History

Merge tag 'seccomp-v5.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull seccomp fixes from Kees Cook: "This fixes a rare race condition in seccomp when using TSYNC and USER_NOTIF together where a memory allocation would not get freed (found by syzkaller, fixed by Tycho). Additionally updates Tycho's MAINTAINERS and .mailmap entries for his new address" * tag 'seccomp-v5.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: seccomp: don't leave dangling ->notif if file allocation fails mailmap, MAINTAINERS: move to tycho.pizza seccomp: don't leak memory when filter install races

Linus Torvalds committed 6 years ago

Commit ef2e9a52 parents 4f8b0a5 e8393173 files · +20 −7Browse files

Unified · Split

3 files
  1. .mailmap +1 −0
  2. MAINTAINERS +1 −1
  3. kernel/seccomp.c +18 −6
.mailmap+1−0
@@ -308,6 +308,7 @@ Tony Luck <tony.luck@intel.com> · 307 unmodified lines
308TripleX Chung <xxx.phy@gmail.com> <triplex@zh-kernel.org>308TripleX Chung <xxx.phy@gmail.com> <triplex@zh-kernel.org>
309TripleX Chung <xxx.phy@gmail.com> <zhongyu@18mail.cn>309TripleX Chung <xxx.phy@gmail.com> <zhongyu@18mail.cn>
310Tsuneo Yoshioka <Tsuneo.Yoshioka@f-secure.com>310Tsuneo Yoshioka <Tsuneo.Yoshioka@f-secure.com>
311Tycho Andersen <tycho@tycho.pizza> <tycho@tycho.ws>
311Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>312Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
312Uwe Kleine-König <ukl@pengutronix.de>313Uwe Kleine-König <ukl@pengutronix.de>
313Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>314Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
MAINTAINERS+1−1
@@ -9800,7 +9800,7 @@ F: drivers/scsi/53c700* · 9799 unmodified lines
9800 9800
9801LEAKING_ADDRESSES9801LEAKING_ADDRESSES
9802M: Tobin C. Harding <me@tobin.cc>9802M: Tobin C. Harding <me@tobin.cc>
9803M: Tycho Andersen <tycho@tycho.ws>9803M: Tycho Andersen <tycho@tycho.pizza>
9804L: kernel-hardening@lists.openwall.com9804L: kernel-hardening@lists.openwall.com
9805S: Maintained9805S: Maintained
9806T: git git://git.kernel.org/pub/scm/linux/kernel/git/tobin/leaks.git9806T: git git://git.kernel.org/pub/scm/linux/kernel/git/tobin/leaks.git
kernel/seccomp.c+18−6
@@ -1109,13 +1109,18 @@ out: · 1108 unmodified lines
1109}1109}
1110 1110
1111#ifdef CONFIG_SECCOMP_FILTER1111#ifdef CONFIG_SECCOMP_FILTER
1112static int seccomp_notify_release(struct inode *inode, struct file *file)1112static void seccomp_notify_free(struct seccomp_filter *filter)
1113{
1114 kfree(filter->notif);
1115 filter->notif = NULL;
1116}
1117
1118static void seccomp_notify_detach(struct seccomp_filter *filter)
1113{1119{
1114 struct seccomp_filter *filter = file->private_data;
1115 struct seccomp_knotif *knotif;1120 struct seccomp_knotif *knotif;
1116 1121
1117 if (!filter)1122 if (!filter)
1118 return 0;1123 return;
1119 1124
1120 mutex_lock(&filter->notify_lock);1125 mutex_lock(&filter->notify_lock);
1121 1126
@@ -1139,9 +1144,15 @@ static int seccomp_notify_release(struct inode *inode, struct file *file) · 17 unmodified lines
1139 complete(&knotif->ready);1144 complete(&knotif->ready);
1140 }1145 }
1141 1146
1142 kfree(filter->notif);1147 seccomp_notify_free(filter);
1143 filter->notif = NULL;
1144 mutex_unlock(&filter->notify_lock);1148 mutex_unlock(&filter->notify_lock);
1149}
1150
1151static int seccomp_notify_release(struct inode *inode, struct file *file)
1152{
1153 struct seccomp_filter *filter = file->private_data;
1154
1155 seccomp_notify_detach(filter);
1145 __put_seccomp_filter(filter);1156 __put_seccomp_filter(filter);
1146 return 0;1157 return 0;
1147}1158}
@@ -1488,7 +1499,7 @@ static struct file *init_listener(struct seccomp_filter *filter) · 340 unmodified lines
1488 1499
1489out_notif:1500out_notif:
1490 if (IS_ERR(ret))1501 if (IS_ERR(ret))
1491 kfree(filter->notif);1502 seccomp_notify_free(filter);
1492out:1503out:
1493 return ret;1504 return ret;
1494}1505}
@@ -1581,6 +1592,7 @@ out_put_fd: · 86 unmodified lines
1581 listener_f->private_data = NULL;1592 listener_f->private_data = NULL;
1582 fput(listener_f);1593 fput(listener_f);
1583 put_unused_fd(listener);1594 put_unused_fd(listener);
1595 seccomp_notify_detach(prepared);
1584 } else {1596 } else {
1585 fd_install(listener, listener_f);1597 fd_install(listener, listener_f);
1586 ret = listener;1598 ret = listener;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t