mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
735,357 Commits 103 Branches 5,007 Tags 5.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Go to file
Wang Hai b43cf5ad52 kobject: Fix slab-out-of-bounds in fill_kobj_path() 
commit 3bb2a01caa upstream.

In kobject_get_path(), if kobj->name is changed between calls
get_kobj_path_length() and fill_kobj_path() and the length becomes
longer, then fill_kobj_path() will have an out-of-bounds bug.

The actual current problem occurs when the ixgbe probe.

In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name
length becomes longer, out-of-bounds will occur.

cpu0                                         cpu1
ixgbe_probe
 register_netdev(netdev)
  netdev_register_kobject
   device_add
    kobject_uevent // Sending ADD events
                                             systemd-udevd // rename netdev
                                              dev_change_name
                                               device_rename
                                                kobject_rename
 ixgbe_mii_bus_init                             |
  mdiobus_register                              |
   __mdiobus_register                           |
    device_register                             |
     device_add                                 |
      kobject_uevent                            |
       kobject_get_path                         |
        len = get_kobj_path_length // old name  |
        path = kzalloc(len, gfp_mask);          |
                                                kobj->name = name;
                                                /* name length becomes
                                                 * longer
                                                 */
        fill_kobj_path /* kobj path length is
                        * longer than path,
                        * resulting in out of
                        * bounds when filling path
                        */

This is the kasan report:

==================================================================
BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0
Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673

 Workqueue: events work_for_cpu_fn
 Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x48
 print_address_description.constprop.0+0x86/0x1e7
 print_report+0x36/0x4f
 kasan_report+0xad/0x130
 kasan_check_range+0x35/0x1c0
 memcpy+0x39/0x60
 fill_kobj_path+0x50/0xc0
 kobject_get_path+0x5a/0xc0
 kobject_uevent_env+0x140/0x460
 device_add+0x5c7/0x910
 __mdiobus_register+0x14e/0x490
 ixgbe_probe.cold+0x441/0x574 [ixgbe]
 local_pci_probe+0x78/0xc0
 work_for_cpu_fn+0x26/0x40
 process_one_work+0x3b6/0x6a0
 worker_thread+0x368/0x520
 kthread+0x165/0x1a0
 ret_from_fork+0x1f/0x30

This reproducer triggers that bug:

while:
do
    rmmod ixgbe
    sleep 0.5
    modprobe ixgbe
    sleep 0.5

When calling fill_kobj_path() to fill path, if the name length of
kobj becomes longer, return failure and retry. This fixes the problem.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2023-11-08 11:21:07 +01:00
Documentation Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group 2023-08-11 11:33:53 +02:00
arch ARM: 8933/1: replace Sun/Solaris style flag on section directive 2023-11-08 11:21:06 +01:00
block block: bio-integrity: Copy flags when bio_integrity_payload is cloned 2023-03-11 16:26:35 +01:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-25 11:46:44 +02:00
crypto X.509: if signature is unsupported skip validation 2023-09-23 10:47:01 +02:00
drivers drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() 2023-11-08 11:21:07 +01:00
firmware Fix built-in early-load Intel microcode alignment 2020-01-23 08:20:30 +01:00
fs NFS: Don't call generic_error_remove_page() while holding locks 2023-11-08 11:21:06 +01:00
include gtp: uapi: fix GTPA_MAX 2023-11-08 11:21:06 +01:00
init init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() 2023-08-08 19:48:24 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:16:33 +01:00
kernel perf/core: Fix potential NULL deref 2023-11-08 11:21:06 +01:00
lib kobject: Fix slab-out-of-bounds in fill_kobj_path() 2023-11-08 11:21:07 +01:00
mm treewide: Remove uninitialized_var() usage 2023-08-11 11:33:32 +02:00
net tcp: fix wrong RTO timeout when received SACK reneging 2023-11-08 11:21:06 +01:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-26 11:40:31 +01:00
scripts modpost: add missing else to the "of" check 2023-10-10 21:43:41 +02:00
security smackfs: Prevent underflow in smk_set_cipso() 2023-09-23 10:46:56 +02:00
sound ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl 2023-09-23 10:46:59 +02:00
tools cpupower: add Makefile dependencies for install targets 2023-10-10 21:43:41 +02:00
usr initramfs: restore default compression behavior 2020-04-13 10:34:19 +02:00
virt KVM: arm64: vgic: Fix exit condition in scan_its_table() 2022-11-03 23:50:50 +09:00
.cocciconfig
…
.get_maintainer.ignore
…
.gitattributes
…
.gitignore kbuild: rpm-pkg: keep spec file until make mrproper 2018-02-13 10:19:46 +01:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING
…
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS Remove DECnet support from kernel 2023-06-21 15:38:58 +02:00
Makefile Linux 4.14.328 2023-10-25 11:13:33 +02:00
README
…

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.