iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
933439c8f3
linux/fs/proc
History
Leon Yu 06b2849d10 proc: fix NULL dereference when reading /proc/<pid>/auxv 
Reading auxv of any kernel thread results in NULL pointer dereferencing
in auxv_read() where mm can be NULL.  Fix that by checking for NULL mm
and bailing out early.  This is also the original behavior changed by
recent commit c531716785 ("proc: switch auxv to use of __mem_open()").

  # cat /proc/2/auxv
  Unable to handle kernel NULL pointer dereference at virtual address 000000a8
  Internal error: Oops: 17 [#1] PREEMPT SMP ARM
  CPU: 3 PID: 113 Comm: cat Not tainted 4.9.0-rc1-ARCH+ #1
  Hardware name: BCM2709
  task: ea3b0b00 task.stack: e99b2000
  PC is at auxv_read+0x24/0x4c
  LR is at do_readv_writev+0x2fc/0x37c
  Process cat (pid: 113, stack limit = 0xe99b2210)
  Call chain:
    auxv_read
    do_readv_writev
    vfs_readv
    default_file_splice_read
    splice_direct_to_actor
    do_splice_direct
    do_sendfile
    SyS_sendfile64
    ret_fast_syscall

Fixes: c531716785 ("proc: switch auxv to use of __mem_open()")
Link: http://lkml.kernel.org/r/1476966200-14457-1-git-send-email-chianglungyu@gmail.com
Signed-off-by: Leon Yu <chianglungyu@gmail.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Kees Cook <keescook@chromium.org>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Mateusz Guzik <mguzik@redhat.com>
Cc: Janis Danisevskis <jdanis@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-10-27 18:43:43 -07:00
..
array.c fs/proc: Stop reporting eip and esp in /proc/PID/stat 2016-10-20 09:21:41 +02:00
base.c proc: fix NULL dereference when reading /proc/<pid>/auxv 2016-10-27 18:43:43 -07:00
cmdline.c
consoles.c
cpuinfo.c
devices.c
fd.c proc: unsigned file descriptors 2016-09-27 18:47:38 -04:00
fd.h proc: unsigned file descriptors 2016-09-27 18:47:38 -04:00
generic.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-10 13:04:49 -07:00
inode.c fs: Replace CURRENT_TIME with current_time() for inode timestamps 2016-09-27 21:06:21 -04:00
internal.h proc: unsigned file descriptors 2016-09-27 18:47:38 -04:00
interrupts.c
Kconfig
kcore.c fs/proc/kcore.c: Add bounce buffer for ktext data 2016-09-20 13:32:49 -07:00
kmsg.c
loadavg.c
Makefile fs/proc: Add compiler check for -Wno-override-init to support gcc < 4.2 2016-08-03 12:45:23 -04:00
meminfo.c meminfo: break apart a very long seq_printf with #ifdefs 2016-10-07 18:46:30 -07:00
namespaces.c switch all procfs directories ->iterate_shared() 2016-05-02 19:49:30 -04:00
nommu.c
page.c mm: rename _count, field of the struct page, to _refcount 2016-05-19 19:12:14 -07:00
proc_net.c proc: make proc entries inherit ownership from parent 2016-08-14 21:07:20 -07:00
proc_sysctl.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-10 20:16:43 -07:00
proc_tty.c
root.c proc: Convert proc_mount to use mount_ns. 2016-06-23 15:41:54 -05:00
self.c fs: Replace CURRENT_TIME with current_time() for inode timestamps 2016-09-27 21:06:21 -04:00
softirqs.c
stat.c seq/proc: modify seq_put_decimal_[u]ll to take a const char *, not char 2016-10-07 18:46:30 -07:00
task_mmu.c fs/proc: Stop trying to report thread stacks 2016-10-20 09:21:41 +02:00
task_nommu.c fs/proc: Stop trying to report thread stacks 2016-10-20 09:21:41 +02:00
thread_self.c fs: Replace CURRENT_TIME with current_time() for inode timestamps 2016-09-27 21:06:21 -04:00
uptime.c
version.c
vmcore.c crash_dump: Add vmcore_elf32_check_arch 2016-05-13 14:01:59 +02:00