linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-08 06:25:52 +02:00

Linux kernel source tree

Go to file

Vincent Whitchurch cd0c280472 ARM: 8948/1: Prevent OOB access in stacktrace [ Upstream commit `40ff1ddb55` ] The stacktrace code can read beyond the stack size, when it attempts to read pt_regs from exception frames. This can happen on normal, non-corrupt stacks. Since the unwind information in the extable is not correct for function prologues, the unwinding code can return data from the stack which is not actually the caller function address, and if in_entry_text() happens to succeed on this value, we can end up reading data from outside the task's stack when attempting to read pt_regs, since there is no bounds check. Example: [<8010e729>] (unwind_backtrace) from [<8010a9c9>] (show_stack+0x11/0x14) [<8010a9c9>] (show_stack) from [<8057d8d7>] (dump_stack+0x87/0xac) [<8057d8d7>] (dump_stack) from [<8012271d>] (tasklet_action_common.constprop.4+0xa5/0xa8) [<8012271d>] (tasklet_action_common.constprop.4) from [<80102333>] (__do_softirq+0x11b/0x31c) [<80102333>] (__do_softirq) from [<80122485>] (irq_exit+0xad/0xd8) [<80122485>] (irq_exit) from [<8015f3d7>] (__handle_domain_irq+0x47/0x84) [<8015f3d7>] (__handle_domain_irq) from [<8036a523>] (gic_handle_irq+0x43/0x78) [<8036a523>] (gic_handle_irq) from [<80101a49>] (__irq_svc+0x69/0xb4) Exception stack(0xeb491f58 to 0xeb491fa0) 1f40: 7eb14794 00000000 1f60: ffffffff 008dd32c 008dd324 ffffffff 008dd314 0000002a 801011e4 eb490000 1f80: 0000002a 7eb1478c 50c5387d eb491fa8 80101001 8023d09c 40080033 ffffffff [<80101a49>] (__irq_svc) from [<8023d09c>] (do_pipe2+0x0/0xac) [<8023d09c>] (do_pipe2) from [<ffffffff>] (0xffffffff) Exception stack(0xeb491fc8 to 0xeb492010) 1fc0: 008dd314 0000002a 00511ad8 008de4c8 7eb14790 7eb1478c 1fe0: 00511e34 7eb14774 004c8557 76f44098 60080030 7eb14794 00000000 00000000 2000: 00000001 00000000 ea846c00 ea847cc0 In this example, the stack limit is 0xeb492000, but 16 bytes outside the stack have been read. Fix it by adding bounds checks. Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-10-01 13:14:31 +02:00
arch	ARM: 8948/1: Prevent OOB access in stacktrace	2020-10-01 13:14:31 +02:00
block	block: ensure bdi->io_pages is always initialized	2020-09-12 13:40:22 +02:00
certs	export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR()	2018-08-22 23:21:44 +09:00
crypto	crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()	2020-07-09 09:37:10 +02:00
Documentation	kbuild: support LLVM=1 to switch the default tools to Clang/LLVM	2020-09-26 18:01:32 +02:00
drivers	Bluetooth: btrtl: Use kvmalloc for FW allocations	2020-10-01 13:14:31 +02:00
firmware	Fix built-in early-load Intel microcode alignment	2020-01-23 08:21:29 +01:00
fs	xfs: fix log reservation overflows when allocating large rt extents	2020-10-01 13:14:29 +02:00
include	sctp: move trace_sctp_probe_path into sctp_outq_sack	2020-10-01 13:14:30 +02:00
init	printk: queue wake_up_klogd irq_work only if per-CPU areas are ready	2020-07-22 09:32:13 +02:00
ipc	ipc/util.c: sysvipc_find_ipc() incorrectly updates position index	2020-05-20 08:18:40 +02:00
kernel	tracing: Set kernel_stack's caller size properly	2020-10-01 13:14:31 +02:00
lib	lib/string.c: implement stpcpy	2020-10-01 13:14:25 +02:00
LICENSES	LICENSES: Remove CC-BY-SA-4.0 license text	2018-10-18 11:28:50 +02:00
mm	mm: fix double page fault on arm64 if PTE_AF is cleared	2020-10-01 13:14:24 +02:00
net	sctp: move trace_sctp_probe_path into sctp_outq_sack	2020-10-01 13:14:30 +02:00
samples	samples: bpf: Fix build error	2020-06-03 08:19:31 +02:00
scripts	checkpatch: fix the usage of capture group ( ... )	2020-09-09 19:04:32 +02:00
security	selinux: allow labeling before policy is loaded	2020-10-01 13:14:23 +02:00
sound	ASoC: max98090: remove msleep in PLL unlocked workaround	2020-10-01 13:14:29 +02:00
tools	kbuild: support LLVM=1 to switch the default tools to Clang/LLVM	2020-09-26 18:01:32 +02:00
usr	initramfs: restore default compression behavior	2020-04-13 10:44:59 +02:00
virt	KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy()	2020-10-01 13:14:29 +02:00
.clang-format	clang-format: Set IndentWrappedFunctionNames false	2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore	Kbuild updates for v4.17 (2nd)	2018-04-15 17:21:30 -07:00
.mailmap	libnvdimm-for-4.19_misc	2018-08-25 18:13:10 -07:00
COPYING	COPYING: use the new text with points to the license files	2018-03-23 12:41:45 -06:00
CREDITS	9p: remove Ron Minnich from MAINTAINERS	2018-08-17 16:20:26 -07:00
Kbuild	Kbuild updates for v4.15	2017-11-17 17:45:29 -08:00
Kconfig	kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt	2018-08-02 08:06:55 +09:00
MAINTAINERS	Documentation/llvm: add documentation on building w/ Clang/LLVM	2020-09-26 18:01:31 +02:00
Makefile	Linux 4.19.148	2020-09-26 18:01:33 +02:00
README	Docs: Added a pointer to the formatted docs to README	2018-03-21 09:02:53 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.