linux-next

mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-24 21:24:00 +08:00

Mainline Linux tree for various devices, only for fun :)

Go to file

Vegard Nossum 4d6501dce0 kthread: Fix use-after-free if kthread fork fails If a kthread forks (e.g. usermodehelper since commit `1da5c46fa9`) but fails in copy_process() between calling dup_task_struct() and setting p->set_child_tid, then the value of p->set_child_tid will be inherited from the parent and get prematurely freed by free_kthread_struct(). kthread() - worker_thread() - process_one_work() \| - call_usermodehelper_exec_work() \| - kernel_thread() \| - _do_fork() \| - copy_process() \| - dup_task_struct() \| - arch_dup_task_struct() \| - tsk->set_child_tid = current->set_child_tid // implied \| - ... \| - goto bad_fork_* \| - ... \| - free_task(tsk) \| - free_kthread_struct(tsk) \| - kfree(tsk->set_child_tid) - ... - schedule() - __schedule() - wq_worker_sleeping() - kthread_data(task)->flags // UAF The problem started showing up with commit `1da5c46fa9` since it reused ->set_child_tid for the kthread worker data. A better long-term solution might be to get rid of the ->set_child_tid abuse. The comment in set_kthread_struct() also looks slightly wrong. Debugged-by: Jamie Iles <jamie.iles@oracle.com> Fixes: `1da5c46fa9` ("kthread: Make struct kthread kmalloc'ed") Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Acked-by: Oleg Nesterov <oleg@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Jamie Iles <jamie.iles@oracle.com> Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20170509073959.17858-1-vegard.nossum@oracle.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>		2017-05-22 22:21:16 +02:00
arch	Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 23:54:56 -07:00
block	Merge branch 'work.uaccess' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-05-01 14:41:04 -07:00
certs	certs: Add a secondary system keyring that can be added to dynamically	2016-04-11 22:48:09 +01:00
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2017-04-18 09:03:50 -07:00
Documentation	Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 23:54:56 -07:00
drivers	Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 23:54:56 -07:00
firmware	WHENCE: use https://linuxtv.org for LinuxTV URLs	2015-12-04 10:35:11 -02:00
fs	Merge branch 'x86-process-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 19:57:58 -07:00
include	Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 23:54:56 -07:00
init	mm: move mm_percpu_wq initialization earlier	2017-03-31 17:13:30 -07:00
ipc	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
kernel	kthread: Fix use-after-free if kthread fork fails	2017-05-22 22:21:16 +02:00
lib	Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 22:07:51 -07:00
mm	Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 23:54:56 -07:00
net	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 19:12:53 -07:00
samples	statx: Include a mask for stx_attributes in struct statx	2017-04-03 01:06:00 -04:00
scripts	Merge branch 'x86-process-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 19:57:58 -07:00
security	Merge branch 'work.uaccess' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-05-01 14:41:04 -07:00
sound	LED updates for 4.12	2017-05-01 13:12:49 -07:00
tools	Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 23:54:56 -07:00
usr	kbuild: initramfs cleanup, set target from Kconfig	2017-01-05 09:40:16 -08:00
virt	KVM/ARM Fixes for v4.11-rc6	2017-04-05 16:27:47 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Add hch to .get_maintainer.ignore	2015-08-21 14:30:10 -07:00
.gitattributes	.gitattributes: set git diff driver for C source code files	2016-10-07 18:46:30 -07:00
.gitignore	Merge branch 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild	2016-08-02 16:48:52 -04:00
.mailmap	mailmap: add Martin Kepplinger's email	2017-04-13 18:24:21 -07:00
COPYING
CREDITS	avr32: remove support for AVR32 architecture	2017-05-01 09:27:15 +02:00
Kbuild	scripts/gdb: provide linux constants	2016-05-23 17:04:14 -07:00
Kconfig
MAINTAINERS	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-05-01 19:36:00 -07:00
Makefile	Linux 4.11	2017-04-30 19:47:48 -07:00
README	README: add a new README file, pointing to the Documentation/	2016-10-24 08:12:35 -02:00

README

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.