iMX/i2som-imx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
fa023d58cc6887643fe3e5e95a7ff599e2734df3
i2som-imx-linux/kernel
History
Kees Cook c01a9ac74a futex: Do not leak robust list to unprivileged process 
commit bdbb776f88 upstream.

It was possible to extract the robust list head address from a setuid
process if it had used set_robust_list(), allowing an ASLR info leak. This
changes the permission checks to be the same as those used for similar
info that comes out of /proc.

Running a setuid program that uses robust futexes would have had:
  cred->euid != pcred->euid
  cred->euid == pcred->uid
so the old permissions check would allow it. I'm not aware of any setuid
programs that use robust futexes, so this is just a preventative measure.

(This patch is based on changes from grsecurity.)

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Serge E. Hallyn <serge.hallyn@canonical.com>
Cc: kernel-hardening@lists.openwall.com
Cc: spender@grsecurity.net
Link: http://lkml.kernel.org/r/20120319231253.GA20893@www.outflux.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-04-22 15:39:18 -07:00
..
debug
kgdb,debug_core: pass the breakpoint struct instead of address and memory
2012-04-13 09:13:54 -07:00
events
perf/hwbp: Fix a possible memory leak
2012-02-28 09:52:54 +01:00
gcov
…
irq
genirq: Adjust irq thread affinity on IRQ_SET_MASK_OK_NOCOPY return value
2012-04-13 09:13:52 -07:00
power
PM / Sleep: Mitigate race between the freezer and request_firmware()
2012-04-13 09:13:54 -07:00
sched
Revert "CPU hotplug, cpusets, suspend: Don't touch cpusets during suspend/resume"
2012-03-07 08:21:19 -08:00
time
nohz: Fix stale jiffies update in tick_nohz_restart()
2012-04-22 15:38:59 -07:00
trace
tracing: Fix ent_size in trace output
2012-04-13 09:13:52 -07:00
.gitignore
…
acct.c
Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2012-01-08 12:19:57 -08:00
async.c
kernel/async: remove redundant declaration.
2012-01-13 09:32:18 +10:30
audit_tree.c
…
audit_watch.c
…
audit.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit
2012-01-17 16:41:31 -08:00
audit.h
audit: remove AUDIT_SETUP_CONTEXT as it isn't used
2012-01-17 16:16:57 -05:00
auditfilter.c
audit: allow interfield comparison in audit rules
2012-01-17 16:17:01 -05:00
auditsc.c
kernel-doc: fix new warnings in auditsc.c
2012-01-23 08:44:53 -08:00
backtracetest.c
…
bounds.c
…
capability.c
Revert "capabitlies: ns_capable can use the cap helpers rather than lsm call"
2012-01-17 10:19:41 -08:00
cgroup_freezer.c
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
cgroup.c
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
compat.c
kernel: Fix files explicitly needing EXPORT_SYMBOL infrastructure
2011-10-31 19:30:05 -04:00
configs.c
…
cpu_pm.c
…
cpu.c
Merge branch 'pm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2012-01-08 13:10:57 -08:00
cpuset.c
Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2012-01-09 12:59:24 -08:00
crash_dump.c
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
cred.c
cred: copy_process() should clear child->replacement_session_keyring
2012-04-13 09:13:57 -07:00
delayacct.c
…
dma.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
elfcore.c
…
exec_domain.c
…
exit.c
sched: Fix ancient race in do_exit()
2012-01-27 11:55:36 +01:00
extable.c
…
fork.c
vfork: kill PF_STARTING
2012-03-05 15:49:42 -08:00
freezer.c
freezer: kill unused set_freezable_with_signal()
2011-11-23 09:28:17 -08:00
futex_compat.c
futex: Do not leak robust list to unprivileged process
2012-04-22 15:39:18 -07:00
futex.c
futex: Do not leak robust list to unprivileged process
2012-04-22 15:39:18 -07:00
groups.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
hrtimer.c
Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2011-11-28 08:43:52 -08:00
hung_task.c
hung_task: fix the broken rcu_lock_break() logic
2012-03-05 15:49:42 -08:00
irq_work.c
kernel: fix two implicit header assumptions in irq_work.c
2011-10-31 09:20:12 -04:00
itimer.c
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
jump_label.c
Merge remote-tracking branch 'tip/perf/core' into kvm-updates/3.3
2011-12-27 11:22:24 +02:00
kallsyms.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
…
Kconfig.preempt
…
kexec.c
kdump: crashk_res init check for /sys/kernel/kexec_crash_size
2012-01-12 20:13:11 -08:00
kfifo.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
kmod.c
PM / Sleep: Mitigate race between the freezer and request_firmware()
2012-04-13 09:13:54 -07:00
kprobes.c
kprobes: return proper error code from register_kprobe()
2012-03-05 15:49:42 -08:00
ksysfs.c
kernel: ksysfs.c is implicitly using stat.h
2011-10-31 09:20:13 -04:00
kthread.c
freezer: kill unused set_freezable_with_signal()
2011-11-23 09:28:17 -08:00
latencytop.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
lockdep_internals.h
…
lockdep_proc.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
lockdep_states.h
…
lockdep.c
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-01-06 08:02:58 -08:00
Makefile
PM: Make sysrq-o be available for CONFIG_PM unset
2012-01-14 00:33:03 +01:00
module.c
module: Remove module size limit
2012-04-02 10:32:22 -07:00
mutex-debug.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
mutex-debug.h
…
mutex.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
mutex.h
…
notifier.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
nsproxy.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
padata.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
panic.c
panic: fix stack dump print on direct call to panic()
2012-04-22 15:38:56 -07:00
params.c
module: make module param bint handle nul value
2012-02-14 11:02:15 +10:30
pid_namespace.c
sysctl: add the kernel.ns_last_pid control
2012-01-12 20:13:11 -08:00
pid.c
vfs: fix panic in __d_lookup() with high dentry hashtable counts
2012-02-13 20:45:38 -05:00
posix-cpu-timers.c
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
posix-timers.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
printk.c
kmsg_dump: don't run on non-error paths by default
2012-03-05 15:49:42 -08:00
profile.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
ptrace.c
Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security
2012-01-14 18:36:33 -08:00
range.c
range: fix bogus misuse of module.h to get printk()
2011-10-31 09:20:11 -04:00
rcu.h
rcu: Deconfuse dynticks entry-exit tracing
2011-12-11 10:31:42 -08:00
rcupdate.c
rcu: Detect illegal rcu dereference in extended quiescent state
2011-12-11 10:31:30 -08:00
rcutiny_plugin.h
rcu: Apply ACCESS_ONCE() to rcu_boost() return value
2011-12-11 10:33:19 -08:00
rcutiny.c
rcu: Augment rcu_batch_end tracing for idle and callback state
2011-12-11 10:32:22 -08:00
rcutorture.c
rcu: Add missing __cpuinit annotation in rcutorture code
2012-01-16 09:44:05 -08:00
rcutree_plugin.h
rcu: Apply ACCESS_ONCE() to rcu_boost() return value
2011-12-11 10:33:19 -08:00
rcutree_trace.c
rcu: Track idleness independent of idle tasks
2011-12-11 10:31:24 -08:00
rcutree.c
rcu: Augment rcu_batch_end tracing for idle and callback state
2011-12-11 10:32:22 -08:00
rcutree.h
rcu: Keep invoking callbacks if CPU otherwise idle
2011-12-11 10:32:09 -08:00
relay.c
relay: prevent integer overflow in relay_open()
2012-02-10 09:04:49 +01:00
res_counter.c
net: introduce res_counter_charge_nofail() for socket allocations
2012-01-22 15:08:46 -05:00
resource.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
rtmutex_common.h
…
rtmutex-debug.c
lockdep, rtmutex, bug: Show taint flags on error
2011-12-06 08:16:49 +01:00
rtmutex-debug.h
…
rtmutex-tester.c
rtmutex-tester: convert sysdev_class to a regular subsystem
2011-12-14 14:54:22 -08:00
rtmutex.c
Revert "rcu: Permit rt_mutex_unlock() with irqs disabled"
2011-12-11 10:33:18 -08:00
rtmutex.h
…
rwsem.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
seccomp.c
seccomp: audit abnormal end to a process due to seccomp
2012-01-17 16:16:55 -05:00
semaphore.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
signal.c
user namespace: make signal.c respect user namespaces
2012-01-10 16:30:54 -08:00
smp.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
softirq.c
rcu: Fix early call to rcu_idle_enter()
2011-12-11 10:31:38 -08:00
spinlock.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
srcu.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
stacktrace.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
stop_machine.c
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
sys_ni.c
Cross Memory Attach
2011-10-31 17:30:44 -07:00
sys.c
prctl: use CAP_SYS_RESOURCE for PR_SET_MM option
2012-03-15 17:03:03 -07:00
sysctl_binary.c
binary_sysctl(): fix memory leak
2011-12-20 10:25:04 -08:00
sysctl_check.c
…
sysctl.c
sysctl: fix write access to dmesg_restrict/kptr_restrict
2012-04-13 09:13:55 -07:00
taskstats.c
…
test_kprobes.c
…
time.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
timeconst.pl
…
timer.c
Merge branch 'core-debugobjects-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2012-01-06 07:53:34 -08:00
tracepoint.c
tracepoints/module: Fix disabling tracepoints with taint CRAP or OOT
2012-01-16 11:35:57 -05:00
tsacct.c
[S390] cputime: add sparse checking and cleanup
2011-12-15 14:56:19 +01:00
uid16.c
…
up.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
user_namespace.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
user-return-notifier.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
user.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
utsname_sysctl.c
Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux
2011-11-06 19:44:47 -08:00
utsname.c
kernel: Map most files to use export.h instead of module.h
2011-10-31 09:20:12 -04:00
wait.c
lockdep/waitqueues: Add better annotation
2011-12-21 10:07:39 +01:00
watchdog.c
bugs, x86: Fix printk levels for panic, softlockups and stack dumps
2012-01-26 21:28:45 +01:00
workqueue_sched.h
…
workqueue.c
Block: use a freezable workqueue for disk-event polling
2012-03-02 10:51:00 +01:00