linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00

No description

C 96.8%
Assembly 0.9%
Rust 0.7%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Maciej Fijalkowski 178e31df1f bpf: fix OOB devmap writes when deleting elements commit `ab244dd7cf` upstream. Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: error_code(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue: events_unbound bpf_map_free_deferred [ 160.773308] RIP: 0010:dev_map_free+0x77/0x170 [ 160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? __die+0x20/0x60 [ 160.884586] ? page_fault_oops+0x15a/0x450 [ 160.888746] ? search_extable+0x22/0x30 [ 160.892647] ? search_bpf_extables+0x5f/0x80 [ 160.896988] ? exc_page_fault+0xa9/0x140 [ 160.900973] ? asm_exc_page_fault+0x22/0x30 [ 160.905232] ? dev_map_free+0x77/0x170 [ 160.909043] ? dev_map_free+0x58/0x170 [ 160.912857] bpf_map_free_deferred+0x51/0x90 [ 160.917196] process_one_work+0x142/0x370 [ 160.921272] worker_thread+0x29e/0x3b0 [ 160.925082] ? rescuer_thread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthread_park+0x80/0x80 [ 160.936079] ret_from_fork+0x2d/0x50 [ 160.943396] ? kthread_park+0x80/0x80 [ 160.950803] ret_from_fork_asm+0x11/0x20 [ 160.958482] </TASK> Fixes: `546ac1ffb7` ("bpf: add devmap, a map for storing net device references") CC: stable@vger.kernel.org Reported-by: Jordy Zomer <jordyzomer@google.com> Suggested-by: Jordy Zomer <jordyzomer@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-3-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2024-12-14 20:03:30 +01:00
arch	x86/kexec: Restore GDT on return from ::preserve_context kexec	2024-12-14 20:03:30 +01:00
block	block: don't verify IO lock for freeze/unfreeze in elevator_init_mq()	2024-12-05 14:03:10 +01:00
certs	sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3	2024-09-20 19:52:48 +03:00
crypto	crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY	2024-12-05 14:01:18 +01:00
Documentation	dt-bindings: net: fec: add pps channel property	2024-12-09 10:41:11 +01:00
drivers	drm/amdgpu/hdp5.2: do a posting read when flushing HDP	2024-12-14 20:03:29 +01:00
fs	smb3.1.1: fix posix mounts to older servers	2024-12-14 20:03:26 +01:00
include	drm/dp_mst: Fix resetting msg rx state after topology removal	2024-12-14 20:03:28 +01:00
init	Compiler Attributes: disable __counted_by for clang < 19.1.3	2024-12-05 14:02:45 +01:00
io_uring	io_uring: Change res2 parameter type in io_uring_cmd_done	2024-12-14 20:03:26 +01:00
ipc	ipc: fix memleak if msg_init_ns failed in create_ipc_ns	2024-12-05 14:03:02 +01:00
kernel	bpf: fix OOB devmap writes when deleting elements	2024-12-14 20:03:30 +01:00
lib	maple_tree: refine mas_store_root() on storing NULL	2024-12-09 10:41:01 +01:00
LICENSES	LICENSES: add 0BSD license text	2024-09-01 20:43:24 -07:00
mm	Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"	2024-12-14 20:03:26 +01:00
net	tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg	2024-12-14 20:03:14 +01:00
rust	rust: block: fix formatting of `kernel::block::mq::request` module	2024-12-05 14:02:21 +01:00
samples	kfifo: don't include dma-mapping.h in kfifo.h	2024-12-05 14:03:03 +01:00
scripts	modpost: Add .irqentry.text to OTHER_SECTIONS	2024-12-14 20:03:30 +01:00
security	apparmor: test: Fix memory leak for aa_unpack_strdup()	2024-12-05 14:02:46 +01:00
sound	ALSA: hda/realtek: Add support for Samsung Galaxy Book3 360 (NP730QFG)	2024-12-14 20:03:23 +01:00
tools	selftest: hugetlb_dio: fix test naming	2024-12-14 20:03:27 +01:00
usr	initramfs: shorten cmd_initfs in usr/Makefile	2024-07-16 01:07:52 +09:00
virt	KVM: x86: switch hugepage recovery thread to vhost_task	2024-12-05 14:02:43 +01:00
.clang-format	clang-format: Update with v6.11-rc1's `for_each` macro list	2024-08-02 13:20:31 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.editorconfig	.editorconfig: remove trim_trailing_whitespace option	2024-06-13 16:47:52 +02:00
.get_maintainer.ignore	Add Jeff Kirsher to .get_maintainer.ignore	2024-03-08 11:36:54 +00:00
.gitattributes	.gitattributes: set diff driver for Rust source code files	2023-05-31 17:48:25 +02:00
.gitignore	Kbuild updates for v6.12	2024-09-24 13:02:06 -07:00
.mailmap	mailmap: add entry for Thorsten Blum	2024-11-07 14:14:59 -08:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Remove self from DSA entry	2024-11-03 12:52:38 -08:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: update location of media main tree	2024-12-05 14:02:42 +01:00
Makefile	rust: allow `clippy::needless_lifetimes`	2024-12-14 20:03:20 +01:00
README	README: Fix spelling	2024-03-18 03:36:32 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.