tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'uml-for-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux

Pull UML fixes from Johannes Berg:
"A few fixes for UML, which I'd meant to send earlier but then forgot.

All of them are pretty long-standing issues that are either not really
happening (the UAF), in rarely used code (the FD buffer issue), or an
issue only for some host configurations (the executable stack):

- mark stack not executable to work on more modern systems with
selinux

- fix use-after-free in a virtio error path

- fix stack buffer overflow in external unix socket FD receive
function"

* tag 'uml-for-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux:
um: Fix FD copy size in os_rcv_fd_msg()
um: virtio_uml: Fix use-after-free after put_device in probe
um: Don't mark stack executable

Linus Torvalds f03e578c 8b789f2b

+6 -5
+4 -2
arch/um/drivers/virtio_uml.c
··· 1250 1250 device_set_wakeup_capable(&vu_dev->vdev.dev, true); 1251 1251 1252 1252 rc = register_virtio_device(&vu_dev->vdev); 1253 - if (rc) 1253 + if (rc) { 1254 1254 put_device(&vu_dev->vdev.dev); 1255 + return rc; 1256 + } 1255 1257 vu_dev->registered = 1; 1256 - return rc; 1258 + return 0; 1257 1259 1258 1260 error_init: 1259 1261 os_close_file(vu_dev->sock);
+1 -1
arch/um/os-Linux/file.c
··· 535 535 cmsg->cmsg_type != SCM_RIGHTS) 536 536 return n; 537 537 538 - memcpy(fds, CMSG_DATA(cmsg), cmsg->cmsg_len); 538 + memcpy(fds, CMSG_DATA(cmsg), cmsg->cmsg_len - CMSG_LEN(0)); 539 539 return n; 540 540 } 541 541
+1 -2
arch/um/os-Linux/util.c
··· 20 20 21 21 void stack_protections(unsigned long address) 22 22 { 23 - if (mprotect((void *) address, UM_THREAD_SIZE, 24 - PROT_READ | PROT_WRITE | PROT_EXEC) < 0) 23 + if (mprotect((void *) address, UM_THREAD_SIZE, PROT_READ | PROT_WRITE) < 0) 25 24 panic("protecting stack failed, errno = %d", errno); 26 25 } 27 26