No description
Find a file
Baokun Li b9f58cdae6 cachefiles: defer exposing anon_fd until after copy_to_user() succeeds
[ Upstream commit 4b4391e77a ]

After installing the anonymous fd, we can now see it in userland and close
it. However, at this point we may not have gotten the reference count of
the cache, but we will put it during colse fd, so this may cause a cache
UAF.

So grab the cache reference count before fd_install(). In addition, by
kernel convention, fd is taken over by the user land after fd_install(),
and the kernel should not call close_fd() after that, i.e., it should call
fd_install() after everything is ready, thus fd_install() is called after
copy_to_user() succeeds.

Fixes: c838305450 ("cachefiles: notify the user daemon when looking up cookie")
Suggested-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Link: https://lore.kernel.org/r/20240522114308.2402121-10-libaokun@huaweicloud.com
Acked-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-06-21 14:40:16 +02:00
arch powerpc/uaccess: Fix build errors seen with GCC 13/14 2024-06-21 14:40:15 +02:00
block block: stack max_user_sectors 2024-06-12 11:39:52 +02:00
certs This update includes the following changes: 2023-11-02 16:15:30 -10:00
crypto crypto: ecrdsa - Fix module auto-load on add_key 2024-06-16 13:51:03 +02:00
Documentation Revert "xsk: Document ability to redirect to any socket bound to the same umem" 2024-06-16 13:51:10 +02:00
drivers cxl/region: Fix memregion leaks in devm_cxl_add_region() 2024-06-21 14:40:15 +02:00
fs cachefiles: defer exposing anon_fd until after copy_to_user() succeeds 2024-06-21 14:40:16 +02:00
include cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() 2024-06-21 14:40:16 +02:00
init printk: Fix LOG_CPU_MAX_BUF_SHIFT when BASE_SMALL is enabled 2024-06-12 11:39:35 +02:00
io_uring io_uring: fix cancellation overwriting req->flags 2024-06-21 14:40:11 +02:00
ipc sysctl changes for v6.9-rc1 2024-03-18 14:59:13 -07:00
kernel bpf: Fix a potential use-after-free in bpf_link_free() 2024-06-21 14:40:04 +02:00
lib ubsan: Restore dependency on ARCH_HAS_UBSAN 2024-06-12 11:39:38 +02:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
mm mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL 2024-06-16 13:51:08 +02:00
net net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() 2024-06-21 14:40:10 +02:00
rust rust: remove params from module macro example 2024-04-25 17:34:33 +02:00
samples samples/landlock: Fix incorrect free in populate_ruleset_net 2024-05-30 09:45:01 +02:00
scripts kconfig: fix comparison to constant symbols, 'm', 'n' 2024-06-12 11:39:54 +02:00
security landlock: Fix d_parent walk 2024-06-21 14:40:12 +02:00
sound ALSA: seq: Fix incorrect UMP type for system messages 2024-06-16 13:51:15 +02:00
tools cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c 2024-06-21 14:40:15 +02:00
usr Kbuild updates for v6.8 2024-01-18 17:57:07 -08:00
virt KVM: Drop unused @may_block param from gfn_to_pfn_cache_invalidate_start() 2024-04-11 12:58:53 -07:00
.clang-format clang-format: Update with v6.7-rc4's for_each macro list 2023-12-08 23:54:38 +01:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-21 14:40:11 +02:00
.get_maintainer.ignore Add Jeff Kirsher to .get_maintainer.ignore 2024-03-08 11:36:54 +00:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore kbuild: create a list of all built DTB files 2024-02-19 18:20:39 +09:00
.mailmap 18 hotfixes, 7 of which are cc:stable. 2024-05-10 14:16:03 -07:00
.rustfmt.toml
COPYING
CREDITS MAINTAINERS: Drop Gustavo Pimentel as PCI DWC Maintainer 2024-03-27 13:41:02 -05:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig
MAINTAINERS cpufreq: amd-pstate: remove global header file 2024-06-21 14:40:00 +02:00
Makefile Linux 6.9.5 2024-06-16 13:51:16 +02:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.