drm/ioctl: Fix Spectre v1 vulnerabilities

[mirror_ubuntu-bionic-kernel.git] / kernel / fork.c

diff --git a/kernel/fork.c b/kernel/fork.c
index 6f320a216e7d98f691729d1eb6fd6131e57e7108..7fcd1f86e03156bf241f69d3a3eda49bed03b4ef 100644 (file)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -220,10 +220,9 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
                if (!s)
                        continue;
 
-#ifdef CONFIG_DEBUG_KMEMLEAK
                /* Clear stale pointers from reused stack. */
                memset(s->addr, 0, THREAD_SIZE);
-#endif
+
                tsk->stack_vm_area = s;
                return s->addr;
        }
@@ -648,6 +647,14 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
                        continue;
                }
                charge = 0;
+               /*
+                * Don't duplicate many vmas if we've been oom-killed (for
+                * example)
+                */
+               if (fatal_signal_pending(current)) {
+                       retval = -EINTR;
+                       goto out;
+               }
                if (mpnt->vm_flags & VM_ACCOUNT) {
                        unsigned long len = vma_pages(mpnt);
 
@@ -681,7 +688,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
                        struct inode *inode = file_inode(file);
                        struct address_space *mapping = file->f_mapping;
 
-                       get_file(file);
+                       vma_get_file(tmp);
                        if (tmp->vm_flags & VM_DENYWRITE)
                                atomic_dec(&inode->i_writecount);
                        i_mmap_lock_write(mapping);
@@ -1676,8 +1683,6 @@ static __latent_entropy struct task_struct *copy_process(
 
        posix_cpu_timers_init(p);
 
-       p->start_time = ktime_get_ns();
-       p->real_start_time = ktime_get_boot_ns();
        p->io_context = NULL;
        p->audit_context = NULL;
        cgroup_fork(p);
@@ -1726,6 +1731,9 @@ static __latent_entropy struct task_struct *copy_process(
        p->sequential_io        = 0;
        p->sequential_io_avg    = 0;
 #endif
+#ifdef CONFIG_SECURITY
+       p->security = NULL;
+#endif
 
        /* Perform scheduler related setup. Assign this task to a CPU. */
        retval = sched_fork(clone_flags, p);
@@ -1841,6 +1849,17 @@ static __latent_entropy struct task_struct *copy_process(
        if (retval)
                goto bad_fork_free_pid;
 
+       /*
+        * From this point on we must avoid any synchronous user-space
+        * communication until we take the tasklist-lock. In particular, we do
+        * not want user-space to be able to predict the process start-time by
+        * stalling fork(2) after we recorded the start_time but before it is
+        * visible to the system.
+        */
+
+       p->start_time = ktime_get_ns();
+       p->real_start_time = ktime_get_boot_ns();
+
        /*
         * Make it visible to the rest of the system, but dont wake it up yet.
         * Need tasklist lock for parent etc handling!