Tycho Andersen 5c2a3997ae dlm: don't leak kernel pointer to userspace ... [ Upstream commit 9de30f3f7f ] In copy_result_to_user(), we first create a struct dlm_lock_result, which contains a struct dlm_lksb, the last member of which is a pointer to the lvb. Unfortunately, we copy the entire struct dlm_lksb to the result struct, which is then copied to userspace at the end of the function, leaking the contents of sb_lvbptr, which is a valid kernel pointer in some cases (indeed, later in the same function the data it points to is copied to userspace). It is an error to leak kernel pointers to userspace, as it undermines KASLR protections (see e.g. 65eea8edc3 ("floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl") for another example of this). Signed-off-by: Tycho Andersen <tycho@tycho.ws> Signed-off-by: David Teigland <teigland@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-12-01 09:17:28 +01:00
..
ast.c	dlm: Don't swamp the CPU with callbacks queued during recovery	2019-02-12 19:46:58 +01:00
ast.h
config.c	dlm: make config_item_type const	2017-10-19 16:15:22 +02:00
config.h	dlm: add log_info config option	2016-06-21 09:04:24 -05:00
debug_fs.c	dlm: Improve a size determination in table_seq_start()	2017-08-07 11:23:09 -05:00
dir.c
dir.h
dlm_internal.h	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
Kconfig
lock.c	dlm: memory leaks on error path in dlm_user_request()	2019-01-13 09:51:07 +01:00
lock.h
lockspace.c	dlm: fixed memory leaks after failed ls_remove_names allocation	2019-01-13 09:51:07 +01:00
lockspace.h
lowcomms.c	dlm: check if workqueues are NULL before flushing/destroying	2019-07-31 07:27:07 +02:00
lowcomms.h
lvb_table.h
main.c	dlm: audit and remove any unnecessary uses of module.h	2016-10-19 11:00:03 -05:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
member.c	dlm: fix invalid free	2019-12-01 09:17:27 +01:00
member.h
memory.c
memory.h
midcomms.c
midcomms.h
netlink.c	dlm for 4.10	2016-12-14 08:31:37 -08:00
plock.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
rcom.c	dlm: remove dlm_send_rcom_lookup_dump	2017-10-09 09:29:31 -05:00
rcom.h	dlm: remove dlm_send_rcom_lookup_dump	2017-10-09 09:29:31 -05:00
recover.c	DLM: retry rcom when dlm_wait_function is timed out.	2017-09-25 12:45:21 -05:00
recover.h
recoverd.c	dlm: recheck kthread_should_stop() before schedule()	2017-09-25 12:48:10 -05:00
recoverd.h
requestqueue.c
requestqueue.h
user.c	dlm: don't leak kernel pointer to userspace	2019-12-01 09:17:28 +01:00
user.h
util.c
util.h