linux-kernel - [GIT PULL] fixes for v5.2-rc8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  1 Jul 2019 18:15:03 +0200
From:   Christian Brauner <christian@...uner.io>
To:     torvalds@...ux-foundation.org
Cc:     linux-kernel@...r.kernel.org, viro@...iv.linux.org.uk,
        jannh@...gle.com
Subject: [GIT PULL] fixes for v5.2-rc8

Hi Linus,

This contains a single urgent fix for copy_process() in kernel/fork.c:

The following changes since commit 6fbc7275c7a9ba97877050335f290341a1fd8dbf:

  Linux 5.2-rc7 (2019-06-30 11:25:36 +0800)

are available in the Git repository at:

  git@...olite.kernel.org:pub/scm/linux/kernel/git/brauner/linux tags/for-linus-20190701

for you to fetch changes up to 28dd29c06d0dede4b32b2c559cff21955a830928:

  fork: return proper negative error code (2019-07-01 16:43:30 +0200)

With Al's removal of ksys_close() from cleanup paths in copy_process() a
bug was introduced. When anon_inode_getfile() failed the cleanup was
correctly performed but the error code was not propagated to callers of
copy_process() causing them to operate on a nonsensical pointer. The fix is
a simple on-liner which makes sure that a proper negative error code is
returned from copy_process().
syzkaller has also verified that the bug is not reproducible with the patch
in this branch.

Please consider pulling these changes from the signed for-linus-20190701 tag.

Thanks!
Christian

----------------------------------------------------------------
for-linus-20190701

----------------------------------------------------------------
Christian Brauner (1):
      fork: return proper negative error code

 kernel/fork.c | 1 +
 1 file changed, 1 insertion(+)