linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00

No description

C 96.9%
Assembly 0.9%
Rust 0.6%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Ido Schimmel 26bef56162 devlink: Fix use-after-free after a failed reload commit `6b4db2e528` upstream. After a failed devlink reload, devlink parameters are still registered, which means user space can set and get their values. In the case of the mlxsw "acl_region_rehash_interval" parameter, these operations will trigger a use-after-free [1]. Fix this by rejecting set and get operations while in the failed state. Return the "-EOPNOTSUPP" error code which does not abort the parameters dump, but instead causes it to skip over the problematic parameter. Another possible fix is to perform these checks in the mlxsw parameter callbacks, but other drivers might be affected by the same problem and I am not aware of scenarios where these stricter checks will cause a regression. [1] mlxsw_spectrum3 0000:00:10.0: Port 125: Failed to register netdev mlxsw_spectrum3 0000:00:10.0: Failed to create ports ================================================================== BUG: KASAN: use-after-free in mlxsw_sp_acl_tcam_vregion_rehash_intrvl_get+0xbd/0xd0 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:904 Read of size 4 at addr ffff8880099dcfd8 by task kworker/u4:4/777 CPU: 1 PID: 777 Comm: kworker/u4:4 Not tainted 5.19.0-rc7-custom-126601-gfe26f28c586d #1 Hardware name: QEMU MSN4700, BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x92/0xbd lib/dump_stack.c:106 print_address_description mm/kasan/report.c:313 [inline] print_report.cold+0x5e/0x5cf mm/kasan/report.c:429 kasan_report+0xb9/0xf0 mm/kasan/report.c:491 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:306 mlxsw_sp_acl_tcam_vregion_rehash_intrvl_get+0xbd/0xd0 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:904 mlxsw_sp_acl_region_rehash_intrvl_get+0x49/0x60 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c:1106 mlxsw_sp_params_acl_region_rehash_intrvl_get+0x33/0x80 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3854 devlink_param_get net/core/devlink.c:4981 [inline] devlink_nl_param_fill+0x238/0x12d0 net/core/devlink.c:5089 devlink_param_notify+0xe5/0x230 net/core/devlink.c:5168 devlink_ns_change_notify net/core/devlink.c:4417 [inline] devlink_ns_change_notify net/core/devlink.c:4396 [inline] devlink_reload+0x15f/0x700 net/core/devlink.c:4507 devlink_pernet_pre_exit+0x112/0x1d0 net/core/devlink.c:12272 ops_pre_exit_list net/core/net_namespace.c:152 [inline] cleanup_net+0x494/0xc00 net/core/net_namespace.c:582 process_one_work+0x9fc/0x1710 kernel/workqueue.c:2289 worker_thread+0x675/0x10b0 kernel/workqueue.c:2436 kthread+0x30c/0x3d0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> The buggy address belongs to the physical page: page:ffffea0000267700 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99dc flags: 0x100000000000000(node=0\|zone=1) raw: 0100000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880099dce80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880099dcf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8880099dcf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8880099dd000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880099dd080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Fixes: `98bbf70c1c` ("mlxsw: spectrum: add "acl_region_rehash_interval" devlink param") Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2022-08-25 11:45:16 +02:00
arch	m68k: coldfire/device.c: protect FLEXCAN blocks	2022-08-25 11:45:15 +02:00
block	block: don't allow the same type rq_qos add more than once	2022-08-17 15:16:10 +02:00
certs	certs: make system keyring depend on x509 parser	2022-07-24 12:53:55 -07:00
crypto	KEYS: asymmetric: enforce SM2 signature use pkey algo	2022-08-17 15:16:17 +02:00
Documentation	Documentation: ACPI: EINJ: Fix obsolete example	2022-08-25 11:45:11 +02:00
drivers	virtio-blk: Avoid use-after-free on suspend/resume	2022-08-25 11:45:16 +02:00
fs	NFSv4/pnfs: Fix a use-after-free bug in open	2022-08-25 11:45:12 +02:00
include	SUNRPC: Don't reuse bvec on retransmission of the request	2022-08-25 11:45:15 +02:00
init	stack: Declare {randomize_,}kstack_offset to fix Sparse warnings	2022-08-17 15:14:14 +02:00
io_uring	io_uring: mem-account pbuf buckets	2022-08-17 15:16:21 +02:00
ipc	ipc: Free mq_sysctls if ipc namespace creation failed	2022-06-22 17:47:41 -05:00
kernel	bpf: Acquire map uref in .init_seq_private for hash map iterator	2022-08-25 11:45:14 +02:00
lib	crypto: lib/blake2s - reduce stack frame usage in self test	2022-08-17 15:16:19 +02:00
LICENSES	LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers	2021-12-16 14:33:10 +01:00
mm	Revert "mm: kfence: apply kmemleak_ignore_phys on early allocated pool"	2022-08-21 15:20:08 +02:00
net	devlink: Fix use-after-free after a failed reload	2022-08-25 11:45:16 +02:00
samples	sample: bpf: xdp_router_ipv4: Allow the kernel to send arp requests	2022-08-17 15:14:25 +02:00
scripts	scripts/faddr2line: Fix vmlinux detection on arm64	2022-08-17 15:16:01 +02:00
security	apparmor: Fix memleak in aa_simple_write_to_buffer()	2022-08-25 11:45:11 +02:00
sound	ASoC: qdsp6: q6apm-dai: unprepare stream if its already prepared	2022-08-25 11:45:15 +02:00
tools	bpf: Disallow bpf programs call prog_run command.	2022-08-25 11:45:13 +02:00
usr	Not a lot of material this cycle. Many singleton patches against various	2022-05-27 11:22:03 -07:00
virt	KVM: Unconditionally get a ref to /dev/kvm module when creating a VM	2022-08-25 11:45:05 +02:00
.clang-format	clang-format: Fix space after for_each macros	2022-05-20 19:27:16 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	kbuild: split the second line of .mod into .usyms	2022-05-08 03:16:59 +09:00
.mailmap	ARM: SoC fixes for 5.19, part 4	2022-07-27 09:43:07 -07:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: mark ARM/PALM TREO SUPPORT orphan	2022-07-07 15:17:00 +02:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	io_uring: move to separate directory	2022-08-17 15:14:20 +02:00
Makefile	Linux 5.19.3	2022-08-21 15:20:09 +02:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.