linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00

No description

C 96.8%
Assembly 0.9%
Rust 0.7%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Massimiliano Pellizzer 5a68e46dfe apparmor: fix missing bounds check on DEFAULT table in verify_dfa() commit `d352873bbe` upstream. The verify_dfa() function only checks DEFAULT_TABLE bounds when the state is not differentially encoded. When the verification loop traverses the differential encoding chain, it reads k = DEFAULT_TABLE[j] and uses k as an array index without validation. A malformed DFA with DEFAULT_TABLE[j] >= state_count, therefore, causes both out-of-bounds reads and writes. [ 57.179855] ================================================================== [ 57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660 [ 57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993 [ 57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy) [ 57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 57.181563] Call Trace: [ 57.181572] <TASK> [ 57.181577] dump_stack_lvl+0x5e/0x80 [ 57.181596] print_report+0xc8/0x270 [ 57.181605] ? verify_dfa+0x59a/0x660 [ 57.181608] kasan_report+0x118/0x150 [ 57.181620] ? verify_dfa+0x59a/0x660 [ 57.181623] verify_dfa+0x59a/0x660 [ 57.181627] aa_dfa_unpack+0x1610/0x1740 [ 57.181629] ? __kmalloc_cache_noprof+0x1d0/0x470 [ 57.181640] unpack_pdb+0x86d/0x46b0 [ 57.181647] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181653] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181656] ? aa_unpack_nameX+0x1a8/0x300 [ 57.181659] aa_unpack+0x20b0/0x4c30 [ 57.181662] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181664] ? stack_depot_save_flags+0x33/0x700 [ 57.181681] ? kasan_save_track+0x4f/0x80 [ 57.181683] ? kasan_save_track+0x3e/0x80 [ 57.181686] ? __kasan_kmalloc+0x93/0xb0 [ 57.181688] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181693] ? aa_simple_write_to_buffer+0x54/0x130 [ 57.181697] ? policy_update+0x154/0x330 [ 57.181704] aa_replace_profiles+0x15a/0x1dd0 [ 57.181707] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181710] ? __kvmalloc_node_noprof+0x44a/0x780 [ 57.181712] ? aa_loaddata_alloc+0x77/0x140 [ 57.181715] ? srso_alias_return_thunk+0x5/0xfbef5 [ 57.181717] ? _copy_from_user+0x2a/0x70 [ 57.181730] policy_update+0x17a/0x330 [ 57.181733] profile_replace+0x153/0x1a0 [ 57.181735] ? rw_verify_area+0x93/0x2d0 [ 57.181740] vfs_write+0x235/0xab0 [ 57.181745] ksys_write+0xb0/0x170 [ 57.181748] do_syscall_64+0x8e/0x660 [ 57.181762] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 57.181765] RIP: 0033:0x7f6192792eb2 Remove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE entries unconditionally. Fixes: `031dcc8f4e` ("apparmor: dfa add support for state differential encoding") Reported-by: Qualys Security Advisory <qsa@qualys.com> Tested-by: Salvatore Bonaccorso <carnil@debian.org> Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Reviewed-by: Cengiz Can <cengiz.can@canonical.com> Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-03-13 17:23:29 +01:00
arch	ARM: clean up the memset64() C wrapper	2026-03-12 07:09:44 -04:00
block	block: use trylock to avoid lockdep circular dependency in sysfs	2026-03-12 07:09:59 -04:00
certs	sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3	2024-09-20 19:52:48 +03:00
crypto	crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec	2026-01-30 10:32:12 +01:00
Documentation	hwmon: (aht10) Add support for dht20	2026-03-12 07:09:46 -04:00
drivers	ata: libata-eh: Fix detection of deferred qc timeouts	2026-03-12 07:10:02 -04:00
fs	smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()	2026-03-12 07:09:56 -04:00
include	net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks	2026-03-13 17:23:28 +01:00
init	printk changes for 6.18	2025-10-04 11:13:11 -07:00
io_uring	io_uring/zcrx: fix user_ref race between scrub and refill paths	2026-03-04 07:21:33 -05:00
ipc	ipc: don't audit capability check in ipc_permissions()	2026-02-26 14:59:19 -08:00
kernel	bpf: collect only live registers in linked regs	2026-03-12 07:10:02 -04:00
lib	debugobject: Make it work with deferred page initialization - again	2026-03-12 07:09:08 -04:00
LICENSES	LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2	2025-07-24 11:15:39 +02:00
mm	mm: thp: deny THP for files on anonymous inodes	2026-03-12 07:09:41 -04:00
net	net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks	2026-03-13 17:23:28 +01:00
rust	rust: kunit: fix warning when !CONFIG_PRINTK	2026-03-12 07:09:52 -04:00
samples	samples/ftrace: Adjust LoongArch register restore order in direct calls	2026-01-08 10:17:11 +01:00
scripts	kbuild: rpm-pkg: Disable automatic requires for manual debuginfo package	2026-03-04 07:21:32 -05:00
security	apparmor: fix missing bounds check on DEFAULT table in verify_dfa()	2026-03-13 17:23:29 +01:00
sound	ASoC: fsl_xcvr: provide regmap names	2026-03-12 07:09:44 -04:00
tools	selftests/bpf: Avoid simplification of crafted bounds test	2026-03-12 07:10:03 -04:00
usr	gen_init_cpio: Ignore fsync() returning EINVAL on pipes	2025-10-07 09:53:05 -07:00
virt	KVM: Don't clobber irqfd routing type when deassigning irqfd	2026-02-11 13:41:44 +01:00
.clang-format	memblock: drop for_each_free_mem_pfn_range_in_zone_from()	2025-09-14 08:49:03 +03:00
.clippy.toml	rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration	2025-05-07 00:11:47 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.editorconfig	.editorconfig: remove trim_trailing_whitespace option	2024-06-13 16:47:52 +02:00
.get_maintainer.ignore	MAINTAINERS: remove Alyssa Rosenzweig	2025-09-18 21:17:31 +02:00
.gitattributes	.gitattributes: set diff driver for Rust source code files	2023-05-31 17:48:25 +02:00
.gitignore	.gitignore: ignore compile_commands.json globally	2025-08-12 15:53:55 -07:00
.mailmap	8 hotfixes. 4 are cc:stable, 7 are against mm/.	2025-11-26 12:38:05 -08:00
.pylintrc	tools: docs: parse-headers.py: move it from sphinx dir	2025-08-29 15:54:42 -06:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: mark ISDN subsystem as orphan	2025-10-27 17:49:45 -07:00
Kbuild	sched: Make migrate_{en,dis}able() inline	2025-09-25 09:57:16 +02:00
Kconfig	io_uring: Rename KConfig to Kconfig	2025-02-19 14:53:27 -07:00
MAINTAINERS	soc: fixes for 6.18, part 4	2025-11-28 09:57:31 -08:00
Makefile	Linux 6.18.17	2026-03-12 07:15:13 -04:00
README	README: Fix spelling	2024-03-18 03:36:32 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.