Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1620267

[PATCH 4.4 32/32] mm/mempolicy.c: fix error handling in set_mempolicy and mbind.

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.4 32/32] mm/mempolicy.c: fix error handling in set_mempolicy and mbind.
Date 2017-04-10 18:50 +0200
Message-ID <tuKFR-3ds-55@gated-at.bofh.it> (permalink)
References <tuKwa-38R-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Salls <salls@cs.ucsb.edu>

commit cf01fb9985e8deb25ccf0ea54d916b8871ae0e62 upstream.

In the case that compat_get_bitmap fails we do not want to copy the
bitmap to the user as it will contain uninitialized stack data and leak
sensitive data.

Signed-off-by: Chris Salls <salls@cs.ucsb.edu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/mempolicy.c |   20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1492,7 +1492,6 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, in
 COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask,
 		       compat_ulong_t, maxnode)
 {
-	long err = 0;
 	unsigned long __user *nm = NULL;
 	unsigned long nr_bits, alloc_size;
 	DECLARE_BITMAP(bm, MAX_NUMNODES);
@@ -1501,14 +1500,13 @@ COMPAT_SYSCALL_DEFINE3(set_mempolicy, in
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
 	if (nmask) {
-		err = compat_get_bitmap(bm, nmask, nr_bits);
+		if (compat_get_bitmap(bm, nmask, nr_bits))
+			return -EFAULT;
 		nm = compat_alloc_user_space(alloc_size);
-		err |= copy_to_user(nm, bm, alloc_size);
+		if (copy_to_user(nm, bm, alloc_size))
+			return -EFAULT;
 	}
 
-	if (err)
-		return -EFAULT;
-
 	return sys_set_mempolicy(mode, nm, nr_bits+1);
 }
 
@@ -1516,7 +1514,6 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulo
 		       compat_ulong_t, mode, compat_ulong_t __user *, nmask,
 		       compat_ulong_t, maxnode, compat_ulong_t, flags)
 {
-	long err = 0;
 	unsigned long __user *nm = NULL;
 	unsigned long nr_bits, alloc_size;
 	nodemask_t bm;
@@ -1525,14 +1522,13 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulo
 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
 	if (nmask) {
-		err = compat_get_bitmap(nodes_addr(bm), nmask, nr_bits);
+		if (compat_get_bitmap(nodes_addr(bm), nmask, nr_bits))
+			return -EFAULT;
 		nm = compat_alloc_user_space(alloc_size);
-		err |= copy_to_user(nm, nodes_addr(bm), alloc_size);
+		if (copy_to_user(nm, nodes_addr(bm), alloc_size))
+			return -EFAULT;
 	}
 
-	if (err)
-		return -EFAULT;
-
 	return sys_mbind(start, len, mode, nm, nr_bits+1, flags);
 }
 

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 4.4 00/32] 4.4.61-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 05/32] drm/vmwgfx: Remove getparam error message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 01/32] drm/vmwgfx: Type-check lookups of fence objects Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 06/32] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 28/32] MIPS: ralink: Fix typos in rt3883 pinctrl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 09/32] arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 16/32] metag/usercopy: Fix alignment error checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 30/32] MIPS: Lantiq: fix missing xbar kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 32/32] mm/mempolicy.c: fix error handling in set_mempolicy and mbind. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 23/32] powerpc: Dont try to fix up misaligned load-with-reservation instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 20/32] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 08/32] staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 29/32] MIPS: End spinlocks with .insn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 27/32] MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
    Re: [PATCH 4.4 27/32] MIPS: Force o32 fp64 support on 32bit MIPS64r6  kernels "Maciej W. Rozycki" <macro@linux-mips.org> - 2017-04-15 01:50 +0200
      Re: [PATCH 4.4 27/32] MIPS: Force o32 fp64 support on 32bit MIPS64r6  kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 15:20 +0200
  [PATCH 4.4 26/32] s390/uaccess: get_user() should zero on failure (again) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 31/32] MIPS: Flush wrong invalid FTLB entry for huge page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 14/32] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 17/32] metag/usercopy: Add early abort to copy_to_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 22/32] powerpc/mm: Add missing global TLB invalidate if cxl is active Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 04/32] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 25/32] s390/decompressor: fix initrd corruption caused by bss clear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 15/32] metag/usercopy: Drop unused macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 24/32] nios2: reserve boot memory for device tree Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 21/32] metag/usercopy: Add missing fixups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 11/32] iio: bmg160: reset chip when probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 19/32] metag/usercopy: Set flags before ADDZ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 13/32] ptrace: fix PTRACE_LISTEN race corrupting task->state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 18/32] metag/usercopy: Zero rest of buffer from copy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 10/32] arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 12/32] Reset TreeId to zero on SMB2 TREE_CONNECT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 02/32] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 07/32] sysfs: be careful of error returns from ops->show() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  Re: [PATCH 4.4 00/32] 4.4.61-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-10 22:40 +0200

csiph-web