github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-05 06:47:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
6bbd3411ff
linux/arch/arm64/kernel
History
Tengda Wu 39dfc971e4 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() 
KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth().

Call Trace:
[   97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8
[   97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550
[   97.285732]
[   97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11
[   97.287032] Hardware name: linux,dummy-virt (DT)
[   97.287815] Call trace:
[   97.288279]  dump_backtrace+0xa0/0x128
[   97.288946]  show_stack+0x20/0x38
[   97.289551]  dump_stack_lvl+0x78/0xc8
[   97.290203]  print_address_description.constprop.0+0x84/0x3c8
[   97.291159]  print_report+0xb0/0x280
[   97.291792]  kasan_report+0x84/0xd0
[   97.292421]  __asan_load8+0x9c/0xc0
[   97.293042]  regs_get_kernel_stack_nth+0xa8/0xc8
[   97.293835]  process_fetch_insn+0x770/0xa30
[   97.294562]  kprobe_trace_func+0x254/0x3b0
[   97.295271]  kprobe_dispatcher+0x98/0xe0
[   97.295955]  kprobe_breakpoint_handler+0x1b0/0x210
[   97.296774]  call_break_hook+0xc4/0x100
[   97.297451]  brk_handler+0x24/0x78
[   97.298073]  do_debug_exception+0xac/0x178
[   97.298785]  el1_dbg+0x70/0x90
[   97.299344]  el1h_64_sync_handler+0xcc/0xe8
[   97.300066]  el1h_64_sync+0x78/0x80
[   97.300699]  kernel_clone+0x0/0x500
[   97.301331]  __arm64_sys_clone+0x70/0x90
[   97.302084]  invoke_syscall+0x68/0x198
[   97.302746]  el0_svc_common.constprop.0+0x11c/0x150
[   97.303569]  do_el0_svc+0x38/0x50
[   97.304164]  el0_svc+0x44/0x1d8
[   97.304749]  el0t_64_sync_handler+0x100/0x130
[   97.305500]  el0t_64_sync+0x188/0x190
[   97.306151]
[   97.306475] The buggy address belongs to stack of task 1.sh/2550
[   97.307461]  and is located at offset 0 in frame:
[   97.308257]  __se_sys_clone+0x0/0x138
[   97.308910]
[   97.309241] This frame has 1 object:
[   97.309873]  [48, 184) 'args'
[   97.309876]
[   97.310749] The buggy address belongs to the virtual mapping at
[   97.310749]  [ffff800089270000, ffff800089279000) created by:
[   97.310749]  dup_task_struct+0xc0/0x2e8
[   97.313347]
[   97.313674] The buggy address belongs to the physical page:
[   97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a
[   97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff)
[   97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000
[   97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   97.319445] page dumped because: kasan: bad access detected
[   97.320371]
[   97.320694] Memory state around the buggy address:
[   97.321511]  ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   97.322681]  ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00
[   97.325023]                          ^
[   97.325683]  ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3
[   97.326856]  ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00

This issue seems to be related to the behavior of some gcc compilers and
was also fixed on the s390 architecture before:

 commit d93a855c31 ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()")

As described in that commit, regs_get_kernel_stack_nth() has confirmed that
`addr` is on the stack, so reading the value at `*addr` should be allowed.
Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case.

Fixes: 0a8ea52c3e ("arm64: Add HAVE_REGS_AND_STACK_ACCESS_API feature")
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Link: https://lore.kernel.org/r/20250604005533.1278992-1-wutengda@huaweicloud.com
[will: Use '*addr' as the argument to READ_ONCE_NOCHECK()]
Signed-off-by: Will Deacon <will@kernel.org>
2025-06-12 17:28:18 +01:00
..
pi arm64 fixes for -rc1 2025-06-05 11:39:17 -07:00
probes - The series "zram: optimal post-processing target selection" from 2024-11-23 09:58:07 -08:00
vdso Updates for the VDSO infrastructure: 2025-03-25 11:30:42 -07:00
vdso32 arm64: vdso: Switch to generic storage implementation 2025-02-21 09:54:01 +01:00
.gitignore
acpi_numa.c arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE 2024-08-14 17:51:39 +01:00
acpi_parking_protocol.c arm64: smp: Remove dedicated wakeup IPI 2023-09-25 17:15:28 +01:00
acpi.c mm/ioremap: pass pgprot_t to ioremap_prot() instead of unsigned long 2025-03-16 22:06:23 -07:00
alternative.c Merge branches 'for-next/kpti', 'for-next/missing-proto-warn', 'for-next/iss2-decode', 'for-next/kselftest', 'for-next/misc', 'for-next/feat_mops', 'for-next/module-alloc', 'for-next/sysreg', 'for-next/cpucap', 'for-next/acpi', 'for-next/kdump', 'for-next/acpi-doc', 'for-next/doc' and 'for-next/tpidr2-fix', remote-tracking branch 'arm64/for-next/perf' into for-next/core 2023-06-23 18:32:20 +01:00
armv8_deprecated.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
asm-offsets.c arm64/mm: Re-organise setting up FEAT_S1PIE registers PIRE0_EL1 and PIR_EL1 2025-05-16 15:06:36 +01:00
cacheinfo.c arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array 2025-02-07 09:57:56 +00:00
compat_alignment.c arm64: Don't call NULL in do_compat_alignment_fixup() 2025-04-01 14:13:11 +01:00
cpu_errata.c Merge branch kvm-arm64/misc-6.16 into kvmarm-master/next 2025-05-23 10:59:43 +01:00
cpu_ops.c
cpu-reset.S arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text 2023-05-02 12:42:22 +01:00
cpufeature.c arm64 fixes for -rc1 2025-06-05 11:39:17 -07:00
cpuinfo.c arm64: Add override for MPAM 2025-06-02 13:49:09 +01:00
crash_dump.c vmcore: convert copy_oldmem_page() to take an iov_iter 2022-04-29 14:37:59 -07:00
debug-monitors.c Merge branch 'for-next/mops' into for-next/core 2024-11-14 12:07:28 +00:00
efi-header.S include: pe.h: Fix PE definitions 2025-05-21 16:46:37 +02:00
efi-rt-wrapper.S arm64: efi: Avoid workqueue to check whether EFI runtime is live 2023-01-16 15:27:31 +01:00
efi.c - The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox 2025-05-31 15:44:16 -07:00
elfcore.c fs: avoid mmap sem relocks when coredumping with many missing pages 2025-02-21 10:25:32 +01:00
entry-common.c Merge branch 'for-next/sme-fixes' into for-next/core 2025-05-27 12:26:43 +01:00
entry-fpsimd.S arm64/sme: Implement context switching for ZT0 2023-01-20 12:23:06 +00:00
entry-ftrace.S fgraph: Replace fgraph_ret_regs with ftrace_regs 2024-12-26 10:50:02 -05:00
entry.S arm64: stacktrace: unwind exception boundaries 2024-10-17 18:06:25 +01:00
fpsimd.c Merge branch 'for-next/sme-fixes' into for-next/core 2025-05-27 12:26:43 +01:00
ftrace.c arm64: module: Use RCU in all users of __module_text_address(). 2025-03-10 11:54:45 +01:00
head.S arm64/boot: Move init_pgdir[] and init_idmap_pgdir[] into __pi_ namespace 2025-05-16 16:05:21 +01:00
hibernate-asm.S arm64: kexec: install a copy of the linear-map 2021-10-01 13:31:00 +01:00
hibernate.c hugetlb: arm64: add mte support 2024-10-16 14:50:47 +01:00
hw_breakpoint.c perf/bpf: Remove unneeded uses_default_overflow_handler() 2024-04-12 11:49:50 +02:00
hyp-stub.S arm64: errata: Work around AmpereOne's erratum AC04_CPU_23 2025-05-19 12:46:26 +01:00
idle.c arm64: idle: Tag the arm64 idle functions as __cpuidle 2023-09-25 17:15:28 +01:00
image-vars.h arm64 fixes for -rc1 2025-06-05 11:39:17 -07:00
image.h arm64: get rid of TEXT_OFFSET 2020-09-07 15:00:52 +01:00
io.c arm64: Use new fallback IO memcpy/memset 2024-10-28 21:44:29 +00:00
irq.c arm64: irq: set the correct node for shadow call stack 2023-12-13 12:09:00 +00:00
jump_label.c asm-generic: introduce text-patching.h 2024-11-07 14:25:15 -08:00
kaslr.c arm64/mm: Remove randomization of the linear map 2025-04-29 13:21:49 +01:00
kexec_image.c kexec_file, arm64: print out debugging message if required 2023-12-20 15:02:57 -08:00
kgdb.c asm-generic: introduce text-patching.h 2024-11-07 14:25:15 -08:00
kuser32.S arm64: Update Documentation/arm references 2023-06-12 06:33:48 -06:00
machine_kexec_file.c arm64, crash: wrap crash dumping code into crash related ifdefs 2024-02-23 17:48:23 -08:00
machine_kexec.c kexec: Consolidate machine_kexec_mask_interrupts() implementation 2024-12-11 20:32:34 +01:00
Makefile arch: use always-$(KBUILD_BUILTIN) for vmlinux.lds 2025-06-07 14:38:07 +09:00
Makefile.syscalls syscalls: fix syscall macros for newfstat/newfstatat 2024-08-02 15:20:47 +02:00
module-plts.c Merge branch 'for-next/cpus_have_const_cap' into for-next/core 2023-10-26 17:10:18 +01:00
module.c arm64/scs: Fix handling of DWARF augmentation data in CIE/FDE frames 2024-11-08 16:37:55 +00:00
mte.c hugetlb: arm64: add mte support 2024-10-16 14:50:47 +01:00
paravirt.c arm64: paravirt: remove conduit check in has_pv_steal_clock 2022-11-09 18:11:56 +00:00
patching.c arm64: patching: avoid early page_to_phys() 2024-12-03 18:05:42 +00:00
pci.c arm64: PCI: Migrate ACPI related functions to pci-acpi.c 2024-08-27 15:48:34 +02:00
perf_callchain.c perf/core: Correct perf sampling with guest VMs 2024-11-14 10:40:01 +01:00
perf_regs.c perf: arm64: Add SVE vector granule register to user regs 2022-09-22 15:06:02 +01:00
pointer_auth.c arm64: move preemption disablement to prctl handlers 2021-07-28 18:33:49 +01:00
process.c arm64/gcs: Don't call gcs_free() during flush_gcs() 2025-06-12 17:18:01 +01:00
proton-pack.c arm64: proton-pack: Add new CPUs 'k' values for branch mitigation 2025-05-08 15:29:28 +01:00
psci.c arm64: psci: Ignore DENIED CPUs 2024-06-28 18:38:31 +01:00
ptrace.c arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() 2025-06-12 17:28:18 +01:00
reloc_test_core.c ARM64: reloc_test: add missing MODULE_DESCRIPTION() macro 2024-06-13 10:23:54 +01:00
reloc_test_syms.S arm64: kernel: Convert to modern annotations for assembly functions 2020-05-04 12:46:03 +01:00
relocate_kernel.S arm64: kexec: load from kimage prior to clobbering 2022-05-17 14:25:35 +01:00
return_address.c arm64: Make return_address() use arch_stack_walk() 2021-12-10 14:06:04 +00:00
rsi.c arm64: rsi: Add automatic arm-cca-guest module loading 2025-01-08 13:58:49 +00:00
sdei.c arm64: sdei: abort running SDEI handlers during crash 2023-08-04 17:35:33 +01:00
setup.c arm64: Extend pr_crit message on invalid FDT 2025-04-29 16:23:57 +01:00
signal.c arm64/fpsimd: signal: Use SMSTOP behaviour in setup_return() 2025-05-08 15:29:09 +01:00
signal32.c arm64/fpsimd: signal32: Always save+flush state early 2025-04-09 18:06:31 +01:00
sigreturn32.S arm64: rework compat syscall macros 2024-07-10 14:23:38 +02:00
sleep.S arm64: mm: Handle LVA support as a CPU feature 2024-02-16 12:42:36 +00:00
smccc-call.S arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-11-07 11:18:52 +00:00
smp_spin_table.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
smp.c arm64 updates for 6.12 2024-09-16 06:55:07 +02:00
stacktrace.c arm64: stacktrace: Don't WARN when unwinding other tasks 2024-12-12 16:23:15 +00:00
suspend.c arm64/sme: Restore SME registers on exit from suspend 2024-02-20 12:19:15 +00:00
sys_compat.c arm64: Avoid cpus_have_const_cap() for ARM64_WORKAROUND_1542419 2023-10-16 14:17:06 +01:00
sys.c arm64: generate 64-bit syscall.tbl 2024-07-10 14:23:38 +02:00
sys32.c arm64: convert unistd_32.h to syscall.tbl format 2024-07-10 14:23:38 +02:00
syscall.c arm64: convert unistd_32.h to syscall.tbl format 2024-07-10 14:23:38 +02:00
time.c arm64: Make profile_pc() use arch_stack_walk() 2021-12-10 14:06:04 +00:00
topology.c Merge branch 'for-next/smt-control' into for-next/core 2025-03-25 19:32:28 +00:00
trace-events-emulation.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
traps.c ubsan: Remove regs from report_ubsan_failure() 2025-05-07 11:21:35 +01:00
vdso-wrap.S arm64: do not descend to vdso directories twice 2021-01-20 12:18:46 +00:00
vdso.c mseal sysmap: enable arm64 2025-04-01 15:17:15 -07:00
vdso32-wrap.S arm64: do not descend to vdso directories twice 2021-01-20 12:18:46 +00:00
vmcore_info.c crash: split vmcoreinfo exporting code out from crash_core.c 2024-02-23 17:48:22 -08:00
vmlinux.lds.S ARM: 2025-05-29 08:10:01 -07:00
watchdog_hld.c arm64: enable perf events based hard lockup detector 2023-06-09 17:44:22 -07:00