Merge tag 'char-misc-5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc driver updates from Greg KH: "Here is the big set of char, misc, and other assorted driver subsystem patches for 5.10-rc1. There's a lot of different things in here, all over the drivers/ directory. Some summaries: - soundwire driver updates - habanalabs driver updates - extcon driver updates - nitro_enclaves new driver - fsl-mc driver and core updates - mhi core and bus updates - nvmem driver updates - eeprom driver updates - binder driver updates and fixes - vbox minor bugfixes - fsi driver updates - w1 driver updates - coresight driver updates - interconnect driver updates - misc driver updates - other minor driver updates All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (396 commits) binder: fix UAF when releasing todo list docs: w1: w1_therm: Fix broken xref, mistakes, clarify text misc: Kconfig: fix a HISI_HIKEY_USB dependency LSM: Fix type of id parameter in kernel_post_load_data prototype misc: Kconfig: add a new dependency for HISI_HIKEY_USB firmware_loader: fix a kernel-doc markup w1: w1_therm: make w1_poll_completion static binder: simplify the return expression of binder_mmap test_firmware: Test partial read support firmware: Add request_partial_firmware_into_buf() firmware: Store opt_flags in fw_priv fs/kernel_file_read: Add "offset" arg for partial reads IMA: Add support for file reads without contents LSM: Add "contents" flag to kernel_read_file hook module: Call security_kernel_post_load_data() firmware_loader: Use security_post_load_data() LSM: Introduce kernel_post_load_data() hook fs/kernel_read_file: Add file_size output argument fs/kernel_read_file: Switch buffer size arg to size_t fs/kernel_read_file: Remove redundant size argument ...
This commit is contained in:
@ -18,6 +18,7 @@
|
||||
#include <linux/fs.h>
|
||||
#include <linux/sysfs.h>
|
||||
#include <linux/kernel.h>
|
||||
#include <linux/kernel_read_file.h>
|
||||
#include <linux/slab.h>
|
||||
#include <linux/vmalloc.h>
|
||||
#include <linux/elf.h>
|
||||
@ -3013,7 +3014,7 @@ static int copy_module_from_user(const void __user *umod, unsigned long len,
|
||||
if (info->len < sizeof(*(info->hdr)))
|
||||
return -ENOEXEC;
|
||||
|
||||
err = security_kernel_load_data(LOADING_MODULE);
|
||||
err = security_kernel_load_data(LOADING_MODULE, true);
|
||||
if (err)
|
||||
return err;
|
||||
|
||||
@ -3023,11 +3024,17 @@ static int copy_module_from_user(const void __user *umod, unsigned long len,
|
||||
return -ENOMEM;
|
||||
|
||||
if (copy_chunked_from_user(info->hdr, umod, info->len) != 0) {
|
||||
vfree(info->hdr);
|
||||
return -EFAULT;
|
||||
err = -EFAULT;
|
||||
goto out;
|
||||
}
|
||||
|
||||
return 0;
|
||||
err = security_kernel_post_load_data((char *)info->hdr, info->len,
|
||||
LOADING_MODULE, "init_module");
|
||||
out:
|
||||
if (err)
|
||||
vfree(info->hdr);
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
static void free_copy(struct load_info *info)
|
||||
@ -4043,8 +4050,7 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
|
||||
SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags)
|
||||
{
|
||||
struct load_info info = { };
|
||||
loff_t size;
|
||||
void *hdr;
|
||||
void *hdr = NULL;
|
||||
int err;
|
||||
|
||||
err = may_init_module();
|
||||
@ -4057,12 +4063,12 @@ SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs, int, flags)
|
||||
|MODULE_INIT_IGNORE_VERMAGIC))
|
||||
return -EINVAL;
|
||||
|
||||
err = kernel_read_file_from_fd(fd, &hdr, &size, INT_MAX,
|
||||
err = kernel_read_file_from_fd(fd, 0, &hdr, INT_MAX, NULL,
|
||||
READING_MODULE);
|
||||
if (err)
|
||||
if (err < 0)
|
||||
return err;
|
||||
info.hdr = hdr;
|
||||
info.len = size;
|
||||
info.len = err;
|
||||
|
||||
return load_module(&info, uargs, flags);
|
||||
}
|
||||
|
Reference in New Issue
Block a user