summaryrefslogtreecommitdiff
path: root/Makefile
diff options
context:
space:
mode:
authorBen Hutchings <ben@decadent.org.uk>2015-06-16 22:11:06 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-06-29 12:08:34 -0700
commit14f81062f365fa9e3839bb2a16862217b71a553c (patch)
tree2c0c984a40a08c20498739053ef34e9329c510b7 /Makefile
parent97d905e8568ff57c36c3e89b23b1c0f9f5146f96 (diff)
pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic
pipe_iov_copy_{from,to}_user() may be tried twice with the same iovec, the first time atomically and the second time not. The second attempt needs to continue from the iovec position, pipe buffer offset and remaining length where the first attempt failed, but currently the pipe buffer offset and remaining length are reset. This will corrupt the piped data (possibly also leading to an information leak between processes) and may also corrupt kernel memory. This was fixed upstream by commits f0d1bec9d58d ("new helper: copy_page_from_iter()") and 637b58c2887e ("switch pipe_read() to copy_page_to_iter()"), but those aren't suitable for stable. This fix for older kernel versions was made by Seth Jennings for RHEL and I have extracted it from their update. CVE-2015-1805 References: https://bugzilla.redhat.com/show_bug.cgi?id=1202855 Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'Makefile')
0 files changed, 0 insertions, 0 deletions