https://github.com/torvalds/linux
Revision 4bfe6cce133cad82cea04490c308795275857782 authored by Jay Lang on 24 May 2020, 16:27:39 UTC, committed by Thomas Gleixner on 28 May 2020, 19:36:20 UTC
In the copy_process() routine called by _do_fork(), failure to allocate a PID (or further along in the function) will trigger an invocation to exit_thread(). This is done to clean up from an earlier call to copy_thread_tls(). Naturally, the child task is passed into exit_thread(), however during the process, io_bitmap_exit() nullifies the parent's io_bitmap rather than the child's. As copy_thread_tls() has been called ahead of the failure, the reference count on the calling thread's io_bitmap is incremented as we would expect. However, io_bitmap_exit() doesn't accept any arguments, and thus assumes it should trash the current thread's io_bitmap reference rather than the child's. This is pretty sneaky in practice, because in all instances but this one, exit_thread() is called with respect to the current task and everything works out. A determined attacker can issue an appropriate ioctl (i.e. KDENABIO) to get a bitmap allocated, and force a clone3() syscall to fail by passing in a zeroed clone_args structure. The kernel handles the erroneous struct and the buggy code path is followed, and even though the parent's reference to the io_bitmap is trashed, the child still holds a reference and thus the structure will never be freed. Fix this by tweaking io_bitmap_exit() and its subroutines to accept a task_struct argument which to operate on. Fixes: ea5f1cd7ab49 ("x86/ioperm: Remove bitmap if all permissions dropped") Signed-off-by: Jay Lang <jaytlang@mit.edu> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable#@vger.kernel.org Link: https://lkml.kernel.org/r/20200524162742.253727-1-jaytlang@mit.edu
1 parent 8874347
Tip revision: 4bfe6cce133cad82cea04490c308795275857782 authored by Jay Lang on 24 May 2020, 16:27:39 UTC
x86/ioperm: Prevent a memory leak when fork fails
x86/ioperm: Prevent a memory leak when fork fails
Tip revision: 4bfe6cc
File | Mode | Size |
---|---|---|
include | ||
.gitignore | -rw-r--r-- | 94 bytes |
Kconfig | -rw-r--r-- | 7.1 KB |
Makefile | -rw-r--r-- | 2.9 KB |
default_cpio_list | -rw-r--r-- | 153 bytes |
gen_init_cpio.c | -rw-r--r-- | 12.8 KB |
gen_initramfs.sh | -rwxr-xr-x | 5.7 KB |
initramfs_data.S | -rw-r--r-- | 1.2 KB |
Computing file changes ...