20 Jul, 2007

3 commits

  • This patch enables core dump filtering for ELF-FDPIC-formatted core file.

    Signed-off-by: Hidehiro Kawai
    Cc: Alan Cox
    Cc: David Howells
    Cc: Hugh Dickins
    Cc: Nick Piggin
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kawai, Hidehiro
     
  • This patch removes an unused argument from elf_fdpic_dump_segments().

    Signed-off-by: Hidehiro Kawai
    Cc: Alan Cox
    Cc: David Howells
    Cc: Hugh Dickins
    Cc: Nick Piggin
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kawai, Hidehiro
     
  • Remove the arg+env limit of MAX_ARG_PAGES by copying the strings directly from
    the old mm into the new mm.

    We create the new mm before the binfmt code runs, and place the new stack at
    the very top of the address space. Once the binfmt code runs and figures out
    where the stack should be, we move it downwards.

    It is a bit peculiar in that we have one task with two mm's, one of which is
    inactive.

    [a.p.zijlstra@chello.nl: limit stack size]
    Signed-off-by: Ollie Wild
    Signed-off-by: Peter Zijlstra
    Cc:
    Cc: Hugh Dickins
    [bunk@stusta.de: unexport bprm_mm_init]
    Signed-off-by: Adrian Bunk
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ollie Wild
     

09 May, 2007

1 commit


03 Apr, 2007

1 commit

  • When the dump cannot occur most likely because of a full file system and
    the page to be written is the zero page, the call to page_cache_release()
    is missed.

    Signed-off-by: Brian Pomerantz
    Cc: Hugh Dickins
    Cc: Nick Piggin
    Cc: David Howells
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Brian Pomerantz
     

24 Mar, 2007

1 commit

  • Fix the /proc/pid/stat representation of executable boundaries. It should
    show the bounds of the executable, but instead shows the bounds of the
    loader.

    Before the patch is applied, the bug can be seen by examining, say, inetd:

    # ps | grep inetd
    610 root 0 S /usr/sbin/inetd -i
    # cat /proc/610/maps
    c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so
    c3180000-c31dede4 r-xs 00000000 00:0b 14582179 /lib/libuClibc-0.9.28.so
    c328c000-c328ea00 rw-p 00008000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so
    c3290000-c329b6c0 rw-p 00000000 00:00 0
    c32a0000-c32c0000 rwxp 00000000 00:00 0
    c32d4000-c32d8000 rw-p 00000000 00:00 0
    c3394000-c3398000 rw-p 00000000 00:00 0
    c3458000-c345f464 r-xs 00000000 00:0b 16384612 /usr/sbin/inetd
    c3470000-c34748f8 rw-p 00004000 00:0b 16384612 /usr/sbin/inetd
    c34cc000-c34d0000 rw-p 00000000 00:00 0
    c34d4000-c34d8000 rw-p 00000000 00:00 0
    c34d8000-c34dc000 rw-p 00000000 00:00 0
    # cat /proc/610/stat
    610 (inetd) S 1 610 610 0 -1 256 0 0 0 0 0 8 0 0 19 0 1 0 94392000718
    950272 0 4294967295 3233480704 3233523592 3274440352 3274439976
    3273467584 0 0 4096 90115 3221712796 0 0 17 0 0 0 0

    The code boundaries are 3233480704 to 3233523592, which are:

    (gdb) p/x 3233480704
    $1 = 0xc0bb0000
    (gdb) p/x 3233523592
    $2 = 0xc0bba788

    Which corresponds to this line in the maps file:

    c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so

    Which is wrong. After the patch is applied, the maps file is pretty much
    identical (there's some minor shuffling of the location of some of the
    anonymous VMAs), but the stat file is now:

    # cat /proc/610/stat
    610 (inetd) S 1 610 610 0 -1 256 0 0 0 0 0 7 0 0 18 0 1 0 94392000722
    950272 0 4294967295 3276111872 3276141668 3274440352 3274439976
    3273467584 0 0 4096 90115 3221712796 0 0 17 0 0 0 0

    The code boundaries are then 3276111872 to 3276141668, which are:

    (gdb) p/x 3276111872
    $1 = 0xc3458000
    (gdb) p/x 3276141668
    $2 = 0xc345f464

    And these correspond to this line in the maps file instead:

    c3458000-c345f464 r-xs 00000000 00:0b 16384612 /usr/sbin/inetd

    Which is now correct.

    Signed-off-by: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     

12 Feb, 2007

1 commit


27 Jan, 2007

1 commit

  • Proposed patch to fix #5 in
    http://www.isec.pl/vulnerabilities/isec-0017-binfmt_elf.txt
    aka
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1073

    To reproduce, do
    * grab poc at the end of advisory.
    * add line "eph.p_memsz = 4096;" after "eph.p_filesz = 4096;"
    where first "4096" is something equal to or greater than 4096.
    * ./poc /usr/bin/sudo && ls -l

    Here I get with 2.6.20-rc5:

    -rw------- 1 ad ad 102400 2007-01-15 19:17 core
    ---s--x--x 2 root root 101820 2007-01-15 19:15 /usr/bin/sudo

    Check for MAY_READ like binfmt_misc.c does.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

13 Dec, 2006

1 commit


09 Dec, 2006

2 commits

  • Replace occurences of task->signal->session by a new process_session() helper
    routine.

    It will be useful for pid namespaces to abstract the session pid number.

    Signed-off-by: Cedric Le Goater
    Cc: Kirill Korotaev
    Cc: Eric W. Biederman
    Cc: Herbert Poetzl
    Cc: Sukadev Bhattiprolu
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Cedric Le Goater
     
  • This patch changes struct file to use struct path instead of having
    independent pointers to struct dentry and struct vfsmount, and converts all
    users of f_{dentry,vfsmnt} in fs/ to use f_path.{dentry,mnt}.

    Additionally, it adds two #define's to make the transition easier for users of
    the f_dentry and f_vfsmnt.

    Signed-off-by: Josef "Jeff" Sipek
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Josef "Jeff" Sipek
     

08 Dec, 2006

1 commit

  • Define elf_addr_t in linux/elf.h. The size of the type is determined using
    ELF_CLASS. This allows us to remove the defines that today are spread all
    over .c and .h files.

    Signed-off-by: Magnus Damm
    Cc: Daniel Jacobowitz
    Cc: Roland McGrath
    Cc: Jakub Jelinek
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Magnus Damm
     

30 Sep, 2006

1 commit

  • do_each_thread() is rcu-safe, and all tasks which use this ->mm must sleep
    in wait_for_completion(&mm->core_done) at this point, so we can use RCU
    locks.

    Also, remove unneeded INIT_LIST_HEAD(new) before list_add(new, head).

    Signed-off-by: Oleg Nesterov
    Acked-By: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Oleg Nesterov
     

11 Jul, 2006

3 commits

  • Add coredump capability for the ELF-FDPIC binfmt.

    Signed-off-by: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • Adjust the ELF-FDPIC binfmt driver to conform much more to the CodingStyle,
    silly though it may be.

    Further changes:

    (*) Drop the casts to long for addresses in kdebug() statements (they're
    unsigned long already).

    (*) Use extra variables to avoid expressions longer than 80 chars by splitting
    the statement into multiple statements and letting the compiler optimise
    them back together.

    (*) Eliminate duplicate call of ksize() when working out how much space was
    actually allocated for the stack.

    (*) Discard the commented-out load_shlib prototype and op pointer as this will
    not be supported in ELF-FDPIC for the foreseeable future.

    Signed-off-by: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     
  • Fix FDPIC compile errors.

    (akpm: we suspect it fixes a warning)

    Signed-off-by: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    David Howells
     

23 Jun, 2006

1 commit


25 Mar, 2006

1 commit


11 Jan, 2006

1 commit


07 Nov, 2005

1 commit

  • This is the fs/ part of the big kfree cleanup patch.

    Remove pointless checks for NULL prior to calling kfree() in fs/.

    Signed-off-by: Jesper Juhl
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jesper Juhl
     

30 Oct, 2005

1 commit

  • How is anon_rss initialized? In dup_mmap, and by mm_alloc's memset; but
    that's not so good if an mm_counter_t is a special type. And how is rss
    initialized? By set_mm_counter, all over the place. Come on, we just need to
    initialize them both at once by set_mm_counter in mm_init (which follows the
    memcpy when forking).

    Signed-off-by: Hugh Dickins
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Hugh Dickins
     

17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds