linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-07 05:55:44 +02:00

Linux kernel source tree

Go to file

Ye Bin 8440377e1a scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() [ Upstream commit `f347c26836` ] The following issue was observed running syzkaller: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 Read of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815 CPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe4/0x14a lib/dump_stack.c:118 print_address_description+0x73/0x280 mm/kasan/report.c:253 kasan_report_error mm/kasan/report.c:352 [inline] kasan_report+0x272/0x370 mm/kasan/report.c:410 memcpy+0x1f/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831 fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021 resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772 schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429 scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835 scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896 scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034 __blk_run_queue_uncond block/blk-core.c:464 [inline] __blk_run_queue+0x1a4/0x380 block/blk-core.c:484 blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78 sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847 sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716 sg_write+0x64/0xa0 drivers/scsi/sg.c:622 __vfs_write+0xed/0x690 fs/read_write.c:485 kill_bdev:block_device:00000000e138492c vfs_write+0x184/0x4c0 fs/read_write.c:549 ksys_write+0x107/0x240 fs/read_write.c:599 do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe We get 'alen' from command its type is int. If userspace passes a large length we will get a negative 'alen'. Switch n, alen, and rlen to u32. Link: https://lore.kernel.org/r/20211013033913.2551004-3-yebin10@huawei.com Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Ye Bin <yebin10@huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-11-26 10:39:11 +01:00
arch	MIPS: sni: Fix the build	2021-11-26 10:39:10 +01:00
block	block: remove inaccurate requeue check	2021-11-18 14:03:58 +01:00
certs	certs: Trigger creation of RSA module signing key if it's not an RSA key	2021-09-15 09:50:29 +02:00
crypto	crypto: pcrypt - Delay write to padata->info	2021-11-18 14:04:12 +01:00
Documentation	fscrypt: allow 256-bit master keys with AES-256-XTS	2021-11-18 14:03:54 +01:00
drivers	scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()	2021-11-26 10:39:11 +01:00
fs	erofs: fix unsafe pagevec reuse of hooked pclusters	2021-11-21 13:46:37 +01:00
include	bus: ti-sysc: Add quirk handling for reinit on context lost	2021-11-26 10:39:08 +01:00
init	bootconfig: init: Fix memblock leak in xbc_make_cmdline()	2021-11-21 13:46:35 +01:00
ipc	ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry	2021-05-26 12:06:54 +02:00
kernel	perf/core: Avoid put_page() when GUP fails	2021-11-21 13:46:37 +01:00
lib	lib/xz: Validate the value before assigning it to an enum variable	2021-11-18 14:03:58 +01:00
LICENSES	LICENSES/deprecated: add Zlib license text	2020-09-16 14:33:49 +02:00
mm	mm, oom: do not trigger out_of_memory from the #PF	2021-11-18 14:04:30 +01:00
net	SUNRPC: Partial revert of commit `6f9f17287e`	2021-11-18 14:04:32 +01:00
samples	samples/kretprobes: Fix return value if register_kretprobe() failed	2021-11-18 14:04:11 +01:00
scripts	scripts/lld-version.sh: Rewrite based on upstream ld-version.sh	2021-11-21 13:46:37 +01:00
security	fortify: Explicitly disable Clang support	2021-11-21 13:46:35 +01:00
sound	ALSA: ISA: not for M68K	2021-11-26 10:39:10 +01:00
tools	selftests/x86/iopl: Adjust to the faked iopl CLI/STI usage	2021-11-21 13:46:37 +01:00
usr	Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-08-07 13:29:39 -07:00
virt	KVM: do not shrink halt_poll_ns below grow_start	2021-10-09 14:40:58 +02:00
.clang-format	RDMA 5.10 pull request	2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
.mailmap	mailmap: add two more addresses of Uwe Kleine-König	2020-12-06 10:19:07 -08:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Jason Cooper to CREDITS	2020-11-30 10:20:34 +01:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	f2fs: move ioctl interface definitions to separated file	2021-05-19 10:13:00 +02:00
Makefile	Linux 5.10.81	2021-11-21 13:46:37 +01:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.