I've just released Linux 2.6.20.20.
It includes a fix for CVE-2007-4573 which affects the x86_64 architecture
with a risk of local privilege escalation. All x86_64 users are encouraged
to upgrade. An old minor fix was also included to prevent users from cheating
on setrlimit(RLIMIT_CPU). This one was merged in 2.6.22-rc1.
Note to the 2.6.20.y users:
The patch rate on 2.6.22.y has significantly dropped, so it is about
time to give it a try. Those who have not tested it yet are strongly
encouraged to prepare for a migration, as there will not be many more
2.6.20.y releases.
I'll also be replying to this message with a copy of the patch between
2.6.20.19 and 2.6.20.20.
The patch and changelog will appear soon at the following locations:
ftp://ftp.all.kernel.org/pub/linux/kernel/v2.6/
ftp://ftp.all.kernel.org/pub/linux/kernel/v2.6/patch-2.6.20.20.bz2
ftp://ftp.all.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.20
Git repository:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.20.y.git
http://www.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.20.y.git
Git repository through the gitweb interface:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.20.y.git
Willy
-------
Makefile | 2 +-
arch/x86_64/ia32/ia32entry.S | 18 +++++++++++++++---
arch/x86_64/kernel/ptrace.c | 4 ----
kernel/sys.c | 19 ++++++++++---------
4 files changed, 26 insertions(+), 17 deletions(-)
Summary of changes from 2.6.20.19 to 2.6.20.20
============================================
Andi Kleen (1):
x86_64: Zero extend all registers after ptrace in 32bit entry path.
Tom Alsberg (1):
CPU time limit patch / setrlimit(RLIMIT_CPU, 0) cheat fix
Willy Tarreau (1):
Linux 2.6.20.20
diff --git a/Makefile b/Makefile
index 6bb9f2e..15b82c6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
VERSION = 2
PATCHLEVEL = 6
SUBLEVEL = 20
-EXTRAVERSION = .19
+EXTRAVERSION = .20
NAME = Homicidal Dwarf Hamster
# *DOCUMENTATION*
diff --git a/arch/x86_64/ia32/ia32entry.S b/arch/x86_64/ia32/ia32entry.S
index b4aa875..824fe53 100644
--- a/arch/x86_64/ia32/ia32entry.S
+++ b/arch/x86_64/ia32/ia32entry.S
@@ -38,6 +38,18 @@
movq %rax,R8(%rsp)
.endm
+ .macro LOAD_ARGS32 offset
+ movl \offset(%rsp),%r11d
+ movl \offset+8(%rsp),%r10d
+ movl \offset+16(%rsp),%r9d
+ movl \offset+24(%rsp),%r8d
+ movl \offset+40(%rsp),%ecx
+ movl \offset+48(%rsp),%edx
+ movl \offset+56(%rsp),%esi
+ movl \offset+64(%rsp),%edi
+ movl \offset+72(%rsp),%eax
+ .endm
+
.macro CFI_STARTPROC32 simple
CFI_STARTPROC \simple
CFI_UNDEFINED r8
@@ -152,7 +164,7 @@ sysenter_tracesys:
movq $-ENOSYS,RAX(%rsp) /* really needed? */
movq %rsp,%rdi /* &pt_regs -> arg1 */
call syscall_trace_enter
- LOAD_ARGS ARGOFFSET /* reload args from stack in case ptrace changed it */
+ LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
RESTORE_REST
movl %ebp, %ebp
/* no need to do an access_ok check here because rbp has been
@@ -255,7 +267,7 @@ cstar_tracesys:
movq $-ENOSYS,RAX(%rsp) /* really needed? */
movq %rsp,%rdi /* &pt_regs -> arg1 */
call syscall_trace_enter
- LOAD_ARGS ARGOFFSET /* reload args from stack in case ptrace changed it */
+ LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
RESTORE_REST
movl RSP-ARGOFFSET(%rsp), %r8d
/* no need to do an access_ok check here because r8 has been
@@ -333,7 +345,7 @@ ia32_tracesys:
movq $-ENOSYS,RAX(%rsp) /* really needed? */
movq %rsp,%rdi /* &pt_regs -> arg1 */
call syscall_trace_enter
- LOAD_ARGS ARGOFFSET /* reload args from stack in case ptrace changed it */
+ LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
RESTORE_REST
jmp ia32_do_syscall
END(ia32_syscall)
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c
index addc14a..e086073 100644
--- a/arch/x86_64/kernel/ptrace.c
+++ b/arch/x86_64/kernel/ptrace.c
@@ -224,10 +224,6 @@ static int putreg(struct task_struct *child,
{
unsigned long tmp;
- /* Some code in the 64bit emulation may not be 64bit clean.
- Don't take any chances. */
- if (test_tsk_thread_flag(child, TIF_IA32))
- value &= 0xffffffff;
switch (regno) {
case offsetof(struct user_regs_struct,fs):
if (value && (value & 3) != 3)
diff --git a/kernel/sys.c b/kernel/sys.c
index 6e2101d..475ddbb 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1916,6 +1916,16 @@ asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim)
if (retval)
return retval;
+ if (resource == RLIMIT_CPU && new_rlim.rlim_cur == 0) {
+ /*
+ * The caller is asking for an immediate RLIMIT_CPU
+ * expiry. But we use the zero value to mean "it was
+ * never set". So let's cheat and make it one second
+ * instead
+ */
+ new_rlim.rlim_cur = 1;
+ }
+
task_lock(current->group_leader);
*old_rlim = new_rlim;
task_unlock(current->group_leader);
@@ -1937,15 +1947,6 @@ asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim)
unsigned long rlim_cur = new_rlim.rlim_cur;
cputime_t cputime;
- if (rlim_cur == 0) {
- /*
- * The caller is asking for an immediate RLIMIT_CPU
- * expiry. But we use the zero value to mean "it was
- * never set". So let's cheat and make it one second
- * instead
- */
- rlim_cur = 1;
- }
cputime = secs_to_cputime(rlim_cur);
read_lock(&tasklist_lock);
spin_lock_irq(¤t->sighand->siglock);