github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 17:13:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
fb6988b83b
linux/lib
History
Florian Schmaus fb6988b83b kunit: fix use-after-free in debugfs when using kunit.filter 
When the kernel is booted with a kunit filter (e.g.,
kunit.filter="speed!=slow"), the kunit executor dynamically allocates
copies of the filtered test suites using kmalloc/kmemdup.

During the initial boot execution, kunit_debugfs_create_suite() creates
debugfs files (such as /sys/kernel/debug/kunit/<suite>/run) and
permanently stores a pointer to the dynamically allocated suite in the
inode's i_private field.

Previously, the executor freed this dynamically allocated suite_set
immediately after executing the boot-time tests. Because the debugfs
nodes were not destroyed, any subsequent interaction with the debugfs
`run` file from userspace triggered a use-after-free (UAF). On systems
with architectural capabilities, like CHERI RISC-V, this resulted in
an immediate fatal hardware exception due to the invalidation of the
capability tags on the reclaimed memory. On other architectures, it
resulted in silent memory corruption.

Fix this UAF by properly coupling the lifetime of the filtered suite
memory allocation to the lifetime of the kunit subsystem and its
associated VFS nodes. Ownership of the boot-time suite_set is now
transferred to a global tracker ('kunit_boot_suites'), and the memory
is cleanly released in kunit_exit() during module teardown.

Link: https://lore.kernel.org/r/20260507084854.233984-1-florian.schmaus@codasip.com
Fixes: e2219db280 ("kunit: add debugfs /sys/kernel/debug/kunit/<suite>/results display")
Signed-off-by: Florian Schmaus <florian.schmaus@codasip.com>
Reviewed-by: Martin Kaiser <martin@kaiser.cx>
Reviewed-by: David Gow <david@davidgow.net>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-05-21 10:45:49 -06:00
..
842 lib: 842: Improve error handling in sw842_compress() 2025-02-09 18:08:11 +08:00
crc LoongArch changes for v7.1 2026-04-24 09:54:45 -07:00
crypto Crypto library fix and documentation update for 7.1 2026-04-21 11:46:22 -07:00
dim Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fonts lib/fonts: Implement font rotation 2026-04-07 17:38:07 +02:00
kunit kunit: fix use-after-free in debugfs when using kunit.filter 2026-05-21 10:45:49 -06:00
lz4 include/linux/lz4.h: add some missing macros 2025-01-24 22:47:28 -08:00
lzo lib/lzo: add unlikely hints to overrun checks 2025-08-16 17:24:31 +08:00
math mm.git review status for linus..mm-nonmm-stable 2026-04-16 20:11:56 -07:00
pldmfw Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
raid xor: add a kunit test case 2026-04-02 23:36:22 -07:00
raid6 First set of RISC-V updates for v6.19-rc1 2025-12-05 16:26:57 -08:00
reed_solomon Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_fortify fortify: Cleanup temp file also on non-successful exit 2026-01-14 19:49:55 -08:00
tests RISC-V updates for v7.1 2026-04-24 10:00:37 -07:00
vdso mm: rename zap_vma_pages() to zap_vma() 2026-04-05 13:53:14 -07:00
xz Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
zlib_deflate lib/zlib: drop EQUAL macro 2025-03-16 22:30:49 -07:00
zlib_dfltcc
zlib_inflate Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
zstd Update zstd to the latest upstream release v1.5.7. Imported cleanly from the 2025-03-26 21:35:28 -07:00
.gitignore fortify: refactor test_fortify Makefile to fix some build problems 2024-08-15 09:26:02 -07:00
alloc_tag.c mm/alloc_tag: clear codetag for pages allocated before page_ext initialization 2026-04-18 00:10:50 -07:00
argv_split.c
ashldi3.c
ashrdi3.c
asn1_decoder.c ASN.1: add module description 2025-04-11 17:32:37 -07:00
asn1_encoder.c
assoc_array.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
atomic64_test.c x86/cpufeatures: Rename X86_CMPXCHG64 to X86_CX8 2025-02-28 11:42:34 +01:00
atomic64.c atomic64: Use arch_spin_locks instead of raw_spin_locks 2025-01-22 15:07:01 -05:00
audit.c audit: fix coding style issues 2026-03-05 22:16:08 -05:00
base64.c lib/base64: rework encode/decode for speed and stricter validation 2025-11-20 14:03:44 -08:00
bcd.c lib/bcd: optimize _bin2bcd() for improved performance 2024-09-01 20:43:33 -07:00
bch.c lib/bch: fix signed shift overflow in build_mod8_tables 2026-03-27 21:19:48 -07:00
bitmap-str.c
bitmap.c bitmap: introduce bitmap_weighted_xor() 2026-04-01 20:03:07 -04:00
bitrev.c
bootconfig-data.S
bootconfig.c memblock: updates for 7.0-rc1 2026-04-18 11:29:14 -07:00
bsearch.c
btree.c btree: simplify merge logic by using btree_last() return value 2025-09-13 17:32:53 -07:00
bucket_locks.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
bug.c mm.git review status for linus..mm-nonmm-stable 2026-04-16 20:11:56 -07:00
build_OID_registry oid_registry: allow arbitrary size OIDs 2026-01-20 19:44:15 -08:00
buildid.c procfs: avoid fetching build ID while holding VMA lock 2026-02-05 14:10:00 -08:00
bust_spinlocks.c
cache_maint.c lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION 2025-11-21 18:42:01 +00:00
check_signature.c
checksum.c net: checksum: Move from32to16() to generic header 2024-10-30 15:29:59 +01:00
closure.c closures: use seq_putc() in debug_show() 2024-09-01 20:43:29 -07:00
clz_ctz.c bitops: Add __attribute_const__ to generic ffs()-family implementations 2025-09-08 14:58:50 -07:00
clz_tab.c
cmdline.c
cmpdi2.c
cmpxchg-emu.c
codetag.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_audit.c
cpu_rmap.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cpumask.c cpumask: drop cpumask_next_wrap_old() 2025-02-24 16:37:23 -05:00
ctype.c
debug_info.c
debug_locks.c
debugobjects.c debugobjects: Drop likely() around !IS_ERR_OR_NULL() 2026-03-25 18:07:39 +01:00
dec_and_lock.c compiler-context-analysis: Remove __cond_lock() function-like helper 2026-01-05 16:43:33 +01:00
decompress_bunzip2.c lib: decompress_bunzip2: fix 32-bit shift undefined behavior 2026-03-27 21:19:43 -07:00
decompress_inflate.c
decompress_unlz4.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
decompress_unlzma.c minmax: make generic MIN() and MAX() macros available everywhere 2024-07-28 15:49:18 -07:00
decompress_unlzo.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
decompress_unxz.c xz: fix arm fdt compile error for kmalloc replacement 2026-02-22 12:05:31 -08:00
decompress_unzstd.c
decompress.c lib/decompress: use designated initializers for struct compress_format 2025-09-22 20:10:58 -07:00
devmem_is_allowed.c
devres.c devres: Export devm_ioremap_resource_wc() 2025-05-05 16:18:09 -05:00
dhry_1.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
dhry_2.c
dhry_run.c
dhry.h
digsig.c integrity-v6.18 2025-10-05 10:48:33 -07:00
dump_stack.c panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() 2025-09-13 17:32:52 -07:00
dynamic_debug.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dynamic_queue_limits.c dql: Fix dql->limit value when reset. 2025-03-25 06:26:55 -07:00
earlycpio.c
errname.c
error-inject.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
errseq.c errseq: eliminate special limitation for macro MAX_ERRNO 2025-05-11 17:54:06 -07:00
extable.c
fault-inject-usercopy.c lib/fault-inject-usercopy.c: use PTR_ERR_OR_ZERO() to simplify code 2025-09-13 17:32:46 -07:00
fault-inject.c fault-inject: use prandom where cryptographically secure randomness is not needed 2025-01-12 20:21:00 -08:00
fdt_addresses.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
fdt.c
find_bit_benchmark_rust.rs rust: add find_bit_benchmark_rust module. 2025-09-22 15:52:44 -04:00
find_bit_benchmark.c lib/find_bit_benchmark: avoid clearing randomly filled bitmap in test_find_first_bit() 2026-03-23 13:33:51 -04:00
find_bit.c bitmap: drop __find_nth_andnot_bit() 2026-03-23 13:33:51 -04:00
flex_proportions.c flex_proportions: make fprop_new_period() hardirq safe 2026-01-26 19:03:46 -08:00
fw_table.c
genalloc.c lib/genalloc: fix device leak in of_gen_pool_get() 2025-09-28 11:36:13 -07:00
generic-radix-tree.c lib/generic-radix-tree.c: add preallocation 2024-09-09 09:41:47 -04:00
glob.c lib/glob: initialize back_str to silence uninitialized variable warning 2026-03-27 21:19:45 -07:00
group_cpus.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hexdump.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
hweight.c bitops: Update kernel-doc in hweight.c to fix the issues with it 2025-11-06 11:51:04 -05:00
idr.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
inflate.c lib/inflate: fix typo "This results" to "The results" in comment 2026-03-27 21:19:42 -07:00
interval_tree_test.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
interval_tree.c interval_tree: Fix ITSTATIC usage for *_subtree_search() 2025-10-14 14:45:22 -07:00
iomap_copy.c
iomap.c asm-generic/io.h: rework split ioread64/iowrite64 helpers 2025-03-01 21:00:22 +01:00
iomem_copy.c lib/iomem_copy: fix kerneldoc format style 2024-10-29 07:14:29 +00:00
iommu-helper.c
iov_iter.c Merge branch 'nocache-cleanup' 2026-04-13 08:39:51 -07:00
irq_poll.c softirq: Remove unused 'action' parameter from action callback 2024-08-20 17:13:40 +02:00
irq_regs.c
is_single_threaded.c
kasprintf.c
Kconfig xor: move to lib/raid/ 2026-04-02 23:36:16 -07:00
Kconfig.debug RISC-V updates for v7.1 2026-04-24 10:00:37 -07:00
Kconfig.kasan kasan: introduce ARCH_DEFER_KASAN and unify static key across modes 2025-09-21 14:21:58 -07:00
Kconfig.kcsan objtool: Drop noinstr hack for KCSAN_WEAK_MEMORY 2025-08-28 16:58:46 -07:00
Kconfig.kfence
Kconfig.kgdb Documentation: move dev-tools debugging files to process/debugging/ 2024-12-17 13:46:53 -07:00
Kconfig.kmsan KMSAN: Restore dynamic check for '-fsanitize=kernel-memory' 2025-10-27 16:22:02 -07:00
Kconfig.ubsan Kconfig.ubsan: Remove CONFIG_UBSAN_REPORT_FULL from documentation 2026-01-07 12:16:03 -08:00
kfifo.c kfifo: fix kmalloc_array_node() argument order 2026-01-26 19:07:09 -08:00
klist.c
kobject_uevent.c kernfs: pass struct ns_common instead of const void * for namespace tags 2026-04-09 14:36:52 +02:00
kobject.c kernfs: pass struct ns_common instead of const void * for namespace tags 2026-04-09 14:36:52 +02:00
kstrtox.c lib/kstrtox: fix kstrtobool() docstring to mention enabled/disabled 2026-01-26 19:07:10 -08:00
kstrtox.h
linear_ranges.c lib/linear_ranges: Add linear_range_get_selector_high_array 2026-03-30 16:58:33 +02:00
list_debug.c lib/list_debug.c: add object information in case of invalid object 2025-01-25 20:22:23 -08:00
list_sort.c lib/list_sort: remove dummy cmp() calls to speed up merge_final() 2026-04-02 23:36:22 -07:00
llist.c llist: make llist_add_batch() a static inline 2025-05-27 19:40:34 -07:00
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-rtmutex.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c treewide: Remove in_irq() 2025-10-24 21:39:27 +02:00
lockref.c compiler-context-analysis: Remove __cond_lock() function-like helper 2026-01-05 16:43:33 +01:00
logic_iomem.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
logic_pio.c logic_pio: Constify fwnode_handle 2024-10-14 16:33:24 -05:00
lru_cache.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
lshrdi3.c
lwq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
Makefile mm.git review status for linus..mm-nonmm-stable 2026-04-16 20:11:56 -07:00
maple_tree.c maple_tree: clean up mas_wr_node_store() 2026-04-05 13:52:57 -07:00
memcat_p.c
memory-notifier-error-inject.c
memregion.c
memweight.c
min_heap.c lib min_heap: use size_t for array size and index variables 2025-03-16 23:24:14 -07:00
muldi3.c
net_utils.c net, treewide: define and use MAC_ADDR_STR_LEN 2025-03-19 19:17:58 +01:00
netdev-notifier-error-inject.c
nlattr.c
nmi_backtrace.c
notifier-error-inject.c
notifier-error-inject.h
objagg.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
objpool.c objpool: fix the overestimation of object pooling metadata size 2026-02-12 15:45:57 -08:00
of-reconfig-notifier-error-inject.c
oid_registry.c lib/oid_registry.c: remove unused sprint_OID 2025-05-11 17:54:13 -07:00
once.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
packing_test.c lib: packing: add pack_fields() and unpack_fields() 2024-12-11 20:13:00 -08:00
packing.c lib: packing: add pack_fields() and unpack_fields() 2024-12-11 20:13:00 -08:00
parman.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
parser.c lib: parser: fix match_wildcard to correctly handle trailing stars 2026-04-02 23:36:24 -07:00
percpu_counter.c lib/percpu_counter: add missing __percpu qualifier to a cast 2024-09-01 20:43:34 -07:00
percpu_test.c percpu: add a test case for the specific 64-bit value addition 2024-11-06 20:11:14 -08:00
percpu-refcount.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
plist.c treewide: Update email address 2026-01-11 06:09:11 -10:00
pm-notifier-error-inject.c
radix-tree.c
radix-tree.h
random32.c Random number generator updates for Linux 6.13-rc1. 2024-11-19 10:43:44 -08:00
ratelimit.c lib: ratelimit: fix spelling mistake 'seperately' 2025-11-20 14:03:45 -08:00
rbtree_test.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
rbtree.c rbtree: Provide rbtree with links 2026-02-27 16:40:16 +01:00
rcuref.c rcuref: Plug slowpath race in rcuref_put() 2025-01-29 15:21:31 +01:00
ref_tracker.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
refcount.c
rhashtable.c rhashtable: Enable context analysis 2026-01-05 16:43:35 +01:00
sbitmap.c lib/sbitmap: make sbitmap_get_shallow() internal 2025-08-07 06:30:17 -06:00
scatterlist.c lib/scatterlist: fix temp buffer in extract_user_to_sg() 2026-04-02 23:36:23 -07:00
seq_buf.c
sg_pool.c
sg_split.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
siphash.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
smp_processor_id.c lib/smp_processor_id: Make migration check unconditional of SMP 2025-07-10 17:52:13 +02:00
sort.c lib/sort.c: add _nonatomic() variants with cond_resched() 2025-04-01 15:20:46 -07:00
stackdepot.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stmp_device.c
string_helpers.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
string.c string: Add load_unaligned_zeropad() code path to sized_strscpy() 2025-04-15 13:50:17 -07:00
strncpy_from_user.c lib/strn*,uaccess: Use masked_user_{read/write}_access_begin when required 2025-11-18 15:27:35 +01:00
strnlen_user.c lib/strn*,uaccess: Use masked_user_{read/write}_access_begin when required 2025-11-18 15:27:35 +01:00
sys_info.c sys_info: add a default kernel sys_info mask 2025-11-20 14:03:43 -08:00
syscall.c
test_bitmap.c bitmap: add test_zero_nbits() 2026-03-24 13:39:53 -04:00
test_bitops.c
test_bpf.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_context-analysis.c compiler: Simplify generic RELOC_HIDE() 2026-03-24 15:08:05 +01:00
test_debug_virtual.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_dynamic_debug.c
test_firmware.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_fpu_glue.c lib: fix the NULL vs IS_ERR() bug for debugfs_create_dir() 2024-09-01 20:43:40 -07:00
test_fpu_impl.c
test_fpu.h
test_free_pages.c
test_hexdump.c
test_hmm_uapi.h lib/test_hmm: add large page allocation failure testing 2025-11-24 15:08:48 -08:00
test_hmm.c lib: test_hmm: implement a device release method 2026-04-18 00:10:52 -07:00
test_ida.c ida: Add ida_find_first_range() 2025-03-25 10:18:31 -03:00
test_kho.c kho: persist blob size in KHO FDT 2026-04-18 00:10:48 -07:00
test_kmod.c lib/test_kmod: do not hardcode/depend on any filesystem 2025-05-11 17:54:09 -07:00
test_lockup.c
test_maple_tree.c maple_tree: use maple copy node for mas_wr_split() 2026-04-05 13:52:56 -07:00
test_memcat_p.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_meminit.c
test_module.c
test_objagg.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_objpool.c lib: test_objpool: Avoid direct access to hrtimer clockbase 2025-09-09 12:27:18 +02:00
test_parman.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_ref_tracker.c ref_tracker: eliminate the ref_tracker_dir name field 2025-06-19 17:02:04 -07:00
test_rhashtable.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_static_key_base.c
test_static_keys.c
test_sysctl.c sysctl: Close test ctl_headers with a for loop 2025-04-14 14:13:41 +02:00
test_ubsan.c ubsan: Fix panic from test_ubsan_out_of_bounds 2025-04-15 13:50:17 -07:00
test_vmalloc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_workqueue.c workqueue: avoid unguarded 64-bit division 2026-04-03 07:14:24 -10:00
test_xarray.c xarray: make xa_alloc_cyclic() return 0 on all success cases 2025-05-11 17:48:19 -07:00
test-kstrtox.c
textsearch.c
timerqueue.c timerqueue: Provide linked timerqueue 2026-02-27 16:40:16 +01:00
trace_readwrite.c
ts_bm.c lib/ts_bm: fix integer overflow in pattern length calculation 2026-03-27 21:19:44 -07:00
ts_fsm.c
ts_kmp.c lib/ts_kmp: fix integer overflow in pattern length calculation 2026-03-27 21:19:44 -07:00
ubsan.c ubsan: Fix incorrect hand-side used in handle 2025-08-25 06:11:06 -07:00
ubsan.h ubsan/overflow: Rework integer overflow sanitizer option to turn on everything 2025-03-07 19:58:05 -08:00
ucmpdi2.c
ucs2_string.c ucs2_string: add module description 2025-04-11 17:32:38 -07:00
union_find.c Union-Find: add a new module in kernel library 2024-07-30 13:04:36 -10:00
usercopy.c uaccess: decouple INLINE_COPY_FROM_USER and CONFIG_RUST 2025-11-12 10:00:16 -08:00
uuid.c lib/uuid: fix typo "reversion" to "revision" in comment 2026-03-27 21:19:41 -07:00
vsprintf.c Merge branch 'for-7.1-printf-kunit-build' into for-linus 2026-04-20 13:41:28 +02:00
win_minmax.c rxrpc: Generate rtt_min 2024-12-09 13:48:29 -08:00
xarray.c xarray: remove redundant __GFP_NOWARN 2025-09-13 16:54:46 -07:00
xxhash.c lib/xxhash: remove more unused xxh functions 2025-11-12 10:00:17 -08:00