linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-20 17:41:09 +00:00

No description

Find a file

Letu Ren 1030659dac scsi: qedf: Fix a UAF bug in __qedf_probe() [ Upstream commit `fbfe96869b` ] In __qedf_probe(), if qedf->cdev is NULL which means qed_ops->common->probe() failed, then the program will goto label err1, and scsi_host_put() will free lport->host pointer. Because the memory qedf points to is allocated by libfc_host_alloc(), it will be freed by scsi_host_put(). However, the if statement below label err0 only checks whether qedf is NULL but doesn't check whether the memory has been freed. So a UAF bug can occur. There are two ways to reach the statements below err0. The first one is described as before, "qedf" should be set to NULL. The second one is goto "err0" directly. In the latter scenario qedf hasn't been changed and it has the initial value NULL. As a result the if statement is not reachable in any situation. The KASAN logs are as follows: [ 2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] [ 2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 2.312969] Call Trace: [ 2.312969] dump_stack_lvl+0x59/0x7b [ 2.312969] print_address_description+0x7c/0x3b0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] __kasan_report+0x160/0x1c0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] kasan_report+0x4b/0x70 [ 2.312969] ? kobject_put+0x25d/0x290 [ 2.312969] kasan_check_range+0x2ca/0x310 [ 2.312969] __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] ? selinux_kernfs_init_security+0xdc/0x5f0 [ 2.312969] ? trace_rpm_return_int_rcuidle+0x18/0x120 [ 2.312969] ? rpm_resume+0xa5c/0x16e0 [ 2.312969] ? qedf_get_generic_tlv_data+0x160/0x160 [ 2.312969] local_pci_probe+0x13c/0x1f0 [ 2.312969] pci_device_probe+0x37e/0x6c0 Link: https://lore.kernel.org/r/20211112120641.16073-1-fantasquex@gmail.com Reported-by: Zheyu Ma <zheyuma97@gmail.com> Acked-by: Saurav Kashyap <skashyap@marvell.com> Co-developed-by: Wende Tan <twd2.me@gmail.com> Signed-off-by: Wende Tan <twd2.me@gmail.com> Signed-off-by: Letu Ren <fantasquex@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-10-12 09:53:27 +02:00
arch	ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer	2022-10-12 09:53:27 +02:00
block	block: blk_queue_enter() / __bio_queue_enter() must return -EAGAIN for nowait	2022-09-23 14:15:48 +02:00
certs	certs/blacklist_hashes.c: fix const confusion in certs blacklist	2022-06-22 14:22:01 +02:00
crypto	KEYS: asymmetric: enforce SM2 signature use pkey algo	2022-08-17 14:24:28 +02:00
Documentation	ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer	2022-10-12 09:53:27 +02:00
drivers	scsi: qedf: Fix a UAF bug in __qedf_probe()	2022-10-12 09:53:27 +02:00
fs	fs: fix UAF/GPF bug in nilfs_mdt_destroy	2022-10-12 09:53:26 +02:00
include	firmware: arm_scmi: Improve checks in the info_get operations	2022-10-12 09:53:26 +02:00
init	stack: Declare {randomize_,}kstack_offset to fix Sparse warnings	2022-08-17 14:23:10 +02:00
ipc	ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()	2022-06-09 10:23:10 +02:00
kernel	swiotlb: max mapping size takes min align mask into account	2022-10-05 10:39:40 +02:00
lib	crypto: lib - remove unneeded selection of XOR_BLOCKS	2022-09-05 10:30:03 +02:00
LICENSES	LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes"	2021-07-15 06:31:24 -06:00
mm	mm: gup: fix the fast GUP race against THP collapse	2022-10-12 09:53:26 +02:00
net	xsk: Inherit need_wakeup flag for shared sockets	2022-10-12 09:53:26 +02:00
samples	samples/landlock: Format with clang-format	2022-06-09 10:23:23 +02:00
scripts	Makefile.extrawarn: Move -Wcast-function-type-strict to W=1	2022-10-12 09:53:26 +02:00
security	apparmor: Fix memleak in aa_simple_write_to_buffer()	2022-08-25 11:40:01 +02:00
sound	ASoC: tas2770: Reinit regcache on reset	2022-10-05 10:39:41 +02:00
tools	selftests: Fix the if conditions of in test_extra_filter()	2022-10-05 10:39:43 +02:00
usr	usr/include/Makefile: add linux/nfc.h to the compile-test coverage	2022-02-01 17:27:15 +01:00
virt	KVM: SEV: add cache flush to solve SEV cache incoherency issues	2022-09-23 14:15:52 +02:00
.clang-format	clang-format: Update with the latest for_each macro list	2021-05-12 23:32:39 +02:00
.cocciconfig
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	.gitignore: ignore only top-level modules.builtin	2021-05-02 00:43:35 +09:00
.mailmap	mailmap: add Andrej Shadura	2021-10-18 20:22:03 -10:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Daniel Drake to credits	2021-09-21 08:34:58 +03:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	Input: goodix - add a goodix.h header file	2022-07-12 16:34:51 +02:00
Makefile	Linux 5.15.72	2022-10-05 10:39:44 +02:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.