Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1524299

[PATCH 4.4 05/38] swapfile: fix memory corruption via malformed swapfile

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jann Horn <jann@thejh.net>

commit dd111be69114cc867f8e826284559bfbc1c40e37 upstream.

When root activates a swap partition whose header has the wrong
endianness, nr_badpages elements of badpages are swabbed before
nr_badpages has been checked, leading to a buffer overrun of up to 8GB.

This normally is not a security issue because it can only be exploited
by root (more specifically, a process with CAP_SYS_ADMIN or the ability
to modify a swap file/partition), and such a process can already e.g.
modify swapped-out memory of any other userspace process on the system.

Link: http://lkml.kernel.org/r/1477949533-2509-1-git-send-email-jann@thejh.net
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Jerome Marchand <jmarchan@redhat.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/swapfile.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2225,6 +2225,8 @@ static unsigned long read_swap_header(st
 		swab32s(&swap_header->info.version);
 		swab32s(&swap_header->info.last_page);
 		swab32s(&swap_header->info.nr_badpages);
+		if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
+			return 0;
 		for (i = 0; i < swap_header->info.nr_badpages; i++)
 			swab32s(&swap_header->info.badpages[i]);
 	}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/38] 4.4.33-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:40 +0100
  [PATCH 4.4 10/38] pinctrl: cherryview: Prevent possible interrupt storm on resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 06/38] coredump: fix unfreezable coredumping task Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 30/38] mei: bus: fix received data size check in NFC fixup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 05/38] swapfile: fix memory corruption via malformed swapfile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 33/38] i40e: fix call of ndo_dflt_bridge_getlink() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 11/38] staging: iio: ad5933: avoid uninitialized variable in error case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 29/38] iommu/vt-d: Fix dead-locks in disable_dmar_iommu() path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 18/38] toshiba-wmi: Fix loading the driver on non Toshiba laptops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 28/38] iommu/amd: Free domain id when free a domain of struct dma_ops_domain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 31/38] lib/genalloc.c: start search from start of chunk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 32/38] hwrng: core - Dont use a stack buffer in add_early_randomness() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 22/38] scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 36/38] mmc: mxs: Initialize the spinlock prior to using it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 38/38] netfilter: fix namespace handling in nf_log_proc_dostring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
    Re: [PATCH 4.4 38/38] netfilter: fix namespace handling in  nf_log_proc_dostring Pablo Neira Ayuso <pablo@netfilter.org> - 2016-11-17 12:10 +0100
      Re: [PATCH 4.4 38/38] netfilter: fix namespace handling in  nf_log_proc_dostring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 13:10 +0100
  [PATCH 4.4 35/38] ASoC: sun4i-codec: return error code instead of NULL when create_card fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 20/38] iio: hid-sensors: Increase the precision of scale to fix wrong reading interpretation. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 13/38] Revert "staging: nvec: ps2: change serio type to passthrough" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 17/38] drbd: Fix kernel_sendmsg() usage - potential NULL deref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 37/38] btrfs: qgroup: Prevent qgroup->reserved from going subzero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 34/38] ACPI / APEI: Fix incorrect return value of ghes_proc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 12/38] drivers: staging: nvec: remove bogus reset command for PS/2 interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 14/38] staging: nvec: remove managed resource from PS2 driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 26/38] dmaengine: at_xdmac: fix spurious flag status for mem2mem transfers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 15/38] USB: cdc-acm: fix TIOCMIWAIT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 09/38] pinctrl: cherryview: Serialize register access in suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 11:50 +0100
  [PATCH 4.4 01/38] ALSA: info: Return error for invalid read/write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 12:00 +0100
  [PATCH 4.4 03/38] ASoC: cs4270: fix DAPM stream name mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-17 12:00 +0100
  Re: [PATCH 4.4 00/38] 4.4.33-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-17 23:30 +0100

csiph-web