iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Kees Cook d48539bf92 binfmt_elf: Do not move brk for INTERP-less ET_EXEC 
commit 7be3cb019db1cbd5fd5ffe6d64a23fefa4b6f229 upstream.

When brk was moved for binaries without an interpreter, it should have
been limited to ET_DYN only. In other words, the special case was an
ET_DYN that lacks an INTERP, not just an executable that lacks INTERP.
The bug manifested for giant static executables, where the brk would end
up in the middle of the text area on 32-bit architectures.

Reported-and-tested-by: Richard Kojedzinszky <richard@kojedz.in>
Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:11:36 +02:00
..
9p
9p: avoid attaching writeback_fid on mmap with type PRIVATE
2019-10-17 13:40:54 -07:00
adfs
fs/adfs: super: fix use-after-free bug
2019-08-06 18:28:26 +02:00
affs
affs_lookup(): close a race with affs_remove_link()
2018-05-30 07:48:51 +02:00
afs
afs: Fix afs_kill_pages()
2017-12-20 10:04:56 +01:00
autofs4
autofs: fix a leak in autofs_expire_indirect()
2019-12-21 10:34:21 +01:00
befs
…
bfs
bfs: add sanity check at bfs_fill_super()
2018-12-01 09:46:33 +01:00
btrfs
Btrfs: clean up an error code in btrfs_init_space_info()
2020-05-10 10:26:03 +02:00
cachefiles
fscache, cachefiles: remove redundant variable 'cache'
2018-12-17 21:55:12 +01:00
ceph
ceph: don't skip updating wanted caps when cap is stale
2020-05-02 17:20:30 +02:00
cifs
cifs: protect updating server->dstaddr with a spinlock
2020-05-10 10:26:11 +02:00
coda
coda: add error handling for fget
2019-08-06 18:28:27 +02:00
configfs
configfs: fix a deadlock in configfs_symlink()
2019-11-12 19:13:24 +01:00
cramfs
Cramfs: fix abad comparison when wrap-arounds occur
2018-11-21 09:27:37 +01:00
debugfs
debugfs: fix use-after-free on symlink traversal
2019-05-16 19:45:01 +02:00
devpts
devpts: clean up interface to pty drivers
2016-08-16 09:30:49 +02:00
dlm
dlm: fix invalid cluster name warning
2019-12-21 10:34:44 +01:00
ecryptfs
ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
2020-03-11 07:51:14 +01:00
efivarfs
efi: Make efivarfs entries immutable by default
2016-03-03 15:07:09 -08:00
efs
…
exofs
fs/exofs: fix potential memory leak in mount option parsing
2018-11-27 16:08:00 +01:00
exportfs
exportfs: fix 'passing zero to ERR_PTR()' warning
2020-01-29 10:21:36 +01:00
ext2
ext2: fix empty body warnings when -Wextra is used
2020-04-24 07:57:25 +02:00
ext4
ext4: fix special inode number checks in __ext4_iget()
2020-05-05 19:13:21 +02:00
f2fs
f2fs: return correct errno in f2fs_gc
2019-11-25 15:54:27 +01:00
fat
fat: fix uninit-memory access for partial initialized inode
2020-03-11 07:51:17 +01:00
freevxfs
…
fscache
fscache: fix race between enablement and dropping of object
2018-12-17 21:55:11 +01:00
fuse
fuse: fix possibly missed wake-up after abort
2020-05-02 17:20:51 +02:00
gfs2
gfs2: fix flock panic issue
2020-05-10 10:26:24 +02:00
hfs
fs/hfs/extent.c: fix array out of bounds read of array extent
2019-11-28 18:25:57 +01:00
hfsplus
hfsplus: fix crash and filesystem corruption when deleting files
2020-04-24 07:57:16 +02:00
hostfs
hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
2016-09-30 10:18:39 +02:00
hpfs
hpfs: implement the show_options method
2016-06-01 12:15:54 -07:00
hugetlbfs
hugetlb: use same fault hash key for shared and private mappings
2019-06-11 12:23:52 +02:00
isofs
isofs: fix timestamps beyond 2027
2017-11-30 08:37:20 +00:00
jbd2
jbd2: improve comments about freeing data buffers whose page mapping is NULL
2020-04-24 07:57:19 +02:00
jffs2
jffs2: fix use-after-free on symlink traversal
2019-05-16 19:45:01 +02:00
jfs
jfs: fix bogus variable self-initialization
2020-01-29 10:21:41 +01:00
kernfs
kernfs: Fix range checks in kernfs_get_target_path
2019-11-25 15:53:59 +01:00
lockd
lockd: fix access beyond unterminated strings in prints
2018-11-21 09:27:36 +01:00
logfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
minix
…
ncpfs
ncpfs: fix build warning of strncpy
2019-03-23 08:44:21 +01:00
nfs
NFS: Fix an LOCK/OPEN race when unlinking an open file
2020-05-10 10:26:05 +02:00
nfs_common
lockd: fix "list_add double add" caused by legacy signal interface
2018-02-03 17:04:28 +01:00
nfsd
nfsd: Return EPERM, not EACCES, in some SETATTR cases
2019-12-21 10:34:45 +01:00
nilfs2
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
nls
…
notify
fanotify: fix logic of events on child
2018-04-24 09:32:11 +02:00
ntfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
ocfs2
ocfs2: no need try to truncate file beyond i_size
2020-04-24 07:57:15 +02:00
omfs
…
openpromfs
…
overlayfs
Revert "ovl: modify ovl_permission() to do checks on two inodes"
2020-02-14 16:29:56 -05:00
proc
mm/page_alloc.c: calculate 'available' memory in a separate function
2020-01-23 08:18:35 +01:00
pstore
pstore/ram: Write new dumps to start of recycled zones
2020-01-12 11:22:46 +01:00
qnx4
…
qnx6
…
quota
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
2020-01-04 13:34:32 +01:00
ramfs
mm, fs: obey gfp_mapping for add_to_page_cache()
2015-10-16 11:42:28 -07:00
reiserfs
reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
2020-02-28 15:39:09 +01:00
romfs
romfs: use different way to generate fsid for BLOCK or MTD
2017-06-17 06:39:38 +02:00
squashfs
squashfs: more metadata hardenings
2018-08-06 16:24:42 +02:00
sysfs
scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
2018-09-05 09:18:40 +02:00
sysv
sysv: return 'err' instead of 0 in __sysv_write_inode
2018-12-17 21:55:09 +01:00
tracefs
tracefs: Fix refcount imbalance in start_creating()
2015-11-04 22:13:45 -05:00
ubifs
ubifs: Fix deadlock in concurrent bulk-read and writepage
2020-02-28 15:38:48 +01:00
udf
udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
2019-07-21 09:07:08 +02:00
ufs
ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
2019-06-11 12:23:49 +02:00
xfs
xfs: Sanity check flags of Q_XQUOTARM call
2020-01-29 10:21:35 +01:00
aio.c
aio: fix spectre gadget in lookup_ioctx
2018-12-21 14:09:50 +01:00
anon_inodes.c
…
attr.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
libnvdimm for 4.4:
2015-11-10 12:07:22 -08:00
binfmt_elf.c
binfmt_elf: Do not move brk for INTERP-less ET_EXEC
2020-05-20 08:11:36 +02:00
binfmt_em86.c
…
binfmt_flat.c
fs/binfmt_flat.c: make load_flat_shared_library() work
2019-07-10 09:56:30 +02:00
binfmt_misc.c
fs/binfmt_misc.c: do not allow offset overflow
2018-07-03 11:21:26 +02:00
binfmt_script.c
exec: load_script: Do not exec truncated interpreter path
2019-11-06 12:09:12 +01:00
block_dev.c
fs/block_dev: always invalidate cleancache in invalidate_bdev()
2017-05-20 14:27:01 +02:00
buffer.c
fs: fix guard_bio_eod to check for real EOD errors
2019-04-27 09:33:49 +02:00
char_dev.c
chardev: Avoid potential use-after-free in 'chrdev_open()'
2020-01-14 20:03:00 +01:00
compat_binfmt_elf.c
binfmt_elf: compat: avoid unused function warning
2018-02-25 11:03:51 +01:00
compat_ioctl.c
compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
2019-08-11 12:20:46 +02:00
compat.c
…
coredump.c
coredump: Ensure proper size of sparse core files
2017-07-05 14:37:20 +02:00
dax.c
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
dcache.c
fs/dcache: move security_d_instantiate() behind attaching dentry to inode
2019-11-10 11:21:39 +01:00
dcookies.c
…
direct-io.c
direct-io: Prevent NULL pointer access in submit_page_section
2017-10-18 09:20:42 +02:00
drop_caches.c
fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
2019-03-23 08:44:26 +01:00
eventfd.c
…
eventpoll.c
fs/epoll: drop ovflist branch prediction
2019-02-20 10:13:14 +01:00
exec.c
signal: Extend exec_id to 64bits
2020-04-24 07:57:12 +02:00
fcntl.c
fs/fcntl: f_setown, avoid undefined behaviour
2018-01-31 12:06:11 +01:00
fhandle.c
fs/coredump: prevent fsuid=0 dumps into user-controlled directories
2016-04-12 09:08:58 -07:00
file_table.c
…
file.c
fs/file.c: initialize init_files.resize_wait
2019-04-27 09:33:49 +02:00
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead
2019-11-12 19:13:31 +01:00
inode.c
futex: Fix inode life-time issue
2020-04-02 19:02:31 +02:00
internal.h
…
ioctl.c
…
Kconfig
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
Kconfig.binfmt
…
libfs.c
libfs: fix infoleak in simple_attr_read()
2020-04-02 19:02:38 +02:00
locks.c
locks: print unsigned ino in /proc/locks
2020-01-12 11:22:41 +01:00
Makefile
ext4: promote ext4 over ext2 in the default probe order
2015-10-15 10:33:21 -04:00
mbcache.c
…
mount.h
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:44:57 +02:00
mpage.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
namei.c
namei: only return -ECHILD from follow_dotdot_rcu()
2020-03-11 07:51:14 +01:00
namespace.c
fs/namespace.c: fix mountpoint reference counter race
2020-05-02 17:20:40 +02:00
no-block.c
…
nsfs.c
nsfs: mark dentry with DCACHE_RCUACCESS
2018-02-16 20:09:43 +01:00
open.c
access: avoid the RCU grace period for the temporary subjective credentials
2019-08-04 09:35:01 +02:00
pipe.c
fs: prevent page refcount overflow in pipe_buf_get
2020-03-11 07:51:15 +01:00
pnode.c
propagate_one(): mnt_set_mountpoint() needs mount_lock
2020-05-02 17:20:55 +02:00
pnode.h
mnt: Add a per mount namespace limit on the number of mounts
2017-04-30 05:49:28 +02:00
posix_acl.c
tmpfs: clear S_ISGID when setting posix ACLs
2017-01-26 08:23:47 +01:00
proc_namespace.c
vfs: show_vfsstat: do not ignore errors from show_devname method
2016-04-12 09:08:55 -07:00
read_write.c
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
2019-06-11 12:24:13 +02:00
readdir.c
filldir[64]: remove WARN_ON_ONCE() for bad directory entries
2020-01-04 13:34:37 +01:00
select.c
fs/select: add vmalloc fallback for select(2)
2018-01-31 12:06:09 +01:00
seq_file.c
Make file credentials available to the seqfile interfaces
2017-08-06 19:19:42 -07:00
signalfd.c
…
splice.c
fs: prevent page refcount overflow in pipe_buf_get
2020-03-11 07:51:15 +01:00
stack.c
…
stat.c
ufs: restore maintaining ->i_blocks
2017-06-14 13:16:24 +02:00
statfs.c
…
super.c
fs: don't scan the inode cache before SB_BORN is set
2019-02-06 19:43:08 +01:00
sync.c
fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback
2015-11-06 17:50:42 -08:00
timerfd.c
timerfd: Protect the might cancel mechanism proper
2017-05-08 07:46:01 +02:00
userfaultfd.c
userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
2019-09-06 10:18:09 +02:00
utimes.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
xattr.c
getxattr: use correct xattr length
2018-09-09 20:04:36 +02:00