Kees Cook 80fee3d540 kernel/sys.c: fix stack memory content leak via UNAME26 ...

Calling uname() with the UNAME26 personality set allows a leak of kernel
stack contents.  This fixes it by defensively calculating the length of
copy_to_user() call, making the len argument unsigned, and initializing
the stack buffer to zero (now technically unneeded, but hey, overkill).

CVE-2012-0957

Change-Id: Ib0a6cb461986eae3eebc15156969762f670ffe9b
Reported-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Devendra Patel <cdevenp@codeaurora.org>

2013-03-06 10:07:28 -08:00

..

debug

debug: add parameters to prevent entering debug mode on errors

2012-05-18 17:03:10 -07:00

events

perf: Fix perf_event_for_each() to use sibling

2012-04-26 13:51:31 +02:00

gcov

…

irq

irqdomain: Port system to new API

2012-06-26 10:35:13 -07:00

power

Merge commit 'AU_LINUX_ANDROID_ICS.04.00.04.00.130' into msm-3.4

2012-06-07 11:14:52 -07:00

sched

sched: fix rq->lock recursion

2012-12-03 11:37:28 -08:00

time

tick-sched: recalculate sleep length each time it is requested

2012-07-17 16:50:23 -07:00

trace

coresight: have trace_printk only log the actual data to STM

2012-11-05 14:00:28 -08:00

.gitignore

…

acct.c

Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2012-01-08 12:19:57 -08:00

async.c

kernel/async: remove redundant declaration.

2012-01-13 09:32:18 +10:30

audit_tree.c

…

audit_watch.c

…

audit.c

constify path argument of audit_log_d_path()

2012-03-20 21:29:40 -04:00

audit.h

audit: remove AUDIT_SETUP_CONTEXT as it isn't used

2012-01-17 16:16:57 -05:00

auditfilter.c

audit: allow interfield comparison in audit rules

2012-01-17 16:17:01 -05:00

auditsc.c

kernel-doc: fix new warnings in auditsc.c

2012-01-23 08:44:53 -08:00

backtracetest.c

…

bounds.c

…

capability.c

Revert "capabitlies: ns_capable can use the cap helpers rather than lsm call"

2012-01-17 10:19:41 -08:00

cgroup_freezer.c

Merge branch 'Linux 3.0.21' into msm-3.0

2012-03-30 00:09:34 -07:00

cgroup.c

cgroup: Remove call to synchronize_rcu in cgroup_attach_task

2012-04-09 13:53:12 -07:00

compat.c

compat: Fix RT signal mask corruption via sigprocmask

2012-05-10 08:58:33 -07:00

configs.c

…

cpu_pm.c

ARM: cpu_pm: Add cpu power management notifiers

2011-11-29 16:42:33 -05:00

cpu.c

Move x86_64 idle notifiers to generic

2012-04-09 13:57:52 -07:00

cpuset.c

Merge tag 'for-linus' of git://github.com/rustyrussell/linux

2012-04-02 08:53:24 -07:00

crash_dump.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

cred.c

cred: copy_process() should clear child->replacement_session_keyring

2012-04-11 08:20:11 -07:00

delayacct.c

…

dma.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

elfcore.c

…

exec_domain.c

…

exit.c

android/lowmemorykiller: Ignore tasks with freed mm

2013-02-21 09:45:35 -08:00

extable.c

…

fork.c

android/lowmemorykiller: Ignore tasks with freed mm

2013-02-21 09:45:35 -08:00

freezer.c

PM / Freezer: Remove references to TIF_FREEZE in comments

2012-03-04 23:08:54 +01:00

futex_compat.c

futex: Mark get_robust_list as deprecated

2012-03-29 11:37:17 +02:00

futex.c

Merge branch 'Linux 3.0.21' into msm-3.0

2012-03-30 00:09:34 -07:00

groups.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

hrtimer.c

hrtimer: Fix extra wakeups from __remove_hrtimer()

2011-12-09 08:52:28 -08:00

hung_task.c

hung_task: fix the broken rcu_lock_break() logic

2012-03-05 15:49:42 -08:00

irq_work.c

irq_work: fix compile failure on tile from missing include

2012-04-13 13:15:16 -04:00

itimer.c

itimer: Use printk_once instead of WARN_ONCE

2012-04-10 11:00:30 +02:00

jump_label.c

static keys: Inline the static_key_enabled() function

2012-02-28 20:01:08 +01:00

kallsyms.c

vsprintf: Fix %ps on non symbols when using kallsyms

2012-04-23 14:29:54 -07:00

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage

2012-03-23 13:18:57 +01:00

Kconfig.preempt

locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage

2012-03-23 13:18:57 +01:00

kexec.c

Merge branch 'akpm' (Andrew's patch-bomb)

2012-03-28 17:19:28 -07:00

kfifo.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

kmod.c

PM / Sleep: Mitigate race between the freezer and request_firmware()

2012-03-28 23:30:28 +02:00

kprobes.c

Merge branch 'Linux 3.0.21' into msm-3.0

2012-03-30 00:09:34 -07:00

ksysfs.c

kernel: ksysfs.c is implicitly using stat.h

2011-10-31 09:20:13 -04:00

kthread.c

freezer: kill unused set_freezable_with_signal()

2011-11-23 09:28:17 -08:00

latencytop.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

lockdep_internals.h

…

lockdep_proc.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

lockdep_states.h

…

lockdep.c

lockdep: Add CPU-idle/offline warning to lockdep-RCU splat

2012-02-21 09:06:06 -08:00

Makefile

sysctl: Move the implementation into fs/proc/proc_sysctl.c

2012-01-24 16:37:54 -08:00

module.c

module: Remove module size limit

2012-03-26 12:50:53 +10:30

mutex-debug.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

mutex-debug.h

…

mutex.c

sched/rt: Use schedule_preempt_disabled()

2012-03-01 10:28:03 +01:00

mutex.h

…

notifier.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

nsproxy.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

padata.c

padata: Fix cpu hotplug

2012-03-29 19:52:46 +08:00

panic.c

coresight: abort coresight tracing on kernel panic

2013-01-15 16:16:09 -08:00

params.c

params: <level>_initcall-like kernel parameters

2012-03-26 12:50:51 +10:30

pid_namespace.c

pidns: add reboot_pid_ns() to handle the reboot syscall

2012-03-28 17:14:36 -07:00

pid.c

vfs: fix panic in __d_lookup() with high dentry hashtable counts

2012-02-13 20:45:38 -05:00

posix-cpu-timers.c

[S390] cputime: add sparse checking and cleanup

2011-12-15 14:56:19 +01:00

posix-timers.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

printk.c

printk: Defer CPU_ONLINE console flushing

2012-10-10 09:44:32 -07:00

profile.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

ptrace.c

ptrace: remove PTRACE_SEIZE_DEVEL bit

2012-03-23 16:58:41 -07:00

range.c

range: fix bogus misuse of module.h to get printk()

2011-10-31 09:20:11 -04:00

rcu.h

rcu: Allow nesting of rcu_idle_enter() and rcu_idle_exit()

2012-02-21 09:06:12 -08:00

rcupdate.c

rcu: Check for illegal use of RCU from offlined CPUs

2012-02-21 09:06:03 -08:00

rcutiny_plugin.h

rcu: Simplify unboosting checks

2012-02-21 09:03:43 -08:00

rcutiny.c

rcu: Add RCU_NONIDLE() for idle-loop RCU read-side critical sections

2012-02-21 09:06:13 -08:00

rcutorture.c

PTR_ERR should be called before its argument is cleared.

2012-02-21 09:06:10 -08:00

rcutree_plugin.h

rcu: Hold off RCU_FAST_NO_HZ after timer posted

2012-02-21 09:42:30 -08:00

rcutree_trace.c

rcu: Rework detection of use of RCU by offline CPUs

2012-02-21 09:06:07 -08:00

rcutree.c

rcu: Fix day-one dyntick-idle stall-warning bug

2012-10-04 15:58:40 -07:00

rcutree.h

rcu: Rework detection of use of RCU by offline CPUs

2012-02-21 09:06:07 -08:00

relay.c

relay: prevent integer overflow in relay_open()

2012-02-10 09:04:49 +01:00

res_counter.c

net: introduce res_counter_charge_nofail() for socket allocations

2012-01-22 15:08:46 -05:00

resource.c

Merge commit 'AU_LINUX_ANDROID_ICS.04.00.04.00.126' into msm-3.4

2012-06-06 18:45:28 -07:00

rtmutex_common.h

…

rtmutex-debug.c

lockdep, rtmutex, bug: Show taint flags on error

2011-12-06 08:16:49 +01:00

rtmutex-debug.h

…

rtmutex-tester.c

rtmutex-tester: convert sysdev_class to a regular subsystem

2011-12-14 14:54:22 -08:00

rtmutex.c

Revert "rcu: Permit rt_mutex_unlock() with irqs disabled"

2011-12-11 10:33:18 -08:00

rtmutex.h

…

rwsem.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

seccomp.c

seccomp: audit abnormal end to a process due to seccomp

2012-01-17 16:16:55 -05:00

semaphore.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

signal.c

Merge tag 'split-asm_system_h-for-linus-20120328' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-asm_system

2012-03-28 15:58:21 -07:00

smp.c

smp: add func to IPI cpus based on parameter func

2012-03-28 17:14:35 -07:00

softirq.c

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2012-03-20 10:32:09 -07:00

spinlock.c

locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage

2012-03-23 13:18:57 +01:00

srcu.c

rcu: Call out dangers of expedited RCU primitives

2012-02-21 09:06:08 -08:00

stacktrace.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

stop_machine.c

Merge commit 'AU_LINUX_ANDROID_ICS.04.00.04.00.126' into msm-3.4

2012-06-06 18:45:28 -07:00

sys_ni.c

Cross Memory Attach

2011-10-31 17:30:44 -07:00

sys.c

kernel/sys.c: fix stack memory content leak via UNAME26

2013-03-06 10:07:28 -08:00

sysctl_binary.c

net/ipv6/addrconf: IPv6 tethering enhancement

2013-01-11 14:18:39 -08:00

sysctl.c

sched: add sysctl for controlling task migrations on wake

2012-11-09 14:47:28 -08:00

taskstats.c

Make TASKSTATS require root access

2011-12-21 12:57:40 -08:00

test_kprobes.c

…

time.c

time: Remove bogus comments

2012-03-15 18:17:55 -07:00

timeconst.pl

…

timer.c

trace: Modify timer_start and irq_handler_entry trace events.

2012-07-26 18:49:05 -07:00

tracepoint.c

static keys: Introduce 'struct static_key', static_key_true()/false() and static_key_slow_[inc|dec]()

2012-02-24 10:05:59 +01:00

tsacct.c

[S390] cputime: add sparse checking and cleanup

2011-12-15 14:56:19 +01:00

uid16.c

…

up.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user_namespace.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user-return-notifier.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

utsname_sysctl.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

utsname.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

wait.c

lockdep/waitqueues: Add better annotation

2011-12-21 10:07:39 +01:00

watchdog.c

kernel/watchdog.c: add comment to watchdog() exit path

2012-03-23 16:58:32 -07:00

workqueue_sched.h

…

workqueue.c

Merge branch 'for-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

2012-03-20 18:13:22 -07:00