android_kernel_oneplus_msm8998/include
Willy Tarreau adc143b97d proc: do not access cmdline nor environ from file-backed areas
commit 7f7ccc2ccc2e70c6054685f5e3522efa81556830 upstream.

proc_pid_cmdline_read() and environ_read() directly access the target
process' VM to retrieve the command line and environment. If this
process remaps these areas onto a file via mmap(), the requesting
process may experience various issues such as extra delays if the
underlying device is slow to respond.

Let's simply refuse to access file-backed areas in these functions.
For this we add a new FOLL_ANON gup flag that is passed to all calls
to access_remote_vm(). The code already takes care of such failures
(including unmapped areas). Accesses via /proc/pid/mem were not
changed though.

This was assigned CVE-2018-1120.

Note for stable backports: the patch may apply to kernels prior to 4.11
but silently miss one location; it must be checked that no call to
access_remote_vm() keeps zero as the last argument.

Reported-by: Qualys Security Advisory <qsa@qualys.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 4.4:
 - Update the extra call to access_remote_vm() from proc_pid_cmdline_read()
 - Adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-17 21:55:17 +01:00
..
acpi Merge branch 'acpi-pci' 2015-11-07 01:30:10 +01:00
asm-generic ioremap: Update pgtable free interfaces with addr 2018-08-17 20:56:45 +02:00
clocksource
crypto crypto: vmac - separate tfm and request context 2018-08-17 20:56:45 +02:00
drm drm: Add DP PSR2 sink enable bit 2018-08-06 16:24:39 +02:00
dt-bindings ARM: dts: Fix omap3 off mode pull defines 2017-11-21 09:21:19 +01:00
keys KEYS: Merge the type-specific data with the payload data 2015-10-21 15:18:36 +01:00
kvm KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active 2015-11-24 18:07:40 +01:00
linux proc: do not access cmdline nor environ from file-backed areas 2018-12-17 21:55:17 +01:00
math-emu
media media: v4l: event: Prevent freeing event subscriptions while accessed 2018-10-10 08:52:10 +02:00
memory
misc
net neighbour: Avoid writing before skb->head in neigh_hh_output() 2018-12-17 21:55:09 +01:00
pcmcia
ras
rdma IB/core: Make testing MR flags for writability a static inline function 2018-08-15 17:42:06 +02:00
rxrpc
scsi scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state 2018-11-10 07:41:37 -08:00
soc memory: tegra: Apply interrupts mask per SoC 2018-08-06 16:24:38 +02:00
sound ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command 2018-12-17 21:55:12 +01:00
target target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK 2018-01-17 09:35:31 +01:00
trace tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account 2018-05-30 07:48:52 +02:00
uapi ethtool: Remove trailing semicolon for static inline 2018-09-19 22:48:56 +02:00
video udlfb: set optimal write delay 2018-09-09 20:04:36 +02:00
xen fix xen_swiotlb_dma_mmap prototype 2017-10-05 09:41:48 +02:00
Kbuild