Commit-ID: 120e4e76857ddbc9268e1aa3f9de61a498e84618
Gitweb: https://git.kernel.org/tip/120e4e76857ddbc9268e1aa3f9de61a498e84618
Author: Kangjie Lu <kjlu(a)umn.edu>
AuthorDate: Wed, 9 Jan 2019 01:45:24 -0600
Committer: Ingo Molnar <mingo(a)kernel.org>
CommitDate: Mon, 21 Jan 2019 11:26:17 +0100
sched/core: Fix a potential double-fetch bug in sched_copy_attr()
"uattr->size" is copied in from user space and checked. However, it is
copied in again after the security check. A malicious user may race to
change it. The fix sets uattr->size to be the checked size.
Signed-off-by: Kangjie Lu <kjlu(a)umn.edu>
Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org>
Cc: Linus Torvalds <torvalds(a)linux-foundation.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Thomas Gleixner <tglx(a)linutronix.de>
Cc: pakki001(a)umn.edu
Cc: <stable(a)vger.kernel.org>
Link: https://lkml.kernel.org/r/20190109074524.10176-1-kjlu@umn.edu
Signed-off-by: Ingo Molnar <mingo(a)kernel.org>
---
kernel/sched/core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index a674c7db2f29..d4d3514c4fe9 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4499,6 +4499,9 @@ static int sched_copy_attr(struct sched_attr __user *uattr, struct sched_attr *a
if (ret)
return -EFAULT;
+ /* In case attr->size was changed by user-space: */
+ attr->size = size;
+
/*
* XXX: Do we want to be lenient like existing syscalls; or do we want
* to be strict and return an error on out-of-bounds values?
Building xtensa:defconfig ... failed
--------------
Error log:
arch/xtensa/kernel/process.c: In function 'get_wchan':
arch/xtensa/kernel/process.c:314:24: error: implicit declaration of function 'SPILL_SLOT'; did you mean 'PCI_SLOT'?
Guenter
Hello,
We ran automated tests on a patchset that was proposed for merging into this
kernel tree. The patches were applied to:
Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Commit: 1c163f4c7b3f Stable queue: queue-5.0
The results of these automated tests are provided below.
Overall result: PASSED
Merge: OK
Compile: OK
Tests: OK
We hope that these logs can help you find the problem quickly. For the full
detail on our testing procedures, please scroll to the bottom of this message.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Merge testing
-------------
We cloned this repository and checked out a ref:
Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Ref: 1c163f4c7b3f Stable queue: queue-5.0
We then merged the patchset with `git am`:
cpufreq-use-struct-kobj_attribute-instead-of-struct-global_attr.patch
staging-erofs-fix-mis-acted-tail-merging-behavior.patch
binder-create-node-flag-to-request-sender-s-security-context.patch
usb-serial-option-add-telit-me910-ecm-composition.patch
usb-serial-cp210x-add-id-for-ingenico-3070.patch
usb-serial-ftdi_sio-add-id-for-hjelmslund-electronics-usb485.patch
driver-core-postpone-dma-tear-down-until-after-devres-release.patch
staging-erofs-fix-fast-symlink-w-o-xattr-when-fs-xattr-is-on.patch
staging-erofs-fix-memleak-of-inode-s-shared-xattr-array.patch
staging-erofs-fix-race-of-initializing-xattrs-of-a-inode-at-the-same-time.patch
staging-erofs-fix-illegal-address-access-under-memory-pressure.patch
staging-comedi-ni_660x-fix-missing-break-in-switch-statement.patch
staging-wilc1000-fix-to-set-correct-value-for-vif_num.patch
staging-android-ion-fix-sys-heap-pool-s-gfp_flags.patch
staging-android-ashmem-don-t-call-fallocate-with-ashmem_mutex-held.patch
staging-android-ashmem-avoid-range_alloc-allocation-with-ashmem_mutex-held.patch
ip6mr-do-not-call-__ip6_inc_stats-from-preemptible-context.patch
net-dsa-mv88e6xxx-add-call-to-mv88e6xxx_ports_cmode_init-to-probe-for-new-dsa-framework.patch
net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracefully-in-mv88e6xxx_port_set_duplex.patch
net-dsa-mv8e6xxx-fix-number-of-internal-phys-for-88e6x90-family.patch
net-mscc-enable-all-ports-in-qsgmii.patch
net-sched-put-back-q.qlen-into-a-single-location.patch
net-sysfs-fix-mem-leak-in-netdev_register_kobject.patch
qmi_wwan-add-support-for-quectel-eg12-em12.patch
sctp-call-iov_iter_revert-after-sending-abort.patch
sky2-disable-msi-on-dell-inspiron-1545-and-gateway-p-79.patch
team-free-bpf-filter-when-unregistering-netdev.patch
tipc-fix-rdm-dgram-connect-regression.patch
x86-cpu-amd-set-the-cpb-bit-unconditionally-on-f17h.patch
x86-boot-compressed-64-do-not-read-legacy-rom-on-efi-system.patch
tracing-fix-event-filters-and-triggers-to-handle-negative-numbers.patch
xhci-tegra-prevent-error-pointer-dereference.patch
usb-xhci-fix-for-enabling-usb-role-switch-quirk-on-intel_sunrisepoint_lp_xhci.patch
applicom-fix-potential-spectre-v1-vulnerabilities.patch
alpha-wire-up-io_pgetevents-system-call.patch
mips-irq-allocate-accurate-order-pages-for-irq-stack.patch
aio-fix-locking-in-aio_poll.patch
xtensa-fix-get_wchan.patch
gnss-sirf-fix-premature-wakeup-interrupt-enable.patch
usb-serial-cp210x-fix-gpio-in-autosuspend.patch
revert-selftests-firmware-add-config_fw_loader_user_helper_fallback-to-config.patch
revert-selftests-firmware-remove-use-of-non-standard-diff-z-option.patch
selftests-firmware-fix-verify_reqs-return-value.patch
bluetooth-btrtl-restore-old-logic-to-assume-firmware-is-already-loaded.patch
bluetooth-fix-locking-in-bt_accept_enqueue-for-bh-context.patch
exec-fix-mem-leak-in-kernel_read_file.patch
Compile testing
---------------
We compiled the kernel for 3 architectures:
arm64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/aarch64/68de19361219566c69ad1d7311…
powerpc:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/ppc64le/dc0fc83b28529b4db75189f2c2…
x86_64:
make options: make INSTALL_MOD_STRIP=1 -j64 targz-pkg -j64
configuration: https://artifacts.cki-project.org/builds/x86_64/1e00a7746979b52fa64837521ae…
Hardware testing
----------------
We booted each kernel and ran the following tests:
arm64: https://beaker.engineering.redhat.com/jobs/3402991
Boot test [0]
LTP lite - release 20190115 [1]
Loopdev Sanity [2]
xfstests: xfs [3]
AMTU (Abstract Machine Test Utility) [4]
Ethernet drivers sanity [5]
httpd: mod_ssl smoke sanity [6] ⚠
httpd: php sanity [7] ⚠
tuned: tune-processes-through-perf [8] ⚠
Usex - version 1.9-29 [9]
powerpc: https://beaker.engineering.redhat.com/jobs/3402710
Boot test [0]
LTP lite - release 20190115 [1]
Loopdev Sanity [2]
xfstests: xfs [3]
AMTU (Abstract Machine Test Utility) [4]
Ethernet drivers sanity [5]
httpd: mod_ssl smoke sanity [6] ⚠
httpd: php sanity [7] ⚠
tuned: tune-processes-through-perf [8] ⚠
Usex - version 1.9-29 [9]
x86_64: https://beaker.engineering.redhat.com/jobs/3402711
Boot test [0]
LTP lite - release 20190115 [1]
Loopdev Sanity [2]
xfstests: xfs [3]
AMTU (Abstract Machine Test Utility) [4]
Ethernet drivers sanity [5]
httpd: mod_ssl smoke sanity [6] ⚠
httpd: php sanity [7] ⚠
tuned: tune-processes-through-perf [8] ⚠
Usex - version 1.9-29 [9]
Test source:
[0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution…
[2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/…
[3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/filesystems…
[4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu
[5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/networking/…
[6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt…
[8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun…
[9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us…
Experimental tests (marked with ⚠ )
-----------------------------------
This test run included experimental tests. These tests are
still under development and they may not pass or fail correctly under certain
conditions.