linux-stable/arch/arc
Vineet Gupta d3b7bb5c5a ARC: entry: fix off-by-one error in syscall number validation
commit 3433adc8bd upstream.

We have NR_syscall syscalls from [0 .. NR_syscall-1].
However the check for invalid syscall number is "> NR_syscall" as
opposed to >=. This off-by-one error erronesously allows "NR_syscall"
to be treated as valid syscall causeing out-of-bounds access into
syscall-call table ensuing a crash (holes within syscall table have a
invalid-entry handler but this is beyond the array implementing the
table).

This problem showed up on v5.6 kernel when testing glibc 2.33 (v5.10
kernel capable, includng faccessat2 syscall 439). The v5.6 kernel has
NR_syscalls=439 (0 to 438). Due to the bug, 439 passed by glibc was
not handled as -ENOSYS but processed leading to a crash.

Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/48
Reported-by: Shahab Vahedi <shahab@synopsys.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-22 10:57:39 +02:00
..
boot ARC: [plat-hsdk]: Switch ethernet phy-mode to rgmii-id 2020-09-23 10:46:27 +02:00
configs arc: hsdk_defconfig: Enable CONFIG_BLK_DEV_RAM 2019-04-20 09:14:59 +02:00
include arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC 2021-01-23 15:48:42 +01:00
kernel ARC: entry: fix off-by-one error in syscall number validation 2021-05-22 10:57:39 +02:00
lib ARCv2: lib: memcpy: fix doing prefetchw outside of buffer 2019-03-23 14:35:16 +01:00
mm ARC: fix build warnings 2019-06-25 11:36:51 +08:00
oprofile
plat-axs10x
plat-eznps irqchip/eznps: Fix build error for !ARC700 builds 2020-09-23 10:46:27 +02:00
plat-hsdk arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER 2020-10-29 09:07:09 +01:00
plat-sim
plat-tb10x
Kbuild
Kconfig ARCv2: support manual regfile save on interrupts 2019-03-23 14:35:16 +01:00
Kconfig.debug
Makefile ARC: build: add boot_targets to PHONY 2021-01-23 15:48:41 +01:00