kernel_optimize_test/fs/proc
Mathias Krause 8148a73c99 proc: prevent accessing /proc/<PID>/environ until it's ready
If /proc/<PID>/environ gets read before the envp[] array is fully set up
in create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to
read more bytes than are actually written, as env_start will already be
set but env_end will still be zero, making the range calculation
underflow, allowing to read beyond the end of what has been written.

Fix this as it is done for /proc/<PID>/cmdline by testing env_end for
zero.  It is, apparently, intentionally set last in create_*_tables().

This bug was found by the PaX size_overflow plugin that detected the
arithmetic underflow of 'this_len = env_end - (env_start + src)' when
env_end is still zero.

The expected consequence is that userland trying to access
/proc/<PID>/environ of a not yet fully set up process may get
inconsistent data as we're in the middle of copying in the environment
variables.

Fixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: Pax Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Mateusz Guzik <mguzik@redhat.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-05-05 17:38:53 -07:00
..
array.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2016-01-20 17:09:18 -08:00
base.c proc: prevent accessing /proc/<PID>/environ until it's ready 2016-05-05 17:38:53 -07:00
cmdline.c
consoles.c
cpuinfo.c
devices.c
fd.c proc: add a reschedule point in proc_readfd_common() 2016-01-09 02:56:10 -05:00
fd.h
generic.c proc: change proc_subdir_lock to a rwlock 2015-09-10 13:29:01 -07:00
inode.c kmemcg: account certain kmem allocations to memcg 2016-01-14 16:00:49 -08:00
internal.h proc: Allow creating permanently empty directories that serve as mount points 2015-07-01 10:36:41 -05:00
interrupts.c
Kconfig fs, proc: add help for CONFIG_PROC_CHILDREN 2015-07-17 16:39:52 -07:00
kcore.c wrappers for ->i_mutex access 2016-01-22 18:04:28 -05:00
kmsg.c
loadavg.c
Makefile
meminfo.c mm/page_alloc.c: calculate 'available' memory in a separate function 2016-03-17 15:09:34 -07:00
namespaces.c cgroup: introduce cgroup namespaces 2016-02-16 13:04:58 -05:00
nommu.c vfs: add seq_file_path() helper 2015-06-23 18:01:07 -04:00
page.c /proc/kpageflags: return KPF_SLAB for slab tail pages 2016-03-17 15:09:34 -07:00
proc_net.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
proc_sysctl.c fs: Drop unlikely before IS_ERR(_OR_NULL) 2015-09-29 15:13:58 +02:00
proc_tty.c
root.c vfs: Commit to never having exectuables on proc and sysfs. 2015-07-10 10:39:25 -05:00
self.c wrappers for ->i_mutex access 2016-01-22 18:04:28 -05:00
softirqs.c
stat.c
task_mmu.c numa: fix /proc/<pid>/numa_maps for THP 2016-04-28 19:34:04 -07:00
task_nommu.c proc: revert /proc/<pid>/maps [stack:TID] annotation 2016-02-03 08:28:43 -08:00
thread_self.c wrappers for ->i_mutex access 2016-01-22 18:04:28 -05:00
uptime.c
version.c
vmcore.c mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00