Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <YE53QiJuxsCUeoiu@localhost.localdomain>
In-Reply-To: <YE53QiJuxsCUeoiu@localhost.localdomain>
From:   Linus Torvalds <torvalds@linuxfoundation.org>
Date:   Sun, 14 Mar 2021 14:40:05 -0700
Message-ID: <CAHk-=wgMm=PG3uxfpmYpkX-GaDAR09pej=t3nD6hHDNCYCyaRQ@mail.gmail.com>
Subject: Re: [PATCH] prctl: fix PR_SET_MM_AUXV kernel stack leak
To:     Alexey Dobriyan <adobriyan@gmail.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        gorcunov@openvz.org, Security Officers <security@kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Applied directly, since I'm just about to tag rc3 and was just looking
that there were no last-minute pull requests.

Andrew, no need to pick it up into your queue.

Side note: I think we should return -EINVAL more aggressively: right
now we fill up potentially all of user_auxv[] and return success, but
we will have always cleared that last auxv pointer pair.

So we actually return "success" even when the user supplies us with
more data than we then really accept.

IOW, tightening that up might be worth it (maybe actually check that
they are valid user pointers at the same time).

That's a separate issue, and I can't find it in myself to care (and
nobody has ever complained), but I thought I'd mention it.

                 Linus