]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Dec 2020 13:23:24 +0000 (14:23 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Dec 2020 13:23:24 +0000 (14:23 +0100)
added patches:
ptrace-prevent-kernel-infoleak-in-ptrace_get_syscall_info.patch

queue-5.10/ptrace-prevent-kernel-infoleak-in-ptrace_get_syscall_info.patch [new file with mode: 0644]

diff --git a/queue-5.10/ptrace-prevent-kernel-infoleak-in-ptrace_get_syscall_info.patch b/queue-5.10/ptrace-prevent-kernel-infoleak-in-ptrace_get_syscall_info.patch
new file mode 100644 (file)
index 0000000..79fd26d
--- /dev/null
@@ -0,0 +1,39 @@
+From 0032ce0f85a269a006e91277be5fdbc05fad8426 Mon Sep 17 00:00:00 2001
+From: Peilin Ye <yepeilin.cs@gmail.com>
+Date: Sat, 1 Aug 2020 11:20:44 -0400
+Subject: ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info()
+
+From: Peilin Ye <yepeilin.cs@gmail.com>
+
+commit 0032ce0f85a269a006e91277be5fdbc05fad8426 upstream.
+
+ptrace_get_syscall_info() is potentially copying uninitialized stack
+memory to userspace, since the compiler may leave a 3-byte hole near the
+beginning of `info`. Fix it by adding a padding field to `struct
+ptrace_syscall_info`.
+
+Fixes: 201766a20e30 ("ptrace: add PTRACE_GET_SYSCALL_INFO request")
+Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
+Reviewed-by: Dmitry V. Levin <ldv@altlinux.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200801152044.230416-1-yepeilin.cs@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/uapi/linux/ptrace.h |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/uapi/linux/ptrace.h
++++ b/include/uapi/linux/ptrace.h
+@@ -81,7 +81,8 @@ struct seccomp_metadata {
+ struct ptrace_syscall_info {
+       __u8 op;        /* PTRACE_SYSCALL_INFO_* */
+-      __u32 arch __attribute__((__aligned__(sizeof(__u32))));
++      __u8 pad[3];
++      __u32 arch;
+       __u64 instruction_pointer;
+       __u64 stack_pointer;
+       union {