linux-kernel - [PATCH -next 0/2] ipc/shm: shmat() fixes around nil-page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180503203243.15045-1-dave@stgolabs.net>
Date:   Thu,  3 May 2018 13:32:41 -0700
From:   Davidlohr Bueso <dave@...olabs.net>
To:     akpm@...ux-foundation.org, aarcange@...hat.com
Cc:     joe.lawrence@...hat.com, gareth.evans@...textis.co.uk,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        dave@...olabs.net, stable@...nel.org
Subject: [PATCH -next 0/2] ipc/shm: shmat() fixes around nil-page

Hi,

These patches fix two issues reported[1] a while back by Joe and Andrea
around how shmat(2) behaves with nil-page.

The first reverts a commit that it was incorrectly thought that mapping
nil-page (address=0) was a no no with MAP_FIXED. This is not the case,
with the exception of SHM_REMAP; which is address in the second patch.

I chose two patches because it is easier to backport and it explicitly
reverts bogus behaviour. Both patches ought to be in -stable and ltp
testcases need updated (the added testcase around the cve can be modified
to just test for SHM_RND|SHM_REMAP).

[1] lkml.kernel.org/r/20180430172152.nfa564pvgpk3ut7p@...ux-n805

Thanks! 

Davidlohr Bueso (2):
  Revert "ipc/shm: Fix shmat mmap nil-page protection"
  ipc/shm: fix shmat() nil address after round-down when remapping

 ipc/shm.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

-- 
2.13.6