From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755529AbcFGOmu (ORCPT ); Tue, 7 Jun 2016 10:42:50 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:53942 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752288AbcFGOmt (ORCPT ); Tue, 7 Jun 2016 10:42:49 -0400 Message-ID: <1465310565.3529.25.camel@decadent.org.uk> Subject: Re: [PATCH 3.14 11/23] pipe: Fix buffer offset after partially failed read From: Ben Hutchings To: Jiri Slaby , Greg Kroah-Hartman , linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org, Willy Tarreau Date: Tue, 07 Jun 2016 15:42:45 +0100 In-Reply-To: <094a36ed-163a-8ced-afd2-85bb74d21f4f@suse.cz> References: <20160605213826.938892115@linuxfoundation.org> <20160605213828.067815770@linuxfoundation.org> <094a36ed-163a-8ced-afd2-85bb74d21f4f@suse.cz> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-0eD24NKwzVUykEV9BTRn" X-Mailer: Evolution 3.20.2-2 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-0eD24NKwzVUykEV9BTRn Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 2016-06-07 at 15:50 +0200, Jiri Slaby wrote: > On 06/05/2016, 11:40 PM, Greg Kroah-Hartman wrote: > > 3.14-stable review patch.=C2=A0=C2=A0If anyone has any objections, plea= se let > > me know. > >=20 > > ------------------ > >=20 > > From: Ben Hutchings > >=20 > > commit feae3ca2e5e1a8f44aa6290255d3d9709985d0b2 upstream. >=20 > This is not a SHA of an upstream commit ;). Indeed, that's from the stable/linux-3.2.y branch. =C2=A0There is no upstream commit since the bug was never introduced there. Ben. > > Quoting the RHEL advisory: > >=20 > > > It was found that the fix for CVE-2015-1805 incorrectly kept > > > buffer > > > offset and buffer length in sync on a failed atomic read, > > > potentially > > > resulting in a pipe buffer state corruption. A local, > > > unprivileged user > > > could use this flaw to crash the system or leak kernel memory to > > > user > > > space. (CVE-2016-0774, Moderate) > >=20 > > The same flawed fix was applied to stable branches from 2.6.32.y to > > 3.14.y inclusive, and I was able to reproduce the issue on 3.2.y. > > We need to give pipe_iov_copy_to_user() a separate offset variable > > and only update the buffer offset if it succeeds. > >=20 > > References: https://rhn.redhat.com/errata/RHSA-2016-0103.html > > Signed-off-by: Ben Hutchings > > Cc: Willy Tarreau > > Signed-off-by: Greg Kroah-Hartman >=20 > thanks, --=20 Ben Hutchings When in doubt, use brute force. - Ken Thompson --=-0eD24NKwzVUykEV9BTRn Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCgAGBQJXVt1lAAoJEOe/yOyVhhEJAtcP/1zv/1fVZvEaJ1o+rmpLqWz/ w3h22jxH2T4H3NZeS8GDionhpbGSX0kGrONHFCNNd3ORgXtRPIH7BIT5s2+dq+L9 RqGPoeAsm2hNXs6wrFnWNwFDcEFpa75AjL8kwsIQkGTLTQH8favSILcecUSnBY9W 6vMju6yN+IMD6b/nexSHsmYzKh4tpCATNH/t8DWC66UEC8EHZnYUhN07Y90ZXm3o BnXrJ+XRr8D/s6shS25SOcCNxNsqZwY1suUHpzPMjTZNNo5UXOwxzgAMfCQO9oc1 6pbR5A+ZwtoMLq5rs/RG+9Q+8pJ1pJaZY1mpNGEOmUsmKdGXs81I9WHalsnNf+d6 urRoQSlkkrxYpXlRGBcZa8vDU5cbPWYZNcS2ruD8fcKu2P85rex1Fx+z+grpObKI hhlZjojYBnPD7GdmKMnrCJmTel5Ns7eXIP8ZtAWo8ja7Z+jnw7RZDaNiUWbavKWE 2CXdMENnhw/C4vCT3p6mtXHqoenhf4Dm+bxdpJglavKigG4efTvGdJmsKeBGjOtP odPRCB9ysN9dpPLUBI1QNLznnizbzxofkZV3lRzwVCKnwbwqxkIlV8P9AUfLASnB lNDA/QjGrvZu6hHblUMk0fmwWtgGa4zUTiNwhY3iGggs4AC5C+9kKm+kM7yZMm3F 7odqasRM58Ln4wtbwdZU =/gbf -----END PGP SIGNATURE----- --=-0eD24NKwzVUykEV9BTRn--