Linus Torvalds 197e7e5213 Sanitize 'move_pages()' permission checks ... The 'move_paghes()' system call was introduced long long ago with the same permission checks as for sending a signal (except using CAP_SYS_NICE instead of CAP_SYS_KILL for the overriding capability). That turns out to not be a great choice - while the system call really only moves physical page allocations around (and you need other capabilities to do a lot of it), you can check the return value to map out some the virtual address choices and defeat ASLR of a binary that still shares your uid. So change the access checks to the more common 'ptrace_may_access()' model instead. This tightens the access checks for the uid, and also effectively changes the CAP_SYS_NICE check to CAP_SYS_PTRACE, but it's unlikely that anybody really _uses_ this legacy system call any more (we hav ebetter NUMA placement models these days), so I expect nobody to notice. Famous last words. Reported-by: Otto Ebeling <otto.ebeling@iki.fi> Acked-by: Eric W. Biederman <ebiederm@xmission.com> Cc: Willy Tarreau <w@1wt.eu> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2017-08-20 13:26:27 -07:00
..
kasan	kasan: avoid -Wmaybe-uninitialized warning	2017-08-02 16:34:46 -07:00
backing-dev.c
balloon_compaction.c	mm/balloon_compaction.c: don't zero ballooned pages	2017-08-10 15:54:07 -07:00
bootmem.c
cleancache.c
cma.c	cma: fix calculation of aligned offset	2017-07-10 16:32:32 -07:00
cma.h
cma_debug.c	mm/cma_debug.c: fix stack corruption due to sprintf usage	2017-08-18 15:32:02 -07:00
compaction.c	mm, compaction: skip over holes in __reset_isolation_suitable	2017-07-06 16:24:32 -07:00
debug.c	mm: make tlb_flush_pending global	2017-08-10 15:54:07 -07:00
debug_page_ref.c
dmapool.c
early_ioremap.c
fadvise.c
failslab.c
filemap.c	mm: hugetlb: return immediately for hugetlb page in __delete_from_page_cache()	2017-07-10 16:32:30 -07:00
frame_vector.c
frontswap.c
gup.c	mm, gup: ensure real head page is ref-counted when using hugepages	2017-07-06 16:24:34 -07:00
highmem.c
huge_memory.c	mm, oom: fix potential data corruption when oom_reaper races with writer	2017-08-18 15:32:01 -07:00
hugetlb.c	userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case	2017-08-10 15:54:06 -07:00
hugetlb_cgroup.c
hwpoison-inject.c
init-mm.c
internal.h	mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries	2017-08-02 16:34:46 -07:00
interval_tree.c
Kconfig	mm/kasan: add support for memory hotplug	2017-07-10 16:32:33 -07:00
Kconfig.debug
khugepaged.c	mm: make PR_SET_THP_DISABLE immediately active	2017-07-10 16:32:31 -07:00
kmemcheck.c
kmemleak-test.c
kmemleak.c	mm: kmemleak: treat vm_struct as alternative reference to vmalloc'ed objects	2017-07-06 16:24:34 -07:00
ksm.c	mm: fix KSM data corruption	2017-08-10 15:54:07 -07:00
list_lru.c	mm/list_lru.c: fix list_lru_count_node() to be race free	2017-07-10 16:32:33 -07:00
maccess.c
madvise.c	mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries	2017-08-02 16:34:46 -07:00
Makefile
memblock.c	mm: discard memblock data later	2017-08-18 15:32:01 -07:00
memcontrol.c	mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()	2017-08-18 15:32:01 -07:00
memory-failure.c	mm, hugetlb, soft_offline: use new_page_nodemask for soft offline migration	2017-07-10 16:32:32 -07:00
memory.c	mm, oom: fix potential data corruption when oom_reaper races with writer	2017-08-18 15:32:01 -07:00
memory_hotplug.c	mm/memory-hotplug: switch locking to a percpu rwsem	2017-07-10 16:32:33 -07:00
mempolicy.c	mm/mempolicy: fix use after free when calling get_mempolicy	2017-08-18 15:32:02 -07:00
mempool.c
memtest.c
migrate.c	Sanitize 'move_pages()' permission checks	2017-08-20 13:26:27 -07:00
mincore.c
mlock.c
mm_init.c
mmap.c	mm: fix overflow check in expand_upwards()	2017-07-14 15:05:12 -07:00
mmu_context.c
mmu_notifier.c
mmzone.c
mprotect.c	mm: migrate: prevent racy access to tlb_flush_pending	2017-08-10 15:54:07 -07:00
mremap.c	userfaultfd: non-cooperative: notify about unmap of destination during mremap	2017-08-02 16:34:46 -07:00
msync.c
nobootmem.c	mm: discard memblock data later	2017-08-18 15:32:01 -07:00
nommu.c
oom_kill.c	mm/oom_kill.c: add tracepoints for oom reaper-related events	2017-07-10 16:32:32 -07:00
page-writeback.c	mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()	2017-08-18 15:32:01 -07:00
page_alloc.c	mm: discard memblock data later	2017-08-18 15:32:01 -07:00
page_counter.c
page_ext.c
page_idle.c
page_io.c	mm/page_io.c: fix oops during block io poll in swapin path	2017-08-02 17:16:11 -07:00
page_isolation.c	mm: unify new_node_page and alloc_migrate_target	2017-07-10 16:32:31 -07:00
page_owner.c	mm: avoid taking zone lock in pagetypeinfo_showmixed()	2017-07-10 16:32:32 -07:00
page_poison.c
page_vma_mapped.c	mm/hugetlb: add size parameter to huge_pte_offset()	2017-07-06 16:24:34 -07:00
pagewalk.c	mm/hugetlb: add size parameter to huge_pte_offset()	2017-07-06 16:24:34 -07:00
percpu-internal.h
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c
pgtable-generic.c
process_vm_access.c
quicklist.c
readahead.c
rmap.c	rmap: do not call mmu_notifier_invalidate_page() under ptl	2017-08-10 15:54:07 -07:00
rodata_test.c
shmem.c	mm: fix list corruptions on shmem shrinklist	2017-08-10 15:54:07 -07:00
slab.c	mm: memcontrol: account slab stats per lruvec	2017-07-06 16:24:35 -07:00
slab.h	mm: memcontrol: account slab stats per lruvec	2017-07-06 16:24:35 -07:00
slab_common.c	mm: allow slab_nomerge to be set at build time	2017-07-06 16:24:31 -07:00
slob.c
slub.c	slub: fix per memcg cache leak on css offline	2017-08-18 15:32:01 -07:00
sparse-vmemmap.c	mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic	2017-07-12 16:26:03 -07:00
sparse.c	mm, memory_hotplug: do not associate hotadded memory to zones until online	2017-07-06 16:24:32 -07:00
swap.c	mm: swap: provide lru_add_drain_all_cpuslocked()	2017-07-10 16:32:33 -07:00
swap_cgroup.c	mm, THP, swap: delay splitting THP during swap out	2017-07-06 16:24:31 -07:00
swap_slots.c	mm/swap_slots.c: don't disable preemption while taking the per-CPU cache	2017-07-10 16:32:32 -07:00
swap_state.c	swap: add block io poll in swapin path	2017-07-10 16:32:30 -07:00
swapfile.c	swap: add block io poll in swapin path	2017-07-10 16:32:30 -07:00
truncate.c	mm/truncate.c: fix THP handling in invalidate_mapping_pages()	2017-07-10 16:32:32 -07:00
usercopy.c
userfaultfd.c
util.c	mm: fix global NR_SLAB_.*CLAIMABLE counter reads	2017-08-10 15:54:06 -07:00
vmacache.c
vmalloc.c	mm/vmalloc.c: don't unconditonally use __GFP_HIGHMEM	2017-08-18 15:32:02 -07:00
vmpressure.c	mm, vmpressure: pass-through notification support	2017-07-10 16:32:31 -07:00
vmscan.c	mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic	2017-07-12 16:26:03 -07:00
vmstat.c	mm: avoid taking zone lock in pagetypeinfo_showmixed()	2017-07-10 16:32:32 -07:00
workingset.c	mm: memcontrol: per-lruvec stats infrastructure	2017-07-06 16:24:35 -07:00
z3fold.c
zbud.c
zpool.c
zsmalloc.c	zram: do not free pool->size_class	2017-08-02 16:34:47 -07:00
zswap.c	mm/zswap.c: delete an error message for a failed memory allocation in zswap_dstmem_prepare()	2017-07-06 16:24:35 -07:00