linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-29 22:02:02 +00:00

No description

Find a file

Zhang Zhengming 35ca4fb494 relayfs: fix out-of-bounds access in relay_file_read commit `43ec16f145` upstream. There is a crash in relay_file_read, as the var from point to the end of last subbuf. The oops looks something like: pc : __arch_copy_to_user+0x180/0x310 lr : relay_file_read+0x20c/0x2c8 Call trace: __arch_copy_to_user+0x180/0x310 full_proxy_read+0x68/0x98 vfs_read+0xb0/0x1d0 ksys_read+0x6c/0xf0 __arm64_sys_read+0x20/0x28 el0_svc_common.constprop.3+0x84/0x108 do_el0_svc+0x74/0x90 el0_svc+0x1c/0x28 el0_sync_handler+0x88/0xb0 el0_sync+0x148/0x180 We get the condition by analyzing the vmcore: 1). The last produced byte and last consumed byte both at the end of the last subbuf 2). A softirq calls function(e.g __blk_add_trace) to write relay buffer occurs when an program is calling relay_file_read_avail(). relay_file_read relay_file_read_avail relay_file_read_consume(buf, 0, 0); //interrupted by softirq who will write subbuf .... return 1; //read_start point to the end of the last subbuf read_start = relay_file_read_start_pos //avail is equal to subsize avail = relay_file_read_subbuf_avail //from points to an invalid memory address from = buf->start + read_start //system is crashed copy_to_user(buffer, from, avail) Link: https://lkml.kernel.org/r/20230419040203.37676-1-zhang.zhengming@h3c.com Fixes: `8d62fdebda` ("relay file read: start-pos fix") Signed-off-by: Zhang Zhengming <zhang.zhengming@h3c.com> Reviewed-by: Zhao Lei <zhao_lei1@hoperun.com> Reviewed-by: Zhou Kete <zhou.kete@h3c.com> Reviewed-by: Pengcheng Yang <yangpc@wangsu.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-05-11 23:16:51 +09:00
arch	KVM: arm64: vgic: Don't acquire its_lock before config_lock	2023-05-11 23:16:51 +09:00
block	blk-crypto: make blk_crypto_evict_key() more robust	2023-05-11 23:16:48 +09:00
certs	Kbuild updates for v6.3	2023-02-26 11:53:25 -08:00
crypto	crypto: testmgr - fix RNG performance in fuzz tests	2023-05-11 23:16:50 +09:00
Documentation	Rust fixes for v6.3	2023-04-20 12:46:18 -07:00
drivers	cpufreq: qcom-cpufreq-hw: fix double IO unmap and resource release on exit	2023-05-11 23:16:50 +09:00
fs	reiserfs: Add security prefix to xattr name in reiserfs_security_write()	2023-05-11 23:16:50 +09:00
include	tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem	2023-05-11 23:16:49 +09:00
init	gcc: disable '-Warray-bounds' for gcc-13 too	2023-04-23 09:56:20 -07:00
io_uring	io_uring-6.3-2023-04-14	2023-04-15 10:29:53 -07:00
ipc	Merge branch 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2023-02-24 19:20:07 -08:00
kernel	relayfs: fix out-of-bounds access in relay_file_read	2023-05-11 23:16:51 +09:00
lib	maple_tree: fix mas_empty_area() search	2023-04-18 14:22:13 -07:00
LICENSES	LICENSES: Add the copyleft-next-0.3.1 license	2022-11-08 15:44:01 +01:00
mm	mm/mremap: fix vm_pgoff in vma_merge() case 3	2023-05-01 08:32:26 +09:00
net	bluetooth: Perform careful capability checks in hci_sock_ioctl()	2023-05-01 08:32:25 +09:00
rust	rust: allow to use INIT_STACK_ALL_ZERO	2023-04-19 19:34:43 +02:00
samples	LoongArch changes for v6.3	2023-03-01 09:27:00 -08:00
scripts	Kbuild fixes for v6.3 (4th)	2023-04-23 08:22:25 -07:00
security	IMA: allow/fix UML builds	2023-05-11 23:16:47 +09:00
sound	ASoC: amd: ps: update the acp clock source.	2023-05-11 23:16:47 +09:00
tools	22 hotfixes.	2023-04-19 17:55:45 -07:00
usr	initramfs: Check negative timestamp to prevent broken cpio archive	2023-04-16 17:37:01 +09:00
virt	KVM: PPC: Make KVM_CAP_IRQFD_RESAMPLE platform dependent	2023-03-31 11:19:05 -04:00
.clang-format	cpumask: re-introduce constant-sized cpumask optimizations	2023-03-05 14:30:34 -08:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	get_maintainer: add Alan to .get_maintainer.ignore	2022-08-20 15:17:44 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for *.dtso files	2023-02-26 15:28:23 +09:00
.gitignore	kbuild: rpm-pkg: move source components to rpmbuild/SOURCES	2023-03-16 22:45:56 +09:00
.mailmap	Networking fixes for 6.3-rc8, including fixes from netfilter and bpf	2023-04-20 11:03:51 -07:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: Resume MPTCP co-maintainer role	2023-04-19 18:10:24 -07:00
Makefile	Linux 6.3.1	2023-05-01 08:32:26 +09:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.