kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/include
History
Nicolin Chen 7caf6c4bc2 iommufd: Fix struct iommu_hwpt_pgfault init and padding 
commit e721f619e3 upstream.

The iommu_hwpt_pgfault is used to report IO page fault data to userspace,
but iommufd_fault_fops_read was never zeroing its padding. This leaks the
content of the kernel stack memory to userspace.

Also, the iommufd uAPI requires explicit padding and use of __aligned_u64
to ensure ABI compatibility's with 32 bit.

pahole result, before:
struct iommu_hwpt_pgfault {
        __u32     flags;                /*     0     4 */
        __u32     dev_id;               /*     4     4 */
        __u32     pasid;                /*     8     4 */
        __u32     grpid;                /*    12     4 */
        __u32     perm;                 /*    16     4 */

        /* XXX 4 bytes hole, try to pack */

        __u64     addr;                 /*    24     8 */
        __u32     length;               /*    32     4 */
        __u32     cookie;               /*    36     4 */

        /* size: 40, cachelines: 1, members: 8 */
        /* sum members: 36, holes: 1, sum holes: 4 */
        /* last cacheline: 40 bytes */
};

pahole result, after:
struct iommu_hwpt_pgfault {
        __u32      flags;                /*     0     4 */
        __u32      dev_id;               /*     4     4 */
        __u32      pasid;                /*     8     4 */
        __u32      grpid;                /*    12     4 */
        __u32      perm;                 /*    16     4 */
        __u32      __reserved;           /*    20     4 */
        __u64      addr __attribute__((__aligned__(8))); /*    24     8 */
        __u32      length;               /*    32     4 */
        __u32      cookie;               /*    36     4 */

        /* size: 40, cachelines: 1, members: 9 */
        /* forced alignments: 1 */
        /* last cacheline: 40 bytes */
} __attribute__((__aligned__(8)));

Fixes: c714f15860 ("iommufd: Add fault and response message definitions")
Link: https://patch.msgid.link/r/20250120195051.2450-1-nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-02-17 10:05:31 +01:00
..
acpi LoongArch: Fix warnings during S3 suspend 2025-02-08 09:57:59 +01:00
asm-generic Rename .data.once to .data..once to fix resetting WARN*_ONCE 2024-12-05 14:03:08 +01:00
clocksource x86/hyperv: Fix hv tsc page based sched_clock for hibernation 2024-12-27 14:02:15 +01:00
crypto move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
cxl cxl: Move mailbox related bits to the same context 2024-09-12 08:38:01 -07:00
drm drm/connector: add mutex to protect ELD from concurrent access 2025-02-17 10:04:46 +01:00
dt-bindings dt-bindings: clock: sunxi: Export PLL_VIDEO_2X and PLL_MIPI 2025-02-08 09:57:09 +01:00
keys KEYS: Remove unused declarations 2024-09-20 18:28:26 +03:00
kunit kunit: skb: use "gfp" variable instead of hardcoding GFP_KERNEL 2024-12-05 14:02:13 +01:00
kvm KVM: arm64: Refine PMU defines for number of counters 2024-08-16 13:09:12 +01:00
linux hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING 2025-02-17 10:05:31 +01:00
math-emu powerpc/math-emu: Remove -w build flag and fix warnings 2022-09-05 17:28:25 +10:00
media media: v4l2-core: v4l2-dv-timings: check cvt/gtf result 2024-12-05 14:02:57 +01:00
memory memory: renesas-rpc-if: Remove Runtime PM wrappers 2023-01-23 11:48:00 +01:00
misc cxl: fix typo in comment 2022-11-24 23:12:19 +11:00
net net: sched: Fix truncation of offloaded action statistics 2025-02-17 10:05:02 +01:00
pcmcia ARM: pxa/sa1100: move I/O space to PCI_IOBASE 2022-05-07 22:56:17 +02:00
ras mm/memory-failure: remove obsolete MF_MSG_DIFFERENT_COMPOUND 2024-07-12 15:52:22 -07:00
rdma RDMA/core: Implement RoCE GID port rescan and export delete function 2024-12-05 14:02:08 +01:00
rv rv: Reset per-task monitors also for idle tasks 2025-02-17 10:05:30 +01:00
scsi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
soc net: mscc: ocelot: be resilient to loss of PTP packets during transmission 2024-12-19 18:13:14 +01:00
sound ALSA: hda: Fix compilation of snd_hdac_adsp_xxx() helpers 2025-02-08 09:57:32 +01:00
target move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
trace rxrpc: Fix the rxrpc_connection attend queue handling 2025-02-17 10:05:00 +01:00
uapi iommufd: Fix struct iommu_hwpt_pgfault init and padding 2025-02-17 10:05:31 +01:00
ufs scsi: ufs: core: Fix use-after free in init error and remove paths 2025-02-17 10:05:22 +01:00
vdso random: vDSO: add a __vdso_getrandom prototype for all architectures 2024-09-13 17:28:35 +02:00
video fbdev: da8xx: remove the driver 2024-10-15 10:08:23 +02:00
xen xen: Remove dependency between pciback and privcmd 2024-10-18 11:59:04 +02:00