No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jann Horn c8157f67b0 timers: Prevent union confusion from unexpected restart_syscall()
[ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ]

The nanosleep syscalls use the restart_block mechanism, with a quirk:
The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on
syscall entry, while the rest of the restart_block is only set up in the
unlikely case that the syscall is actually interrupted by a signal (or
pseudo-signal) that doesn't have a signal handler.

If the restart_block was set up by a previous syscall (futex(...,
FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then,
this will clobber some of the union fields used by futex_wait_restart() and
do_restart_poll().

If userspace afterwards wrongly calls the restart_syscall syscall,
futex_wait_restart()/do_restart_poll() will read struct fields that have
been clobbered.

This doesn't actually lead to anything particularly interesting because
none of the union fields contain trusted kernel data, and
futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much
sense to apply seccomp filters to their arguments.

So the current consequences are just of the "if userspace does bad stuff,
it can damage itself, and that's not a problem" flavor.

But still, it seems like a hazard for future developers, so invalidate the
restart_block when partly setting it up in the nanosleep syscalls.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-11 16:43:54 +01:00
arch ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy 2023-03-11 16:43:54 +01:00
block blk-iocost: fix divide by 0 error in calc_lcoefs() 2023-03-11 16:43:54 +01:00
certs
crypto crypto: rsa-pkcs1pad - Use akcipher_request_complete 2023-03-11 16:43:41 +01:00
Documentation
drivers thermal: intel: Fix unsigned comparison with less than zero 2023-03-11 16:43:54 +01:00
fs udf: Define EFSCORRUPTED error code 2023-03-11 16:43:53 +01:00
include ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared 2023-03-11 16:43:48 +01:00
init
ipc
kernel timers: Prevent union confusion from unexpected restart_syscall() 2023-03-11 16:43:54 +01:00
lib lib/mpi: Fix buffer overrun when SG is too long 2023-03-11 16:43:38 +01:00
LICENSES
mm
net wifi: mac80211: make rate u32 in sta_set_rate_info_rx() 2023-03-11 16:43:42 +01:00
samples
scripts
security
sound ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() 2023-03-11 16:43:46 +01:00
tools selftests/ftrace: Fix bash specific "==" operator 2023-03-11 16:43:50 +01:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.234 2023-03-03 11:41:49 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.