summaryrefslogtreecommitdiffstats
path: root/mm
diff options
context:
space:
mode:
authorWilly Tarreau <w@1wt.eu>2018-05-11 08:11:44 +0200
committerLinus Torvalds <torvalds@linux-foundation.org>2018-05-17 09:27:47 -0700
commit7f7ccc2ccc2e70c6054685f5e3522efa81556830 (patch)
tree7309cb80e03910053c21d5b003ed1d6b2dcacc16 /mm
parente6506eb241871d68647c53cb6d0a16299550ae97 (diff)
downloadlinux-stable-7f7ccc2ccc2e70c6054685f5e3522efa81556830.tar.gz
linux-stable-7f7ccc2ccc2e70c6054685f5e3522efa81556830.tar.bz2
linux-stable-7f7ccc2ccc2e70c6054685f5e3522efa81556830.zip
proc: do not access cmdline nor environ from file-backed areas
proc_pid_cmdline_read() and environ_read() directly access the target process' VM to retrieve the command line and environment. If this process remaps these areas onto a file via mmap(), the requesting process may experience various issues such as extra delays if the underlying device is slow to respond. Let's simply refuse to access file-backed areas in these functions. For this we add a new FOLL_ANON gup flag that is passed to all calls to access_remote_vm(). The code already takes care of such failures (including unmapped areas). Accesses via /proc/pid/mem were not changed though. This was assigned CVE-2018-1120. Note for stable backports: the patch may apply to kernels prior to 4.11 but silently miss one location; it must be checked that no call to access_remote_vm() keeps zero as the last argument. Reported-by: Qualys Security Advisory <qsa@qualys.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Oleg Nesterov <oleg@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
-rw-r--r--mm/gup.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/mm/gup.c b/mm/gup.c
index 76af4cfeaf68..541904a7c60f 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -544,6 +544,9 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags)
if (vm_flags & (VM_IO | VM_PFNMAP))
return -EFAULT;
+ if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma))
+ return -EFAULT;
+
if (write) {
if (!(vm_flags & VM_WRITE)) {
if (!(gup_flags & FOLL_FORCE))