Commit 7eeef2ab authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'core-debug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull wchan kernel address hiding from Ingo Molnar:
 "This fixes a wchan related information leak in /proc/PID/stat.

  There's a bit of an ABI twist to it: instead of setting the wchan
  field to 0 (which is our usual technique) we set it conditionally to a
  0/1 flag to keep ABI compatibility with older procps versions that
  only fetches /proc/PID/wchan (symbolic names) if the absolute wchan
  address is nonzero"

* 'core-debug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  fs/proc, core/debug: Don't expose absolute kernel addresses via wchan
parents 6aa2fdb8 b2f73922

Documentation/filesystems/proc.txt

+3 −2
Original line number Diff line number Diff line
@@ -140,7 +140,8 @@ Table 1-1: Process specific entries in /proc 
 stat		Process status

 statm		Process memory status information

 status		Process status in human readable form

 wchan		If CONFIG_KALLSYMS is set, a pre-decoded wchan

 wchan		Present with CONFIG_KALLSYMS=y: it shows the kernel function

		symbol the task is blocked in - or "0" if not blocked.

 pagemap	Page table

 stack		Report full stack trace, enable via CONFIG_STACKTRACE

 smaps		a extension based on maps, showing the memory consumption of
@@ -310,7 +311,7 @@ Table 1-4: Contents of the stat files (as of 2.6.30-rc7) 
  blocked       bitmap of blocked signals

  sigign        bitmap of ignored signals

  sigcatch      bitmap of caught signals

  wchan         address where process went to sleep

  0		(place holder, used to be the wchan address, use /proc/PID/wchan instead)

  0             (place holder)

  0             (place holder)

  exit_signal   signal to send to parent thread on exit

fs/proc/array.c

+14 −2
Original line number Diff line number Diff line
@@ -375,7 +375,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, 
static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,

			struct pid *pid, struct task_struct *task, int whole)

{

	unsigned long vsize, eip, esp, wchan = ~0UL;

	unsigned long vsize, eip, esp, wchan = 0;

	int priority, nice;

	int tty_pgrp = -1, tty_nr = 0;

	sigset_t sigign, sigcatch;
@@ -507,7 +507,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, 
	seq_put_decimal_ull(m, ' ', task->blocked.sig[0] & 0x7fffffffUL);

	seq_put_decimal_ull(m, ' ', sigign.sig[0] & 0x7fffffffUL);

	seq_put_decimal_ull(m, ' ', sigcatch.sig[0] & 0x7fffffffUL);

	seq_put_decimal_ull(m, ' ', wchan);



	/*

	 * We used to output the absolute kernel address, but that's an

	 * information leak - so instead we show a 0/1 flag here, to signal

	 * to user-space whether there's a wchan field in /proc/PID/wchan.

	 *

	 * This works with older implementations of procps as well.

	 */

	if (wchan)

		seq_puts(m, " 1");

	else

		seq_puts(m, " 0");



	seq_put_decimal_ull(m, ' ', 0);

	seq_put_decimal_ull(m, ' ', 0);

	seq_put_decimal_ll(m, ' ', task->exit_signal);

fs/proc/base.c

+3 −6
Original line number Diff line number Diff line
@@ -430,13 +430,10 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns, 


	wchan = get_wchan(task);



	if (lookup_symbol_name(wchan, symname) < 0) {

		if (!ptrace_may_access(task, PTRACE_MODE_READ))

			return 0;

		seq_printf(m, "%lu", wchan);

	} else {

	if (wchan && ptrace_may_access(task, PTRACE_MODE_READ) && !lookup_symbol_name(wchan, symname))

		seq_printf(m, "%s", symname);

	}

	else

		seq_putc(m, '0');



	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE