Amanieu d'Antras 3ead7c52bd signalfd: fix information leak in signalfd_copyinfo ...

This function may copy the si_addr_lsb field to user mode when it hasn't
been initialized, which can leak kernel stack data to user mode.

Just checking the value of si_code is insufficient because the same
si_code value is shared between multiple signals.  This is solved by
checking the value of si_signo in addition to si_code.

Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2015-08-07 04:39:40 +03:00

..

9p

9p: don't leave a half-initialized inode sitting around

2015-07-12 11:22:05 -04:00

adfs

fs/adfs: remove unneeded cast

2015-06-30 19:44:57 -07:00

affs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

afs

net: Add a struct net parameter to sock_create_kern

2015-05-11 10:50:17 -04:00

autofs4

make simple_positive() public

2015-06-23 18:02:01 -04:00

befs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

bfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-04-26 17:22:07 -07:00

btrfs

Merge branch 'for-linus-4.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs

2015-07-31 17:05:37 -07:00

cachefiles

Merge branch 'fscache-fixes' into for-next

2015-06-23 18:01:30 -04:00

ceph

ceph: always re-send cap flushes when MDS recovers

2015-07-31 11:38:53 +03:00

cifs

cifs: Unset CIFS_MOUNT_POSIX_PATHS flag when following dfs mounts

2015-06-29 14:50:22 -05:00

coda

fs: cleanup slight list_entry abuse

2015-06-23 18:01:59 -04:00

configfs

configfs: fix kernel infoleak through user-controlled format string

2015-07-17 16:39:53 -07:00

cramfs

…

debugfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

devpts

devpts: if initialization failed, don't crash when opening /dev/ptmx

2015-06-30 19:44:58 -07:00

dlm

net: Add a struct net parameter to sock_create_kern

2015-05-11 10:50:17 -04:00

ecryptfs

ioctl_compat: handle FITRIM

2015-07-09 11:42:21 -07:00

efivarfs

Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-05-06 10:57:37 -07:00

efs

fs/efs: femove unneeded cast

2015-06-25 17:00:42 -07:00

exofs

pagemap.h: move dir_pages() over there

2015-06-23 18:02:00 -04:00

exportfs

VFS: (Scripted) Convert S_ISLNK/DIR/REG(dentry->d_inode) to d_is_*(dentry)

2015-02-22 11:38:41 -05:00

ext2

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

ext3

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2015-06-24 20:07:10 -07:00

ext4

ioctl_compat: handle FITRIM

2015-07-09 11:42:21 -07:00

f2fs

f2fs: call set_page_dirty to attach i_wb for cgroup

2015-07-25 08:54:26 -07:00

fat

writeback: separate out include/linux/backing-dev-defs.h

2015-06-02 08:33:34 -06:00

freevxfs

pagemap.h: move dir_pages() over there

2015-06-23 18:02:00 -04:00

fscache

FS-Cache: Retain the netfs context in the retrieval op earlier

2015-04-02 14:28:53 +01:00

fuse

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

gfs2

Merge tag 'gfs2-merge-window' of git://git.kernel.org:/pub/scm/linux/kernel/git/gfs2/linux-gfs2

2015-06-27 09:47:46 -07:00

hfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

hfsplus

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

hostfs

Merge branch 'for-linus-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-06-22 12:51:21 -07:00

hpfs

hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead

2015-07-09 13:35:31 -07:00

hugetlbfs

mm/hugetlb: reduce arch dependent code about hugetlb_prefault_arch_hook

2015-06-24 17:49:41 -07:00

isofs

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15 15:06:57 -04:00

jbd

jbd: Deletion of an unnecessary check before the function call "iput"

2014-11-18 10:15:29 +01:00

jbd2

Revert "jbd2: speedup jbd2_journal_dirty_metadata()"

2015-06-27 09:41:50 -07:00

jffs2

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

jfs

Merge tag 'jfs-4.2' of git://github.com/kleikamp/linux-shaggy

2015-07-16 16:28:28 -07:00

kernfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2015-07-03 15:20:57 -07:00

lockd

nfsd: eliminate NFSD_DEBUG

2015-04-21 16:16:02 -04:00

logfs

logfs: fix a pagecache leak for symlinks

2015-05-10 22:18:28 -04:00

minix

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

ncpfs

ncpfs: successful rename() should invalidate caches for parents

2015-06-14 11:31:39 -04:00

nfs

Merge tag 'nfs-for-4.2-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

2015-07-28 09:37:44 -07:00

nfs_common

…

nfsd

nfsd: do nfs4_check_fh in nfs4_check_file instead of nfs4_check_olstateid

2015-07-31 16:30:26 -04:00

nilfs2

ioctl_compat: handle FITRIM

2015-07-09 11:42:21 -07:00

nls

…

notify

Revert "fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()"

2015-07-21 16:06:53 -07:00

ntfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

ocfs2

ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()

2015-08-07 04:39:40 +03:00

omfs

omfs: fix potential integer overflow in allocator

2015-05-28 18:25:19 -07:00

openpromfs

…

overlayfs

fix a braino in ovl_d_select_inode()

2015-07-12 11:22:05 -04:00

proc

Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-07-18 10:49:57 -07:00

pstore

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2015-07-03 15:20:57 -07:00

qnx4

…

qnx6

pagemap.h: move dir_pages() over there

2015-06-23 18:02:00 -04:00

quota

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-04-26 17:22:07 -07:00

ramfs

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15 15:06:57 -04:00

reiserfs

Merge branch 'akpm' (patches from Andrew)

2015-06-26 09:52:05 -07:00

romfs

make new_sync_{read,write}() static

2015-04-11 22:29:40 -04:00

squashfs

fs: cleanup slight list_entry abuse

2015-06-23 18:01:59 -04:00

sysfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2015-07-03 15:20:57 -07:00

sysv

pagemap.h: move dir_pages() over there

2015-06-23 18:02:00 -04:00

tracefs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

ubifs

Merge tag 'upstream-4.2-rc1' of git://git.infradead.org/linux-ubifs

2015-06-25 14:11:34 -07:00

udf

udf: Don't corrupt unalloc spacetable when writing it

2015-07-09 16:38:57 +02:00

ufs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

xfs

xfs: remote attributes need to be considered data

2015-07-29 11:48:02 +10:00

aio.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-04-16 23:27:56 -04:00

anon_inodes.c

…

attr.c

…

bad_inode.c

don't bother with most of the bad_file_ops methods

2015-02-20 04:03:58 -05:00

binfmt_aout.c

assorted conversions to %p[dD]

2014-11-19 13:01:20 -05:00

binfmt_elf_fdpic.c

…

binfmt_elf.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

binfmt_em86.c

syscalls: implement execveat() system call

2014-12-13 12:42:51 -08:00

binfmt_flat.c

…

binfmt_misc.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-04-26 17:22:07 -07:00

binfmt_script.c

syscalls: implement execveat() system call

2014-12-13 12:42:51 -08:00

block_dev.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

buffer.c

buffer: remove unusued 'ret' variable

2015-06-02 09:22:34 -06:00

char_dev.c

fs: introduce f_op->mmap_capabilities for nommu mmap support

2015-01-20 14:02:58 -07:00

compat_binfmt_elf.c

…

compat_ioctl.c

ioctl_compat: handle FITRIM

2015-07-09 11:42:21 -07:00

compat.c

…

coredump.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

dax.c

xfs: call dax_fault on read page faults for DAX

2015-07-29 11:48:00 +10:00

dcache.c

fs, file table: reinit files_stat.max_files after deferred memory initialisation

2015-08-07 04:39:40 +03:00

dcookies.c

…

direct-io.c

direct-io: only inc/dec inode->i_dio_count for file systems

2015-04-24 15:45:28 -04:00

drop_caches.c

vmscan: per memory cgroup slab shrinkers

2015-02-12 18:54:09 -08:00

eventfd.c

eventfd: don't take the spinlock in eventfd_poll

2015-02-17 14:34:52 -08:00

eventpoll.c

epoll: optimize setting task running after blocking

2015-02-13 21:21:40 -08:00

exec.c

parisc,metag: Fix crashes due to stack randomization on stack-grows-upwards architectures

2015-05-12 22:03:44 +02:00

fcntl.c

vfs: renumber FMODE_NONOTIFY and add to uniqueness check

2015-01-08 15:10:52 -08:00

fhandle.c

vfs: read file_handle only once in handle_to_path

2015-06-02 10:29:07 -07:00

file_table.c

fs, file table: reinit files_stat.max_files after deferred memory initialisation

2015-08-07 04:39:40 +03:00

file.c

fs/file.c: __fget() and dup2() atomicity rules

2015-07-01 02:31:08 -04:00

filesystems.c

…

fs_pin.c

fs_pin: Allow for the possibility that m_list or s_list go unused.

2015-04-09 11:39:55 -05:00

fs_struct.c

…

fs-writeback.c

block: export bio_associate_*() and wbc_account_io()

2015-07-23 13:36:44 -06:00

inode.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

internal.h

overlayfs: Make f_path always point to the overlay and f_inode to the underlay

2015-06-19 03:19:32 -04:00

ioctl.c

fsioctl.c: make generic_block_fiemap() signal-tolerant

2015-02-10 14:30:30 -08:00

Kconfig

f2fs: relocate Kconfig from misc filesystems

2015-04-10 15:08:35 -07:00

Kconfig.binfmt

mm: split ET_DYN ASLR from mmap ASLR

2015-04-14 16:49:05 -07:00

libfs.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

locks.c

locks: inline posix_lock_file_wait and flock_lock_file_wait

2015-07-13 06:29:11 -04:00

Makefile

um: Remove hppfs

2015-05-31 13:23:08 +02:00

mbcache.c

…

mount.h

fs: use seq_open_private() for proc_mounts

2015-06-30 19:44:56 -07:00

mpage.c

writeback: implement foreign cgroup inode detection

2015-06-02 08:40:20 -06:00

namei.c

link_path_walk(): be careful when failing with ENOTDIR

2015-08-01 20:18:38 -04:00

namespace.c

mnt: In detach_mounts detach the appropriate unmounted mount

2015-07-23 11:31:15 -05:00

no-block.c

…

nsfs.c

VFS: assorted weird filesystems: d_inode() annotations

2015-04-15 15:06:58 -04:00

open.c

fs: Call security_ops->inode_killpriv on truncate

2015-06-23 18:01:09 -04:00

pipe.c

VFS: assorted weird filesystems: d_inode() annotations

2015-04-15 15:06:58 -04:00

pnode.c

mnt: Don't propagate unmounts to locked mounts

2015-04-02 20:34:20 -05:00

pnode.h

mnt: Clarify and correct the disconnect logic in umount_tree

2015-07-22 20:33:27 -05:00

posix_acl.c

fs/posix_acl.c: make posix_acl_create() safer and cleaner

2015-06-23 18:01:07 -04:00

proc_namespace.c

fs: use seq_open_private() for proc_mounts

2015-06-30 19:44:56 -07:00

read_write.c

new_sync_write(): discard ->ki_pos unless the return value is positive

2015-04-11 22:29:46 -04:00

readdir.c

…

select.c

locking/arch: Rename set_mb() to smp_store_mb()

2015-05-19 08:32:00 +02:00

seq_file.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

signalfd.c

signalfd: fix information leak in signalfd_copyinfo

2015-08-07 04:39:40 +03:00

splice.c

Merge branch 'akpm' (patches from Andrew)

2015-06-24 20:47:21 -07:00

stack.c

…

stat.c

VFS: assorted d_backing_inode() annotations

2015-04-15 15:06:59 -04:00

statfs.c

…

super.c

fs:super:get_anon_bdev: fix race condition could cause dev exceed its upper limitation

2015-07-01 01:50:06 -04:00

sync.c

vfs: add support for a lazytime mount option

2015-02-05 02:45:00 -05:00

timerfd.c

fs: Convert show_fdinfo functions to void

2014-11-05 14:13:23 -05:00

utimes.c

…

xattr.c

evm: fix potential race when removing xattrs

2015-05-21 13:28:47 -04:00