d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Change linux get_robust_list system call to match actual linux one.

Browse Source 
The set_robust_list system call request the kernel to record the head
of the list of robust futexes owned by the calling thread. The head
argument is the list head to record.
The get_robust_list system call should return the head of the robust
list of the thread whose thread id is specified in pid argument.
The list head should be stored in the location pointed to by head
argument.

In contrast, our implemenattion of get_robust_list system call copies
the known portion of memory pointed by recorded in set_robust_list
system call pointer to the head of the robust list to the location
pointed by head argument.

So, it is possible for a local attacker to read portions of kernel
memory, which may result in a privilege escalation.

Submitted by:	mjg
Security:	SA-16:03.linux
This commit is contained in:
Gleb Smirnoff 2016-01-14 10:13:58 +00:00
parent 479795819a
commit 037f750877
4 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/amd64/linux/syscalls.master
View File

@ -461,8 +461,8 @@
272 AUE_NULL STD { int linux_unshare(void); }
273 AUE_NULL STD { int linux_set_robust_list(struct linux_robust_list_head *head, \
l_size_t len); }
274 AUE_NULL STD { int linux_get_robust_list(l_int pid, struct linux_robust_list_head *head, \
l_size_t *len); }
274 AUE_NULL STD { int linux_get_robust_list(l_int pid, \
struct linux_robust_list_head **head, l_size_t *len); }
275 AUE_NULL STD { int linux_splice(void); }
276 AUE_NULL STD { int linux_tee(void); }
277 AUE_NULL STD { int linux_sync_file_range(void); }

4
sys/amd64/linux32/syscalls.master
View File

@ -520,8 +520,8 @@
; linux 2.6.17:
311 AUE_NULL STD { int linux_set_robust_list(struct linux_robust_list_head *head, \
l_size_t len); }
312 AUE_NULL STD { int linux_get_robust_list(l_int pid, struct linux_robust_list_head *head, \
l_size_t *len); }
312 AUE_NULL STD { int linux_get_robust_list(l_int pid, \
struct linux_robust_list_head **head, l_size_t *len); }
313 AUE_NULL STD { int linux_splice(void); }
314 AUE_NULL STD { int linux_sync_file_range(void); }
315 AUE_NULL STD { int linux_tee(void); }

2
sys/compat/linux/linux_futex.c
View File

@ -1131,7 +1131,7 @@ linux_get_robust_list(struct thread *td, struct linux_get_robust_list_args *args
return (EFAULT);
}
error = copyout(head, args->head, sizeof(struct linux_robust_list_head));
error = copyout(&head, args->head, sizeof(head));
if (error) {
LIN_SDT_PROBE1(futex, linux_get_robust_list, copyout_error,
error);

4
sys/i386/linux/syscalls.master
View File

@ -528,8 +528,8 @@
; linux 2.6.17:
311 AUE_NULL STD { int linux_set_robust_list(struct linux_robust_list_head *head, \
l_size_t len); }
312 AUE_NULL STD { int linux_get_robust_list(l_int pid, struct linux_robust_list_head **head, \
l_size_t *len); }
312 AUE_NULL STD { int linux_get_robust_list(l_int pid, \
struct linux_robust_list_head **head, l_size_t *len); }
313 AUE_NULL STD { int linux_splice(void); }
314 AUE_NULL STD { int linux_sync_file_range(void); }
315 AUE_NULL STD { int linux_tee(void); }