linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00

No description

C 96.8%
Assembly 0.9%
Rust 0.7%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Tengda Wu 22f935bc86 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() [ Upstream commit `39dfc971e4` ] KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth(). Call Trace: [ 97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550 [ 97.285732] [ 97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11 [ 97.287032] Hardware name: linux,dummy-virt (DT) [ 97.287815] Call trace: [ 97.288279] dump_backtrace+0xa0/0x128 [ 97.288946] show_stack+0x20/0x38 [ 97.289551] dump_stack_lvl+0x78/0xc8 [ 97.290203] print_address_description.constprop.0+0x84/0x3c8 [ 97.291159] print_report+0xb0/0x280 [ 97.291792] kasan_report+0x84/0xd0 [ 97.292421] __asan_load8+0x9c/0xc0 [ 97.293042] regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.293835] process_fetch_insn+0x770/0xa30 [ 97.294562] kprobe_trace_func+0x254/0x3b0 [ 97.295271] kprobe_dispatcher+0x98/0xe0 [ 97.295955] kprobe_breakpoint_handler+0x1b0/0x210 [ 97.296774] call_break_hook+0xc4/0x100 [ 97.297451] brk_handler+0x24/0x78 [ 97.298073] do_debug_exception+0xac/0x178 [ 97.298785] el1_dbg+0x70/0x90 [ 97.299344] el1h_64_sync_handler+0xcc/0xe8 [ 97.300066] el1h_64_sync+0x78/0x80 [ 97.300699] kernel_clone+0x0/0x500 [ 97.301331] __arm64_sys_clone+0x70/0x90 [ 97.302084] invoke_syscall+0x68/0x198 [ 97.302746] el0_svc_common.constprop.0+0x11c/0x150 [ 97.303569] do_el0_svc+0x38/0x50 [ 97.304164] el0_svc+0x44/0x1d8 [ 97.304749] el0t_64_sync_handler+0x100/0x130 [ 97.305500] el0t_64_sync+0x188/0x190 [ 97.306151] [ 97.306475] The buggy address belongs to stack of task 1.sh/2550 [ 97.307461] and is located at offset 0 in frame: [ 97.308257] __se_sys_clone+0x0/0x138 [ 97.308910] [ 97.309241] This frame has 1 object: [ 97.309873] [48, 184) 'args' [ 97.309876] [ 97.310749] The buggy address belongs to the virtual mapping at [ 97.310749] [ffff800089270000, ffff800089279000) created by: [ 97.310749] dup_task_struct+0xc0/0x2e8 [ 97.313347] [ 97.313674] The buggy address belongs to the physical page: [ 97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a [ 97.315885] flags: 0x15ffffe00000000(node=1\|zone=2\|lastcpupid=0xfffff) [ 97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000 [ 97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 97.319445] page dumped because: kasan: bad access detected [ 97.320371] [ 97.320694] Memory state around the buggy address: [ 97.321511] ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.322681] ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 [ 97.325023] ^ [ 97.325683] ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 [ 97.326856] ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 This issue seems to be related to the behavior of some gcc compilers and was also fixed on the s390 architecture before: commit `d93a855c31` ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()") As described in that commit, regs_get_kernel_stack_nth() has confirmed that `addr` is on the stack, so reading the value at `addr` should be allowed. Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case. Fixes: `0a8ea52c3e` ("arm64: Add HAVE_REGS_AND_STACK_ACCESS_API feature") Signed-off-by: Tengda Wu <wutengda@huaweicloud.com> Link: https://lore.kernel.org/r/20250604005533.1278992-1-wutengda@huaweicloud.com [will: Use 'addr' as the argument to READ_ONCE_NOCHECK()] Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2025-06-27 11:11:45 +01:00
arch	arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()	2025-06-27 11:11:45 +01:00
block	block: Clear BIO_EMULATES_ZONE_APPEND flag on BIO completion	2025-06-27 11:11:19 +01:00
certs	sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3	2024-09-20 19:52:48 +03:00
crypto	crypto: api - Redo lookup on EEXIST	2025-06-19 15:31:30 +02:00
Documentation	dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties	2025-06-27 11:11:44 +01:00
drivers	serial: sh-sci: Increment the runtime usage counter for the earlycon device	2025-06-27 11:11:45 +01:00
fs	smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()	2025-06-27 11:11:45 +01:00
include	ipv6: replace ipcm6_init calls with ipcm6_init_sk	2025-06-27 11:11:41 +01:00
init	rust: clean Rust 1.88.0's `unnecessary_transmutes` lint	2025-05-18 08:24:51 +02:00
io_uring	io_uring/sqpoll: don't put task_struct on tctx setup failure	2025-06-27 11:11:42 +01:00
ipc	ipc: fix to protect IPCS lookups using RCU	2025-06-27 11:11:22 +01:00
kernel	perf/core: Fix WARN in perf_cgroup_switch()	2025-06-27 11:11:45 +01:00
lib	pldmfw: Select CRC32 when PLDMFW is selected	2025-06-27 11:11:42 +01:00
LICENSES	LICENSES: add 0BSD license text	2024-09-01 20:43:24 -07:00
mm	mm/hugetlb: unshare page tables during VMA split, not before	2025-06-27 11:11:40 +01:00
net	net: atm: fix /proc/net/atm/lec handling	2025-06-27 11:11:44 +01:00
rust	rust: compile libcore with edition 2024 for 1.87+	2025-06-27 11:11:40 +01:00
samples	samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora	2025-05-29 11:02:01 +02:00
scripts	rust: compile libcore with edition 2024 for 1.87+	2025-06-27 11:11:40 +01:00
security	selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len	2025-06-27 11:11:38 +01:00
sound	ALSA: hda/realtek: Add quirk for Asus GU605C	2025-06-27 11:11:40 +01:00
tools	bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE	2025-06-27 11:11:40 +01:00
usr	kbuild: hdrcheck: fix cross build with clang	2025-03-13 13:02:18 +01:00
virt	KVM: Add member to struct kvm_gfn_range to indicate private/shared	2025-05-22 14:29:36 +02:00
.clang-format	clang-format: Update with v6.11-rc1's `for_each` macro list	2024-08-02 13:20:31 +02:00
.clippy.toml	rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration	2025-05-18 08:24:51 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.editorconfig	.editorconfig: remove trim_trailing_whitespace option	2024-06-13 16:47:52 +02:00
.get_maintainer.ignore	Add Jeff Kirsher to .get_maintainer.ignore	2024-03-08 11:36:54 +00:00
.gitattributes	.gitattributes: set diff driver for Rust source code files	2023-05-31 17:48:25 +02:00
.gitignore	rust: introduce `.clippy.toml`	2025-03-13 13:01:42 +01:00
.mailmap	mailmap: add entry for Thorsten Blum	2024-11-07 14:14:59 -08:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Remove self from DSA entry	2024-11-03 12:52:38 -08:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: Update Alexey Makhalov's email address	2025-05-22 14:29:46 +02:00
Makefile	Linux 6.12.34	2025-06-19 15:32:38 +02:00
README	README: Fix spelling	2024-03-18 03:36:32 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.