Eric W. Biederman
5f2d04139a
signal: Extend exec_id to 64bits ...
commit d1e7fd6462ca9fc76650fbe6ca800e35b24267da upstream.
Replace the 32bit exec_id with a 64bit exec_id to make it impossible
to wrap the exec_id counter. With care an attacker can cause exec_id
wrap and send arbitrary signals to a newly exec'd parent. This
bypasses the signal sending checks if the parent changes their
credentials during exec.
The severity of this problem can been seen that in my limited testing
of a 32bit exec_id it can take as little as 19s to exec 65536 times.
Which means that it can take as little as 14 days to wrap a 32bit
exec_id. Adam Zabrocki has succeeded wrapping the self_exe_id in 7
days. Even my slower timing is in the uptime of a typical server.
Which means self_exec_id is simply a speed bump today, and if exec
gets noticably faster self_exec_id won't even be a speed bump.
Extending self_exec_id to 64bits introduces a problem on 32bit
architectures where reading self_exec_id is no longer atomic and can
take two read instructions. Which means that is is possible to hit
a window where the read value of exec_id does not match the written
value. So with very lucky timing after this change this still
remains expoiltable.
I have updated the update of exec_id on exec to use WRITE_ONCE
and the read of exec_id in do_notify_parent to use READ_ONCE
to make it clear that there is no locking between these two
locations.
Link: https://lore.kernel.org/kernel-hardening/20200324215049.GA3710@pi3.com.pl
Fixes: 2.3.23pre2
Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:12 +02:00
can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
2020-01-14 20:08:28 +01:00
libceph: fix alloc_msg_with_page_vector() memory leaks
2020-04-02 15:11:02 +02:00
clk: add include guard to clk-conf.h
2019-09-17 10:27:46 -07:00
net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop
2020-04-01 11:01:34 +02:00
Char/Misc driver patches for 5.4-rc1
2019-09-18 11:14:31 -07:00
gpio: add gpiod_toggle_active_low()
2020-02-19 19:53:09 +01:00
chrome platform changes for v5.4
2019-09-19 14:14:28 -07:00
Merge branch 'next' into for-linus
2019-09-16 09:56:27 -07:00
mailbox: mediatek: cmdq: clear the event in cmdq initial flow
2019-09-17 00:40:05 -05:00
mfd: bd70528: Fix hour register mask
2020-02-11 04:35:52 -08:00
IB/mlx5: Replace tunnel mpls capability bits for tunnel_offloads
2020-04-13 10:48:10 +02:00
mmc: core: Allow host controllers to require R1B for CMD6
2020-04-01 11:01:27 +02:00
This pull-request contains the following changes for MTD:
2019-09-21 10:59:54 -07:00
netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports
2020-03-05 16:43:44 +01:00
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO
2020-02-24 08:36:35 +01:00
ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
2020-02-01 09:34:49 +00:00
RDMA subsystem updates for 5.4
2019-09-21 10:26:24 -07:00
raid6/test: fix a compilation warning
2020-02-24 08:36:47 +01:00
regulator fix for "regulator: core: Add regulator_is_equal() helper"
2020-02-11 04:35:55 -08:00
timers/nohz: Update NOHZ load in remote tick
2020-03-05 16:43:36 +01:00
drm main pull for 5.4-rc1
2019-09-19 16:24:24 -07:00
SUNRPC: Destroy the back channel when we destroy the host transport
2019-10-30 12:04:35 -04:00
USB: core: add endpoint-blacklist quirk
2020-02-28 17:22:16 +01:00
ACPI: PM: Add acpi_[un]register_wakeup_handler()
2020-04-13 10:48:08 +02:00
ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
2020-01-09 10:19:59 +01:00
memcg: fix a crash in wb_workfn when a device disappears
2020-02-11 04:35:11 -08:00
block: add bio_truncate to fix guard_bio_eod
2020-01-09 10:19:54 +01:00
bitmap.h: fix kernel-doc warning and typo
2019-10-14 15:04:01 -07:00
lib: introduce copy_struct_from_user() helper
2019-10-01 15:45:03 +02:00
blktrace: Protect q->blk_trace with RCU
2020-03-05 16:43:52 +01:00
blktrace: Protect q->blk_trace with RCU
2020-03-05 16:43:52 +01:00
bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
2019-10-31 21:41:33 +01:00
cgroup: Iterate tasks that did not finish do_exit()
2020-03-18 07:17:48 +01:00
Merge branches 'clk-init-destroy', 'clk-doc', 'clk-imx' and 'clk-allwinner' into clk-next
2019-09-19 15:31:27 -07:00
We have a small collection of core framework updates this time, mostly around
2019-09-20 15:45:07 -07:00
mm, compaction: raise compaction priority after it withdrawns
2019-09-24 15:54:10 -07:00
futex: Move futex exit handling into futex code
2019-11-29 10:10:08 +01:00
compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use
2019-10-11 09:26:05 -07:00
Make use of gcc 9's "asm inline()" (Rasmus Villemoes):
2019-09-21 09:47:19 -07:00
cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
2020-04-17 10:50:11 +02:00
cpufreq: Avoid creating excessively large stack frames
2020-02-11 04:35:25 -08:00
padata: validate cpumask without removed CPU during offline
2020-02-24 08:36:34 +01:00
Power management updates for 5.4-rc1
2019-09-17 19:15:14 -07:00
cpumask: nicer for_each_cpumask_and() signature
2019-09-25 17:51:40 -07:00
selinux/stable-5.4 PR 20190917
2019-09-23 11:21:04 -07:00
thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
2020-04-17 10:50:09 +02:00
USB changes for 5.4-rc1
2019-09-18 10:33:46 -07:00
dma-direct: check for overflows on 32 bit DMA addresses
2020-01-04 19:17:24 +01:00
dma-mapping: fix handling of dma-ranges for reserved memory (again)
2020-01-04 19:17:00 +01:00
dmaengine: Store module owner in dma_device struct
2020-02-24 08:36:40 +01:00
iommu/vt-d: Silence RCU-list debugging warnings
2020-04-01 11:01:53 +02:00
dynamic_debug: provide dynamic_hex_dump stub
2019-10-22 12:54:44 -07:00
x86, efi: Never relocate kernel below lowest acceptable address
2019-10-31 09:40:19 +01:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:35:37 -08:00
symbol namespaces: revert to previous __ksymtab name scheme
2019-10-18 15:32:52 +02:00
bpf: Fix use after free in subprog's jited symbol removal
2019-10-22 11:26:09 -07:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
fuse update for 5.4
2019-09-25 09:55:59 -07:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
net: fix sk_page_frag() recursion from memory reclaim
2019-10-28 16:17:31 -07:00
HID: core: increase HID report buffer size to 8KiB
2020-03-05 16:43:42 +01:00
hrtimer: Annotate lockless access to timer->state
2020-01-04 19:18:41 +01:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
mm: introduce page_size()
2019-09-24 15:54:08 -07:00
hwmon: Fix HWMON_P_MIN_ALARM mask
2019-10-02 06:36:50 -07:00
- First round of vmbus hibernation support from Dexuan Cui.
2019-09-24 12:36:31 -07:00
Merge branch 'i2c/for-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
2019-09-24 16:48:02 -07:00
XArray updates for 5.4
2019-11-08 08:46:49 -08:00
ieee80211: fix HE SPR size calculation
2020-04-01 11:02:09 +02:00
macvlan: do not assume mac_header is set in macvlan_broadcast()
2020-01-12 12:21:46 +01:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
team: fix nested locking lockdep warning
2019-10-24 14:53:48 -07:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
inet_diag: return classid for all socket types
2020-03-18 07:17:38 +01:00
iommu/vt-d: Fix debugfs register reads
2020-04-01 11:01:55 +02:00
iommu/vt-d: Fix compile warning from intel-svm.h
2020-02-28 17:22:26 +01:00
Power management updates for 5.4-rc1
2019-09-17 19:15:14 -07:00
augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro
2019-09-25 17:51:39 -07:00
block: Fix use-after-free issue accessing struct io_cq
2020-04-17 10:50:04 +02:00
iomap: move the iomap_dio_rw ->end_io callback into a structure
2019-09-19 15:32:45 -07:00
ipmi: Don't allow device module unload when in use
2019-12-31 16:44:14 +01:00
x86/apic/msi: Plug non-maskable MSI affinity race
2020-02-11 04:35:54 -08:00
genirq/irqdomain: Make sure all irq domain flags are distinct
2020-02-28 17:22:20 +01:00
jbd2: Fix possible overflow in jbd2_log_space_left()
2019-12-13 08:42:53 +01:00
kernfs: fix ino wrap-around detection
2019-12-13 08:42:53 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
kgdb: don't use a notifier to enter kgdb at panic; call directly
2019-09-25 17:51:40 -07:00
khugepaged: enable collapse pmd for pte-mapped THP
2019-09-24 15:54:11 -07:00
KVM: Use vcpu-specific gva->hva translation when querying host page size
2020-02-11 04:35:54 -08:00
x86/kvm: Cache gfn to pfn translation
2020-02-11 04:35:40 -08:00
leds: core: Fix leds.h structure documentation
2019-10-08 22:05:58 +02:00
ata: ahci: Add shutdown to freeze hardware resources of ahci
2020-02-28 17:22:28 +01:00
libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
2020-01-04 19:18:28 +01:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
mm: fork: fix kernel_stack memcg stats for various stack implementations
2020-04-01 11:02:03 +02:00
mm/memory_hotplug: fix try_offline_node()
2019-11-15 18:34:00 -08:00
mm/memory_hotplug: shrink zones when offlining memory
2020-01-09 10:19:56 +01:00
Revert "Revert "mm, thp: restore node-local hugepage allocations""
2019-09-28 14:05:38 -07:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
net: phy: micrel: Update KSZ87xx PHY name
2019-10-17 16:31:52 -07:00
net: phy: fix write to mii-ctrl1000 register
2019-10-04 18:11:08 -07:00
rfkill: allocate static minor
2019-12-13 08:43:18 +01:00
mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled
2020-03-12 13:00:19 +01:00
mm: thp: handle page cache THP correctly in PageTransCompoundMap
2019-11-06 08:28:58 -08:00
fork: improve error message for corrupted page tables
2019-09-25 17:51:40 -07:00
mm: memcg/slab: fix percpu slab vmstats flushing
2020-01-23 08:22:39 +01:00
mod_devicetable: fix PHY module format
2019-12-31 16:41:16 +01:00
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
2019-09-27 19:37:27 -07:00
net: export netdev_next_lower_dev_rcu()
2020-03-05 16:43:35 +01:00
netfilter: remove CONFIG_NETFILTER checks from headers.
2019-09-13 12:47:36 +02:00
netfilter: move nf_bridge_frag_data struct definition to a more appropriate header.
2019-09-13 12:35:33 +02:00
netfilter: move nf_bridge_frag_data struct definition to a more appropriate header.
2019-09-13 12:35:33 +02:00
NFS: Refactor nfs_instantiate() for dentry referencing callers
2019-09-20 15:15:24 -04:00
nvme-fc: Revert "add module to ops template to allow module references"
2020-04-17 10:50:10 +02:00
nvme: introduce "Command Aborted By host" status code
2019-12-31 16:44:40 +01:00
nvmem: core: fix nvmem_cell_write inline function
2019-12-31 16:44:43 +01:00
crypto: pcrypt - Avoid deadlock by using per-instance padata queues
2020-02-11 04:35:28 -08:00
page-flags: fix a crash at SetPageError(THP_SWAP)
2020-03-25 08:25:58 +01:00
mm, page_owner: rename flag indicating that page is allocated
2019-10-14 15:04:00 -07:00
mm: page cache: store only head pages in i_pages
2019-09-24 15:54:08 -07:00
PCI: endpoint: Fix for concurrent memory allocation in OB address region
2020-04-17 10:50:11 +02:00
PCI: Add nr_devfns parameter to pci_add_dma_alias()
2020-02-24 08:36:37 +01:00
pci-v5.4-changes
2019-09-23 19:16:01 -07:00
percpu: Separate decrypted varaibles anytime encryption can be enabled
2020-02-11 04:35:44 -08:00
perf/headers: Fix spelling s/EACCESS/EACCES/, s/privilidge/privilege/
2019-10-28 11:02:01 +01:00
net: phy: fix MDIO bus PM PHY resuming
2020-03-18 07:17:46 +01:00
driver code: clarify and fix platform device DMA mask allocation
2020-03-18 07:17:56 +01:00
PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX
2019-12-21 11:04:31 +01:00
ptp: fix the race between the release of ptp_clock and cdev
2020-01-04 19:18:48 +01:00
lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds
2019-09-25 17:51:39 -07:00
pwm: Ensure pwm_apply_state() doesn't modify the state argument
2019-09-21 03:25:10 +02:00
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
2020-01-04 19:17:25 +01:00
quota: Check that quota is not dirty before release
2019-12-17 19:56:43 +01:00
radix tree: Remove radix_tree_iter_find
2019-11-01 22:26:34 -04:00
augmented rbtree: rework the RB_DECLARE_CALLBACKS macro definition
2019-09-25 17:51:39 -07:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-09-16 17:25:49 -07:00
tasks, sched/core: With a grace period after finish_task_switch(), remove unnecessary code
2019-09-25 17:42:29 +02:00
reset: fix reset_control_ops kerneldoc comment
2019-10-28 12:18:23 +01:00
reset: fix reset_control_get_exclusive kerneldoc comment
2019-10-24 10:26:33 +02:00
cifs: Add support for root file systems
2019-09-16 11:43:38 -05:00
signal: Extend exec_id to 64bits
2020-04-17 10:50:12 +02:00
efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
2019-10-31 09:40:21 +01:00
vt: selection, introduce vc_is_sel
2020-04-02 15:11:00 +02:00
mm: shrinker: make shrinker not depend on memcg kmem
2019-09-24 15:54:11 -07:00
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
2020-04-01 11:02:18 +02:00
bpf: Sockmap/tls, push write_space updates through ulp updates
2020-01-23 08:22:45 +01:00
mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)
2019-10-07 15:47:20 -07:00
net: increase SOMAXCONN to 4096
2019-10-31 14:01:40 -07:00
lib/string: Make memzero_explicit() inline instead of external
2019-10-08 13:27:05 +02:00
ACPI: PM: s2idle: Avoid possible race related to the EC GPE
2020-02-19 19:52:56 +01:00
uapi: rename ext2_swab() to swab() and share globally in swab.h
2020-04-13 10:48:07 +02:00
mm: introduce MADV_PAGEOUT
2019-09-25 17:51:41 -07:00
sysfs: Fixes __BIN_ATTR_WO() macro
2019-10-02 10:06:45 +02:00
block: centralize PI remapping logic to the block layer
2019-09-17 20:03:49 -06:00
tcp: add rcu protection around tp->fastopen_rsk
2019-10-13 10:13:08 -07:00
uaccess: disallow > INT_MAX copy sizes
2020-01-04 19:18:42 +01:00
tcp: fix rejected syncookies due to stale timestamps
2019-12-18 16:08:43 +01:00
bpf: Fix incorrect verifier simulation of ARSH under ALU32
2020-01-23 08:22:44 +01:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-09-16 17:25:49 -07:00
efi/tpm: Only set 'efi_tpm_final_log_size' after successful event log parsing
2019-10-07 15:24:36 +02:00
serdev: ttyport: restore client ops on deregistration
2020-02-28 17:22:19 +01:00
uaccess: Add non-pagefault user-space write function
2020-01-17 19:48:40 +01:00
vsock/virtio: remove unused 'work' field from 'struct virtio_vsock_pkt'
2019-10-28 04:25:04 -04:00
x86/mm: split vmalloc_sync_all()
2020-03-25 08:25:58 +01:00
vt: switch vt_dont_switch to bool
2020-04-02 15:11:00 +02:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-09-17 12:35:15 -07:00
workqueue: unconfine alloc/apply/free_workqueue_attrs()
2019-09-13 21:15:39 +10:00
xarray.h: fix kernel-doc warning
2019-10-14 15:04:01 -07:00
zpool: add malloc_support_movable to zpool_driver
2019-09-24 15:54:12 -07:00
