Eric Lee / smarc-fsl-linux-kernel

16 May, 2018

1 commit

  • ef7c4825f   compat: fix 4-byte infoleak via uninitialized struct field ... Browse Code »

    commit 0a0b98734479aa5b3c671d5190e86273372cab95 upstream.

    Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to
    native counterparts") removed the memset() in compat_get_timex(). Since
    then, the compat adjtimex syscall can invoke do_adjtimex() with an
    uninitialized ->tai.

    If do_adjtimex() doesn't write to ->tai (e.g. because the arguments are
    invalid), compat_put_timex() then copies the uninitialized ->tai field
    to userspace.

    Fix it by adding the memset() back.

    Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts")
    Signed-off-by: Jann Horn
    Acked-by: Kees Cook
    Acked-by: Al Viro
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Jann Horn
     

16 Jul, 2017

1 commit

07 Jul, 2017

1 commit

  • c85686398   Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull misc compat stuff updates from Al Viro:
    "This part is basically untangling various compat stuff. Compat
    syscalls moved to their native counterparts, getting rid of quite a
    bit of double-copying and/or set_fs() uses. A lot of field-by-field
    copyin/copyout killed off.

    - kernel/compat.c is much closer to containing just the
    copyin/copyout of compat structs. Not all compat syscalls are gone
    from it yet, but it's getting there.

    - ipc/compat_mq.c killed off completely.

    - block/compat_ioctl.c cleaned up; floppy compat ioctls moved to
    drivers/block/floppy.c where they belong. Yes, there are several
    drivers that implement some of the same ioctls. Some are m68k and
    one is 32bit-only pmac. drivers/block/floppy.c is the only one in
    that bunch that can be built on biarch"

    * 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    mqueue: move compat syscalls to native ones
    usbdevfs: get rid of field-by-field copyin
    compat_hdio_ioctl: get rid of set_fs()
    take floppy compat ioctls to sodding floppy.c
    ipmi: get rid of field-by-field __get_user()
    ipmi: get COMPAT_IPMICTL_RECEIVE_MSG in sync with the native one
    rt_sigtimedwait(): move compat to native
    select: switch compat_{get,put}_fd_set() to compat_{get,put}_bitmap()
    put_compat_rusage(): switch to copy_to_user()
    sigpending(): move compat to native
    getrlimit()/setrlimit(): move compat to native
    times(2): move compat to native
    compat_{get,put}_bitmap(): use unsafe_{get,put}_user()
    fb_get_fscreeninfo(): don't bother with do_fb_ioctl()
    do_sigaltstack(): lift copying to/from userland into callers
    take compat_sys_old_getrlimit() to native syscall
    trim __ARCH_WANT_SYS_OLD_GETRLIMIT

    Linus Torvalds
     

06 Jul, 2017

2 commits

  • ea3b25e13   Merge branch 'timers-compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull timer-related user access updates from Al Viro:
    "Continuation of timers-related stuff (there had been more, but my
    parts of that series are already merged via timers/core). This is more
    of y2038 work by Deepa Dinamani, partially disrupted by the
    unification of native and compat timers-related syscalls"

    * 'timers-compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    posix_clocks: Use get_itimerspec64() and put_itimerspec64()
    timerfd: Use get_itimerspec64() and put_itimerspec64()
    nanosleep: Use get_timespec64() and put_timespec64()
    posix-timers: Use get_timespec64() and put_timespec64()
    posix-stubs: Conditionally include COMPAT_SYS_NI defines
    time: introduce {get,put}_itimerspec64
    time: add get_timespec64 and put_timespec64

    Linus Torvalds
     
  • 4be95131b   Merge branch 'work.sys_wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull wait syscall updates from Al Viro:
    "Consolidating sys_wait* and compat counterparts.

    Gets rid of set_fs()/double-copy mess, simplifies the whole thing
    (lifting the copyouts to the syscalls means less headache in the part
    that does actual work - fewer failure exits, to start with), gets rid
    of the overhead of field-by-field __put_user()"

    * 'work.sys_wait' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    osf_wait4: switch to kernel_wait4()
    waitid(): switch copyout of siginfo to unsafe_put_user()
    wait_task_zombie: consolidate info logics
    kill wait_noreap_copyout()
    lift getrusage() from wait_noreap_copyout()
    waitid(2): leave copyout of siginfo to syscall itself
    kernel_wait4()/kernel_waitid(): delay copying status to userland
    wait4(2)/waitid(2): separate copying rusage to userland
    move compat wait4 and waitid next to native variants

    Linus Torvalds
     

26 Jun, 2017

2 commits

  • d5b7ffbfb   time: introduce {get,put}_itimerspec64 ... Browse Code »

    As we change the user space type for the timerfd and posix timer
    functions to newer data types, we need some form of conversion
    helpers to avoid duplicating that logic.

    Suggested-by: Arnd Bergmann
    Signed-off-by: Deepa Dinamani
    Signed-off-by: Al Viro

    Deepa Dinamani
     
  • f59dd9c88   time: add get_timespec64 and put_timespec64 ... Browse Code »

    Add helper functions to convert between struct timespec64 and
    struct timespec at userspace boundaries.

    This is a preparatory patch to use timespec64 as the basic type
    internally in the kernel as timespec is not y2038 safe on 32 bit systems.
    The patch helps the cause by containing all data conversions at the
    userspace boundaries within these functions.

    Suggested-by: Arnd Bergmann
    Signed-off-by: Deepa Dinamani
    Signed-off-by: Al Viro

    Deepa Dinamani
     

14 Jun, 2017

10 commits

10 Jun, 2017

6 commits

28 May, 2017

1 commit

22 May, 2017

1 commit

15 Apr, 2017

2 commits

  • ad1963846   time: Change k_clock nsleep() to use timespec64 ... Browse Code »

    struct timespec is not y2038 safe on 32 bit machines. Replace uses of
    struct timespec with struct timespec64 in the kernel.

    The syscall interfaces themselves will be changed in a separate series.

    Note that the restart_block parameter for nanosleep has also been left
    unchanged and will be part of syscall series noted above.

    Signed-off-by: Deepa Dinamani
    Cc: y2038@lists.linaro.org
    Cc: john.stultz@linaro.org
    Cc: arnd@arndb.de
    Link: http://lkml.kernel.org/r/1490555058-4603-8-git-send-email-deepa.kernel@gmail.com
    Signed-off-by: Thomas Gleixner

    Deepa Dinamani
     
  • 2ac00f17b   time: Delete do_sys_setimeofday() ... Browse Code »

    struct timespec is not y2038 safe on 32 bit machines and needs to be
    replaced with struct timespec64.

    do_sys_timeofday() is just a wrapper function. Replace all calls to this
    function with direct calls to do_sys_timeofday64() instead and delete
    do_sys_timeofday().

    Signed-off-by: Deepa Dinamani
    Cc: y2038@lists.linaro.org
    Cc: john.stultz@linaro.org
    Cc: arnd@arndb.de
    Cc: linux-alpha@vger.kernel.org
    Link: http://lkml.kernel.org/r/1490555058-4603-2-git-send-email-deepa.kernel@gmail.com
    Signed-off-by: Thomas Gleixner

    Deepa Dinamani
     

25 Dec, 2016

1 commit

16 Nov, 2016

1 commit

  • baa73d9e4   posix-timers: Make them configurable ... Browse Code »

    Some embedded systems have no use for them. This removes about
    25KB from the kernel binary size when configured out.

    Corresponding syscalls are routed to a stub logging the attempt to
    use those syscalls which should be enough of a clue if they were
    disabled without proper consideration. They are: timer_create,
    timer_gettime: timer_getoverrun, timer_settime, timer_delete,
    clock_adjtime, setitimer, getitimer, alarm.

    The clock_settime, clock_gettime, clock_getres and clock_nanosleep
    syscalls are replaced by simple wrappers compatible with CLOCK_REALTIME,
    CLOCK_MONOTONIC and CLOCK_BOOTTIME only which should cover the vast
    majority of use cases with very little code.

    Signed-off-by: Nicolas Pitre
    Acked-by: Richard Cochran
    Acked-by: Thomas Gleixner
    Acked-by: John Stultz
    Reviewed-by: Josh Triplett
    Cc: Paul Bolle
    Cc: linux-kbuild@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Cc: Michal Marek
    Cc: Edward Cree
    Link: http://lkml.kernel.org/r/1478841010-28605-7-git-send-email-nicolas.pitre@linaro.org
    Signed-off-by: Thomas Gleixner

    Nicolas Pitre
     

05 Jun, 2015

1 commit

  • 9b7b819ca   compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap() ... Browse Code »

    In the functions compat_get_bitmap() and compat_put_bitmap() the
    variable nr_compat_longs stores how many compat_ulong_t words should be
    copied in a loop.

    The copy loop itself is this:
    if (nr_compat_longs-- > 0) {
    if (__get_user(um, umask)) return -EFAULT;
    } else {
    um = 0;
    }

    Since nr_compat_longs gets unconditionally decremented in each loop and
    since it's type is unsigned this could theoretically lead to out of
    bounds accesses to userspace if nr_compat_longs wraps around to
    (unsigned)(-1).

    Although the callers currently do not trigger out-of-bounds accesses, we
    should better implement the loop in a safe way to completely avoid such
    warp-arounds.

    Signed-off-by: Helge Deller
    Cc: Linus Torvalds
    Cc: Al Viro

    Helge Deller
     

13 Feb, 2015

1 commit

  • f56141e3e   all arches, signal: move restart_block to struct task_struct ... Browse Code »

    If an attacker can cause a controlled kernel stack overflow, overwriting
    the restart block is a very juicy exploit target. This is because the
    restart_block is held in the same memory allocation as the kernel stack.

    Moving the restart block to struct task_struct prevents this exploit by
    making the restart_block harder to locate.

    Note that there are other fields in thread_info that are also easy
    targets, at least on some architectures.

    It's also a decent simplification, since the restart code is more or less
    identical on all architectures.

    [james.hogan@imgtec.com: metag: align thread_info::supervisor_stack]
    Signed-off-by: Andy Lutomirski
    Cc: Thomas Gleixner
    Cc: Al Viro
    Cc: "H. Peter Anvin"
    Cc: Ingo Molnar
    Cc: Kees Cook
    Cc: David Miller
    Acked-by: Richard Weinberger
    Cc: Richard Henderson
    Cc: Ivan Kokshaysky
    Cc: Matt Turner
    Cc: Vineet Gupta
    Cc: Russell King
    Cc: Catalin Marinas
    Cc: Will Deacon
    Cc: Haavard Skinnemoen
    Cc: Hans-Christian Egtvedt
    Cc: Steven Miao
    Cc: Mark Salter
    Cc: Aurelien Jacquiot
    Cc: Mikael Starvik
    Cc: Jesper Nilsson
    Cc: David Howells
    Cc: Richard Kuo
    Cc: "Luck, Tony"
    Cc: Geert Uytterhoeven
    Cc: Michal Simek
    Cc: Ralf Baechle
    Cc: Jonas Bonn
    Cc: "James E.J. Bottomley"
    Cc: Helge Deller
    Cc: Benjamin Herrenschmidt
    Cc: Paul Mackerras
    Acked-by: Michael Ellerman (powerpc)
    Tested-by: Michael Ellerman (powerpc)
    Cc: Martin Schwidefsky
    Cc: Heiko Carstens
    Cc: Chen Liqin
    Cc: Lennox Wu
    Cc: Chris Metcalf
    Cc: Guan Xuetao
    Cc: Chris Zankel
    Cc: Max Filippov
    Cc: Oleg Nesterov
    Cc: Guenter Roeck
    Signed-off-by: James Hogan
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andy Lutomirski
     

06 Sep, 2014

1 commit

05 Jun, 2014

1 commit

03 Apr, 2014

1 commit

  • 7125764c5   Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Browse Code »

    Pull compat time conversion changes from Peter Anvin:
    "Despite the branch name this is really neither an x86 nor an
    x32-specific patchset, although it the implementation of the
    discussions that followed the x32 security hole a few months ago.

    This removes get/put_compat_timespec/val() and replaces them with
    compat_get/put_timespec/val() which are savvy as to the current status
    of COMPAT_USE_64BIT_TIME.

    It removes several unused and/or incorrect/misleading functions (like
    compat_put_timeval_convert which doesn't in fact do any conversion)
    and also replaces several open-coded implementations what is now
    called compat_convert_timespec() with that function"

    * 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    compat: Fix sparse address space warnings
    compat: Get rid of (get|put)_compat_time(val|spec)

    Linus Torvalds
     

06 Mar, 2014

2 commits

03 Feb, 2014

2 commits

  • dce44e03b   compat: Fix sparse address space warnings ... Browse Code »

    In compat_sys_old_getrlimit() we pass a kernel pointer to
    sys_old_getrlimit() inside a set_fs() bracket. This is okay, so we
    can safely cast the affected pointer to __user.

    In compat_clock_nanosleep_restart(), the variable "rmtp" holds a user
    pointer. Annotate it as such.

    Both of these warnings are ancient, but were reported by Fengguang
    Wu's test system due to other changes.

    Signed-off-by: H. Peter Anvin
    Cc: Toyo Abe
    Link: http://lkml.kernel.org/n/tip-507h7cq5e45eg6ygtykon3bf@git.kernel.org

    H. Peter Anvin
     
  • 81993e81a   compat: Get rid of (get|put)_compat_time(val|spec) ... Browse Code »

    We have two APIs for compatiblity timespec/val, with confusingly
    similar names. compat_(get|put)_time(val|spec) *do* handle the case
    where COMPAT_USE_64BIT_TIME is set, whereas
    (get|put)_compat_time(val|spec) do not. This is an accident waiting
    to happen.

    Clean it up by favoring the full-service version; the limited version
    is replaced with double-underscore versions static to kernel/compat.c.

    A common pattern is to convert a struct timespec to kernel format in
    an allocation on the user stack. Unfortunately it is open-coded in
    several places. Since this allocation isn't actually needed if
    COMPAT_USE_64BIT_TIME is true (since user format == kernel format)
    encapsulate that whole pattern into the function
    compat_convert_timespec(). An equivalent function should be written
    for struct timeval if it is needed in the future.

    Finally, get rid of compat_(get|put)_timeval_convert(): each was only
    used once, and the latter was not even doing what the function said
    (no conversion actually was being done.) Moving the conversion into
    compat_sys_settimeofday() itself makes the code much more similar to
    sys_settimeofday() itself.

    v3: Remove unused compat_convert_timeval().

    v2: Drop bogus "const" in the destination argument for
    compat_convert_time*().

    Cc: Mauro Carvalho Chehab
    Cc: Alexander Viro
    Cc: Hans Verkuil
    Cc: Andrew Morton
    Cc: Heiko Carstens
    Cc: Manfred Spraul
    Cc: Mateusz Guzik
    Cc: Rafael Aquini
    Cc: Davidlohr Bueso
    Cc: Stephen Rothwell
    Cc: Dan Carpenter
    Cc: Arnd Bergmann
    Cc: Thomas Gleixner
    Cc: Ingo Molnar
    Cc: Linus Torvalds
    Cc: Catalin Marinas
    Cc: Will Deacon
    Tested-by: H.J. Lu
    Signed-off-by: H. Peter Anvin

    H. Peter Anvin
     

01 May, 2013

2 commits

  • 08d767608   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal ... Browse Code »

    Pull compat cleanup from Al Viro:
    "Mostly about syscall wrappers this time; there will be another pile
    with patches in the same general area from various people, but I'd
    rather push those after both that and vfs.git pile are in."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal:
    syscalls.h: slightly reduce the jungles of macros
    get rid of union semop in sys_semctl(2) arguments
    make do_mremap() static
    sparc: no need to sign-extend in sync_file_range() wrapper
    ppc compat wrappers for add_key(2) and request_key(2) are pointless
    x86: trim sys_ia32.h
    x86: sys32_kill and sys32_mprotect are pointless
    get rid of compat_sys_semctl() and friends in case of ARCH_WANT_OLD_COMPAT_IPC
    merge compat sys_ipc instances
    consolidate compat lookup_dcookie()
    convert vmsplice to COMPAT_SYSCALL_DEFINE
    switch getrusage() to COMPAT_SYSCALL_DEFINE
    switch epoll_pwait to COMPAT_SYSCALL_DEFINE
    convert sendfile{,64} to COMPAT_SYSCALL_DEFINE
    switch signalfd{,4}() to COMPAT_SYSCALL_DEFINE
    make SYSCALL_DEFINE-generated wrappers do asmlinkage_protect
    make HAVE_SYSCALL_WRAPPERS unconditional
    consolidate cond_syscall and SYSCALL_ALIAS declarations
    teach SYSCALL_DEFINE how to deal with long long/unsigned long long
    get rid of duplicate logics in __SC_....[1-6] definitions

    Linus Torvalds
     
  • 1a0df5944   kernel/compat.c: make do_sysinfo() static ... Browse Code »

    The only use outside of kernel/timer.c was in kernel/compat.c, so move
    compat_sys_sysinfo() next to sys_sysinfo() in kernel/timer.c.

    Signed-off-by: Stephen Rothwell
    Cc: Thomas Gleixner
    Cc: Guenter Roeck
    Cc: Al Viro
    Acked-by: Arnd Bergmann
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Stephen Rothwell