Willy Tarreau
867fbf2bb7
lib/syscall: fix syscall registers retrieval on 32-bit platforms
...
commit 4f134b89a24b965991e7c345b9a4591821f7c2a6 upstream.
Lilith >_> and Claudio Bozzato of Cisco Talos security team reported
that collect_syscall() improperly casts the syscall registers to 64-bit
values leaking the uninitialized last 24 bytes on 32-bit platforms, that
are visible in /proc/self/syscall.
The cause is that info->data.args are u64 while syscall_get_arguments()
uses longs, as hinted by the bogus pointer cast in the function.
Let's just proceed like the other call places, by retrieving the
registers into an array of longs before assigning them to the caller's
array. This was successfully tested on x86_64, i386 and ppc32.
Reference: CVE-2020-28588, TALOS-2020-1211
Fixes: 631b7abacd ("ptrace: Remove maxargs from task_current_syscall()")
Cc: Greg KH <greg@kroah.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Michael Ellerman <mpe@ellerman.id.au> (ppc32)
Signed-off-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:23:32 +01:00
..
842
lib: 842: no need to check return value of debugfs_create functions
2019-07-03 16:57:17 +02:00
crypto
crypto: sha256 - Remove sha256/224_init code duplication
2019-09-05 14:54:54 +10:00
dim
lib/dim: Fix -Wunused-const-variable warnings
2019-07-25 11:34:39 -07:00
fonts
Fonts: Replace discarded const qualifier
2020-11-10 12:37:26 +01:00
livepatch
lz4
lz4: do not export static symbol
2019-09-20 09:06:26 -07:00
lzo
lib/lzo: fix ambiguous encoding bug in lzo-rle
2020-06-17 16:40:28 +02:00
math
mpi
lib/mpi: Fix 64-bit MIPS build with Clang
2020-06-22 09:31:00 +02:00
raid6
lib/raid6/test: fix build on distros whose /bin/sh is not bash
2020-04-29 16:33:00 +02:00
reed_solomon
rslib: Make some functions static
2019-07-02 08:41:37 +02:00
vdso
lib/vdso: Make clock_getres() POSIX compliant again
2019-10-23 14:48:23 +02:00
xz
lib/xz: fix XZ_DYNALLOC to avoid useless memory reallocations
2019-11-15 18:34:00 -08:00
zlib_deflate
zlib_inflate
lib/zlib: remove outdated and incorrect pre-increment optimization
2020-06-24 17:50:39 +02:00
zstd
lib/zstd/mem.h: replace __inline by inline
2019-09-15 19:42:16 +02:00
.gitignore
argv_split.c
ashldi3.c
ashrdi3.c
asn1_decoder.c
assoc_array.c
atomic64.c
atomic64_test.c
audit.c
bcd.c
bch.c
bitmap.c
cpumask: Implement cpumask_or_equal()
2019-07-25 15:47:37 +02:00
bitrev.c
bsearch.c
btree.c
bucket_locks.c
bug.c
bug: move WARN_ON() "cut here" into exception handler
2019-09-25 17:51:41 -07:00
build_OID_registry
bust_spinlocks.c
chacha.c
check_signature.c
checksum.c
clz_ctz.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
clz_tab.c
cmdline.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
cmpdi2.c
compat_audit.c
cpu_rmap.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
cpumask.c
crc-ccitt.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
crc-itu-t.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
crc-t10dif.c
crc-t10dif: Fix potential crypto notify dead-lock
2020-08-19 08:15:54 +02:00
crc4.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
crc7.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
crc8.c
crc16.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
crc32.c
lib/crc32.c: fix trivial typo in preprocessor condition
2020-10-29 09:57:52 +01:00
crc32defs.h
crc32test.c
lib/crc32test: remove extra local_irq_disable/enable
2020-11-10 12:37:27 +01:00
crc64.c
ctype.c
debug_info.c
debug_locks.c
debugobjects.c
debugobjects: Fix various data races
2020-02-24 08:36:52 +01:00
dec_and_lock.c
decompress.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c
devres.c
devres: keep both device name and resource name in pretty name
2020-08-21 13:05:32 +02:00
digsig.c
Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"
2019-07-10 18:43:43 -07:00
dump_stack.c
dump_stack: avoid the livelock of the dump_lock
2019-11-06 08:47:50 -08:00
dynamic_debug.c
dyndbg: fix a BUG_ON in ddebug_describe_flags
2020-08-19 08:16:04 +02:00
dynamic_queue_limits.c
earlycpio.c
error-inject.c
errseq.c
extable.c
lib/extable.c: add missing prototypes
2019-09-25 17:51:39 -07:00
fault-inject.c
fdt.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_bit.c
uapi: rename ext2_swab() to swab() and share globally in swab.h
2020-04-13 10:48:07 +02:00
find_bit_benchmark.c
flex_proportions.c
gen_crc32table.c
gen_crc64table.c
genalloc.c
dma-mapping updates for Linux 5.3
2019-07-12 15:13:55 -07:00
generic-radix-tree.c
lib/generic-radix-tree.c: add kmemleak annotations
2019-10-14 15:04:00 -07:00
glob.c
globtest.c
hexdump.c
lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds
2019-09-25 17:51:39 -07:00
hweight.c
idr.c
ida: Free allocated bitmap in error path
2020-10-29 09:57:47 +01:00
inflate.c
interval_tree.c
interval_tree_test.c
iomap.c
iomap_copy.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 504
2019-06-19 17:09:56 +02:00
iommu-helper.c
ioremap.c
mm/ioremap: probe platform for p4d huge map support
2019-07-16 19:23:22 -07:00
iov_iter.c
mm: introduce page_size()
2019-09-24 15:54:08 -07:00
irq_poll.c
irq_regs.c
is_single_threaded.c
kasprintf.c
Kconfig
lib: Remove select of inexistant GENERIC_IO
2019-11-10 10:38:43 -08:00
Kconfig.debug
kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
2020-10-01 13:17:10 +02:00
Kconfig.kasan
kasan: add memory corruption identification for software tag-based mode
2019-09-24 15:54:07 -07:00
Kconfig.kgdb
Kconfig.ubsan
kfifo.c
Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
2019-08-30 18:47:15 -07:00
klist.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 248
2019-06-19 17:09:08 +02:00
kobject.c
kobject: Restore old behaviour of kobject_del(NULL)
2020-09-17 13:47:52 +02:00
kobject_uevent.c
kstrtox.c
kstrtox.h
libcrc32c.c
list_debug.c
list_sort.c
lib: list_sort.c: add a blank line to avoid kernel-doc warnings
2019-06-20 14:07:34 -06:00
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-rtmutex.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lockref.c
logic_pio.c
lib: logic_pio: Add logic_pio_unregister_range()
2019-08-13 14:54:24 +08:00
lru_cache.c
lshrdi3.c
Makefile
Merge branch 'x86/cleanups' into x86/cpu, to pick up dependent changes
2019-09-06 07:30:23 +02:00
memcat_p.c
memory-notifier-error-inject.c
memweight.c
muldi3.c
net_utils.c
netdev-notifier-error-inject.c
nlattr.c
nmi_backtrace.c
nodemask.c
notifier-error-inject.c
lib: notifier-error-inject: no need to check return value of debugfs_create functions
2019-07-03 16:57:18 +02:00
notifier-error-inject.h
objagg.c
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c
packing.c
parman.c
parser.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230
2019-06-19 17:09:06 +02:00
pci_iomap.c
percpu-refcount.c
Merge branch 'for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu
2019-07-14 16:17:18 -07:00
percpu_counter.c
percpu_test.c
plist.c
pm-notifier-error-inject.c
radix-tree.c
idr: Fix idr_alloc_u32 on 32-bit systems
2019-11-03 06:36:50 -05:00
random32.c
random32: make prandom_u32() output unpredictable
2020-11-18 19:20:20 +01:00
ratelimit.c
rbtree.c
lib/rbtree: avoid generating code twice for the cached versions
2019-07-16 19:23:22 -07:00
rbtree_test.c
augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro
2019-09-25 17:51:39 -07:00
refcount.c
rhashtable.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
sbitmap.c
sbitmap: only queue kyber's wait callback if not already active
2020-01-12 12:21:44 +01:00
scatterlist.c
sgl_alloc_order: fix memory leak
2020-11-05 11:43:22 +01:00
seq_buf.c
sg_pool.c
SCSI sg on 20190709
2019-07-11 15:17:41 -07:00
sg_split.c
lib: scatterlist: Fix to support no mapped sg
2019-08-08 07:45:01 -06:00
sha1.c
show_mem.c
mm: remove quicklist page table caches
2019-09-24 15:54:09 -07:00
siphash.c
smp_processor_id.c
sort.c
media: lib/sort.c: implement sort() variant taking context argument
2019-08-19 13:14:53 -03:00
stackdepot.c
lib/stackdepot.c: fix global out-of-bounds in stack_slabs
2020-02-28 17:22:20 +01:00
stmp_device.c
string.c
lib/string.c: implement stpcpy
2020-10-01 13:18:23 +02:00
string_helpers.c
lib/string_helpers: fix some kerneldoc warnings
2019-07-16 19:23:22 -07:00
strncpy_from_user.c
lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()
2020-01-29 16:45:29 +01:00
strnlen_user.c
lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()
2020-01-29 16:45:29 +01:00
syscall.c
lib/syscall: fix syscall registers retrieval on 32-bit platforms
2020-12-11 13:23:32 +01:00
test-kstrtox.c
test-string_helpers.c
test_bitfield.c
test_bitmap.c
test_blackhole_dev.c
blackhole_dev: add a selftest
2019-07-01 19:34:46 -07:00
test_bpf.c
test_bpf: Fix a new clang warning about xor-ing two numbers
2019-08-20 17:07:29 +02:00
test_debug_virtual.c
test_firmware.c
test_firmware: add support for request_firmware_into_buf
2019-09-04 13:31:28 +02:00
test_hash.c
test_hexdump.c
test_ida.c
test_kasan.c
kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE
2020-06-22 09:31:12 +02:00
test_kmod.c
test_kmod: avoid potential double free in trigger_config_run_type()
2020-08-21 13:05:37 +02:00
test_list_sort.c
test_memcat_p.c
test_meminit.c
lib/test_meminit: add a kmem_cache_alloc_bulk() test
2019-10-14 15:04:01 -07:00
test_module.c
test_objagg.c
test_objagg: Fix potential memory leak in error handling
2020-06-30 15:37:04 -04:00
test_overflow.c
lib/test_overflow.c: avoid tainting the kernel and fix wrap size
2019-07-16 19:23:22 -07:00
test_parman.c
test_printf.c
vsprintf: don't obfuscate NULL and error pointers
2020-05-27 17:46:43 +02:00
test_rhashtable.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
test_siphash.c
test_sort.c
test_stackinit.c
test_static_key_base.c
test_static_keys.c
test_string.c
lib/test_string.c: add some testcases for strchr and strnchr
2019-07-16 19:23:22 -07:00
test_strscpy.c
test_sysctl.c
test_ubsan.c
test_user_copy.c
usercopy: Avoid soft lockups in test_check_nonzero_user()
2019-10-16 14:56:21 +02:00
test_uuid.c
test_vmalloc.c
test_xarray.c
XArray: Fix xas_pause for large multi-index entries
2020-04-17 10:50:18 +02:00
textsearch.c
lib: textsearch: fix escapes in example code
2019-10-03 12:12:23 -04:00
timerqueue.c
lib/timerqueue: Rely on rbtree semantics for next timer
2019-07-24 17:38:01 +02:00
ts_bm.c
ts_fsm.c
ts_kmp.c
ubsan.c
lib/ubsan: don't serialize UBSAN report
2020-01-09 10:20:07 +01:00
ubsan.h
ucmpdi2.c
ucs2_string.c
usercopy.c
lib: introduce copy_struct_from_user() helper
2019-10-01 15:45:03 +02:00
uuid.c
vsprintf.c
vsprintf: don't obfuscate NULL and error pointers
2020-05-27 17:46:43 +02:00
win_minmax.c
xarray.c
xarray: Fix early termination of xas_for_each_marked
2020-04-17 10:50:18 +02:00
xxhash.c