github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-15 02:21:59 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
c11600e4fe
linux/include
History
David Rientjes c11600e4fe mm, mempolicy: task->mempolicy must be NULL before dropping final reference 
KASAN allocates memory from the page allocator as part of
kmem_cache_free(), and that can reference current->mempolicy through any
number of allocation functions.  It needs to be NULL'd out before the
final reference is dropped to prevent a use-after-free bug:

	BUG: KASAN: use-after-free in alloc_pages_current+0x363/0x370 at addr ffff88010b48102c
	CPU: 0 PID: 15425 Comm: trinity-c2 Not tainted 4.8.0-rc2+ #140
	...
	Call Trace:
		dump_stack
		kasan_object_err
		kasan_report_error
		__asan_report_load2_noabort
		alloc_pages_current	<-- use after free
		depot_save_stack
		save_stack
		kasan_slab_free
		kmem_cache_free
		__mpol_put		<-- free
		do_exit

This patch sets current->mempolicy to NULL before dropping the final
reference.

Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1608301442180.63329@chino.kir.corp.google.com
Fixes: cd11016e5f ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
Signed-off-by: David Rientjes <rientjes@google.com>
Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>	[4.6+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-09-01 17:52:01 -07:00
..
acpi treewide: replace obsolete _refok by __ref 2016-08-02 17:31:41 -04:00
asm-generic mm/usercopy: get rid of CONFIG_DEBUG_STRICT_USER_COPY_CHECKS 2016-08-30 10:10:21 -07:00
clocksource clocksource/drivers/sp804: Convert init function to return error 2016-06-28 10:19:30 +02:00
crypto A number of improvements for the /dev/random driver; the most 2016-07-27 15:11:55 -07:00
drm Merge branch 'drm-next-4.8' of git://people.freedesktop.org/~agd5f/linux into drm-next 2016-08-08 16:45:33 +10:00
dt-bindings ARM: DT updates for v4.8 2016-08-01 18:37:45 -04:00
keys KEYS: Strip trailing spaces 2016-06-14 10:29:44 +01:00
kvm KVM/ARM Changes for v4.8 - Take 2 2016-08-04 13:59:56 +02:00
linux mm, mempolicy: task->mempolicy must be NULL before dropping final reference 2016-09-01 17:52:01 -07:00
math-emu
media dma-mapping: use unsigned long for dma_attrs 2016-08-04 08:50:07 -04:00
memory
misc cxl: Add cxl_check_and_switch_mode() API to switch bi-modal cards 2016-07-14 20:28:11 +10:00
net tcp: fix use after free in tcp_xmit_retransmit_queue() 2016-08-18 23:22:57 -07:00
pcmcia
ras tracing, RAS: Cleanup on __get_str() usage 2016-07-15 15:51:16 -04:00
rdma IB/core: Use memdup_user() rather than duplicating its implementation 2016-08-23 12:40:13 -04:00
rxrpc
scsi Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2016-08-04 20:04:37 -04:00
soc ARM: SoC driver updates for v4.8 2016-08-01 18:36:01 -04:00
sound Merge tag 'drm-for-v4.8' of git://people.freedesktop.org/~airlied/linux 2016-08-01 21:44:08 -04:00
target target: Fix ordered task CHECK_CONDITION early exception handling 2016-07-20 00:58:40 -07:00
trace Luiz Capitulino noticed that the tick_stop tracepoint wasn't being parsed 2016-08-09 10:34:09 -07:00
uapi include/uapi/linux/ipx.h: fix conflicting defitions with glibc netipx/ipx.h 2016-08-22 16:25:15 -07:00
video gpu: ipu-v3: ipu-dmfc: Use static DMFC FIFO allocation mechanism 2016-07-12 18:23:43 +02:00
xen xen: change the type of xen_vcpu_id to uint32_t 2016-08-24 18:17:27 +01:00
Kbuild