* [PATCH] lib/syscall: Clear return values when no stack
@ 2017-03-23 22:46 Kees Cook
2017-03-23 23:03 ` Andy Lutomirski
2017-03-24 6:45 ` [tip:core/urgent] " tip-bot for Kees Cook
0 siblings, 2 replies; 3+ messages in thread
From: Kees Cook @ 2017-03-23 22:46 UTC (permalink / raw)
To: Ingo Molnar; +Cc: Robert Święcki, Andy Lutomirski, linux-kernel
Commit aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
added logic to handle a process stack not existing, but left sp and pc
uninitialized, which can be later reported via /proc/$pid/syscall for zombie
processes, potentially exposing kernel memory to userspace.
Zombie /proc/$pid/syscall before:
-1 0xffffffff9a060100 0xffff92f42d6ad900
Zombie /proc/$pid/syscall after:
-1 0x0 0x0
Reported-by: Robert Święcki <robert@swiecki.net>
Fixes: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Kees Cook <keescook@chromium.org>
---
lib/syscall.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/syscall.c b/lib/syscall.c
index 17d5ff5fa6a3..2c6cd1b5c3ea 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -12,6 +12,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
if (!try_get_task_stack(target)) {
/* Task has no stack, so the task isn't in a syscall. */
+ *sp = *pc = 0;
*callno = -1;
return 0;
}
--
2.7.4
--
Kees Cook
Pixel Security
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] lib/syscall: Clear return values when no stack
2017-03-23 22:46 [PATCH] lib/syscall: Clear return values when no stack Kees Cook
@ 2017-03-23 23:03 ` Andy Lutomirski
2017-03-24 6:45 ` [tip:core/urgent] " tip-bot for Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: Andy Lutomirski @ 2017-03-23 23:03 UTC (permalink / raw)
To: Kees Cook
Cc: Ingo Molnar, Robert Święcki, Andy Lutomirski, linux-kernel
On Thu, Mar 23, 2017 at 3:46 PM, Kees Cook <keescook@chromium.org> wrote:
> Commit aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
> added logic to handle a process stack not existing, but left sp and pc
> uninitialized, which can be later reported via /proc/$pid/syscall for zombie
> processes, potentially exposing kernel memory to userspace.
>
> Zombie /proc/$pid/syscall before:
> -1 0xffffffff9a060100 0xffff92f42d6ad900
>
> Zombie /proc/$pid/syscall after:
> -1 0x0 0x0
>
> Reported-by: Robert Święcki <robert@swiecki.net>
> Fixes: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
> Cc: stable@vger.kernel.org # v4.9+
> Signed-off-by: Kees Cook <keescook@chromium.org>
Whoops!
Reviewed-by: Andy Lutomirski <luto@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread* [tip:core/urgent] lib/syscall: Clear return values when no stack
2017-03-23 22:46 [PATCH] lib/syscall: Clear return values when no stack Kees Cook
2017-03-23 23:03 ` Andy Lutomirski
@ 2017-03-24 6:45 ` tip-bot for Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: tip-bot for Kees Cook @ 2017-03-24 6:45 UTC (permalink / raw)
To: linux-tip-commits
Cc: hpa, peterz, keescook, jpoimboe, tglx, luto, mingo, bp, torvalds,
dvlasenk, linux-kernel, brgerst, robert
Commit-ID: 854fbd6e5f60fe99e8e3a569865409fca378f143
Gitweb: http://git.kernel.org/tip/854fbd6e5f60fe99e8e3a569865409fca378f143
Author: Kees Cook <keescook@chromium.org>
AuthorDate: Thu, 23 Mar 2017 15:46:16 -0700
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 24 Mar 2017 07:43:35 +0100
lib/syscall: Clear return values when no stack
Commit:
aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
... added logic to handle a process stack not existing, but left sp and pc
uninitialized, which can be later reported via /proc/$pid/syscall for zombie
processes, potentially exposing kernel memory to userspace.
Zombie /proc/$pid/syscall before:
-1 0xffffffff9a060100 0xffff92f42d6ad900
Zombie /proc/$pid/syscall after:
-1 0x0 0x0
Reported-by: Robert Święcki <robert@swiecki.net>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org # v4.9+
Fixes: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
Link: http://lkml.kernel.org/r/20170323224616.GA92694@beast
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
lib/syscall.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/syscall.c b/lib/syscall.c
index 17d5ff5..2c6cd1b 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -12,6 +12,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
if (!try_get_task_stack(target)) {
/* Task has no stack, so the task isn't in a syscall. */
+ *sp = *pc = 0;
*callno = -1;
return 0;
}
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-03-24 6:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-23 22:46 [PATCH] lib/syscall: Clear return values when no stack Kees Cook
2017-03-23 23:03 ` Andy Lutomirski
2017-03-24 6:45 ` [tip:core/urgent] " tip-bot for Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).