summaryrefslogtreecommitdiff
path: root/kernel/lockdep_proc.c
diff options
context:
space:
mode:
authorJarod Wilson <jwilson@redhat.com>2008-09-09 12:38:56 +0200
committerGreg Kroah-Hartman <gregkh@suse.de>2008-10-08 20:23:12 -0700
commit34f3c11bc4d09fe7d3b105b5e4e6127dc4d8ee24 (patch)
treeed8d9a518a7bdc58930541826bcab0244260eae4 /kernel/lockdep_proc.c
parent553d7dd7336a3c1f3dd12085b5c42451c17225e1 (diff)
S390: CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode
commit 3d6e48f43340343d97839eadb1ab7b6a3ea98797 upstream When running a 31-bit ptrace, on either an s390 or s390x kernel, reads and writes into a padding area in struct user_regs_struct32 will result in a kernel panic. This is also known as CVE-2008-1514. Test case available here: http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/tests/user-area-padding.c?cvsroot=systemtap Steps to reproduce: 1) wget the above 2) gcc -o user-area-padding-31bit user-area-padding.c -Wall -ggdb2 -D_GNU_SOURCE -m31 3) ./user-area-padding-31bit <panic> Test status ----------- Without patch, both s390 and s390x kernels panic. With patch, the test case, as well as the gdb testsuite, pass without incident, padding area reads returning zero, writes ignored. Nb: original version returned -EINVAL on write attempts, which broke the gdb test and made the test case slightly unhappy, Jan Kratochvil suggested the change to return 0 on write attempts. Signed-off-by: Jarod Wilson <jarod@redhat.com> Tested-by: Jan Kratochvil <jan.kratochvil@redhat.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Moritz Muehlenhoff <jmm@debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'kernel/lockdep_proc.c')
0 files changed, 0 insertions, 0 deletions