59 +00:00

..

backing-dev.c

mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress

2016-02-27 14:28:47 +00:00

bootmem.c

…

bounce.c

block: Add bio_for_each_segment_all()

2013-09-10 01:57:27 +01:00

cleancache.c

…

compaction.c

…

debug-pagealloc.c

…

dmapool.c

…

fadvise.c

mm/fadvise.c: drain all pagevecs if POSIX_FADV_DONTNEED fails to discard all pages

2013-03-06 03:24:12 +00:00

failslab.c

…

filemap_xip.c

…

filemap.c

mm: make sendfile(2) killable

2015-11-17 15:54:44 +00:00

fremap.c

…

highmem.c

mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address

2014-07-11 13:33:33 +01:00

huge_memory.c

mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check

2016-06-15 21:28:13 +01:00

hugetlb.c

mm/hugetlb: avoid soft lockup in set_max_huge_pages()

2016-11-20 01:01:30 +00:00

hwpoison-inject.c

…

init-mm.c

…

internal.h

…

Kconfig

…

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

…

kmemleak.c

mm: kmemleak: allow safe memory scanning during kmemleak disabling

2015-08-12 16:33:17 +02:00

ksm.c

mm,ksm: fix endless looping in allocating memory when ksm enable

2016-11-20 01:01:43 +00:00

maccess.c

…

madvise.c

…

Makefile

…

memblock.c

…

memcontrol.c

memcg: only free spare array when readers are done

2016-02-13 10:34:10 +00:00

memory_hotplug.c

mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()

2016-01-22 21:40:08 +00:00

memory-failure.c

mm/memory-failure.c: fix memory leak by race between poison and unpoison

2014-06-09 13:29:15 +01:00

memory.c

mm, gup: close FOLL MAP_PRIVATE race

2016-10-20 23:41:00 +01:00

mempolicy.c

slab/mempolicy: always use local policy from interrupt context

2014-09-13 23:41:50 +01:00

mempool.c

…

migrate.c

mm: Export migrate_page_move_mapping and migrate_page_copy

2016-08-22 22:37:15 +01:00

mincore.c

…

mlock.c

mm: try_to_unmap_cluster() should lock_page() before mlocking

2014-04-30 16:23:26 +01:00

mm_init.c

…

mmap.c

mm: fix anon_vma->degree underflow in anon_vma endless growing prevention

2015-05-09 23:16:33 +01:00

mmu_context.c

…

mmu_notifier.c

mm: mmu_notifier: re-fix freed page still mapped in secondary MMU

2013-05-30 14:35:06 +01:00

mmzone.c

…

mprotect.c

…

mremap.c

…

msync.c

…

nobootmem.c

…

nommu.c

mm/nommu.c: fix arithmetic overflow in __vm_enough_memory()

2015-05-09 23:16:16 +01:00

oom_kill.c

mm, oom: base root bonus on current usage

2014-04-02 00:58:46 +01:00

page_alloc.c

mm, thp: do not allow thp faults to avoid cpuset restrictions

2014-09-13 23:41:40 +01:00

page_cgroup.c

cgroup/kmemleak: add kmemleak_free() for cgroup deallocations.

2014-12-14 16:23:52 +00:00

page_io.c

…

page_isolation.c

…

page-writeback.c

writeback: use |1 instead of +1 to protect against div by zero

2015-08-07 00:32:06 +01:00

pagewalk.c

mm: pagewalk: call pte_hole() for VM_PFNMAP during walk_page_range

2015-03-06 00:39:18 +00:00

percpu-km.c

…

percpu-vm.c

percpu: perform tlb flush after pcpu_map_pages() failure

2014-11-05 20:27:38 +00:00

percpu.c

percpu: free percpu allocation info for uniprocessor system

2014-11-05 20:27:38 +00:00

pgtable-generic.c

…

prio_tree.c

…

process_vm_access.c

Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys

2013-03-20 15:03:37 +00:00

quicklist.c

…

readahead.c

…

rmap.c

mm: fix anon_vma->degree underflow in anon_vma endless growing prevention

2015-05-09 23:16:33 +01:00

shmem.c

fs: Give dentry to inode_change_ok() instead of inode

2016-11-20 01:01:43 +00:00

slab.c

slab/mempolicy: always use local policy from interrupt context

2014-09-13 23:41:50 +01:00

slob.c

…

slub.c

slub: refactoring unfreeze_partials()

2015-08-07 00:32:17 +01:00

sparse-vmemmap.c

…

sparse.c

…

swap_state.c

swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion

2013-06-19 02:17:01 +01:00

swap.c

mm: hugetlbfs: fix hugetlbfs optimization

2014-02-15 19:20:17 +00:00

swapfile.c

swapfile: fix memory corruption via malformed swapfile

2017-02-23 03:50:59 +00:00

thrash.c

…

truncate.c

mm: Remove false WARN_ON from pagecache_isize_extended()

2014-12-14 16:24:01 +00:00

util.c

…

vmalloc.c

mm: kmemleak: avoid false negatives on vmalloc'ed objects

2014-08-06 18:07:42 +01:00

vmscan.c

mm: vmscan: clear kswapd's special reclaim powers before exiting

2014-07-11 13:33:47 +01:00

vmstat.c

vmstat: allocate vmstat_wq before it is used

2016-01-22 21:40:10 +00:00