kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
No description
1,315,422 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Qiu-ji Chen 8473135f89 cdx: Fix possible UAF error in driver_override_show() 
commit 91d44c1afc upstream.

Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c

This function driver_override_show() is part of DEVICE_ATTR_RW, which
includes both driver_override_show() and driver_override_store().
These functions can be executed concurrently in sysfs.

The driver_override_store() function uses driver_set_override() to
update the driver_override value, and driver_set_override() internally
locks the device (device_lock(dev)). If driver_override_show() reads
cdx_dev->driver_override without locking, it could potentially access
a freed pointer if driver_override_store() frees the string
concurrently. This could lead to printing a kernel address, which is a
security risk since DEVICE_ATTR can be read by all users.

Additionally, a similar pattern is used in drivers/amba/bus.c, as well
as many other bus drivers, where device_lock() is taken in the show
function, and it has been working without issues.

This potential bug was detected by our experimental static analysis
tool, which analyzes locking APIs and paired functions to identify
data races and atomicity violations.

Fixes: 1f86a00c11 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
Cc: stable <stable@kernel.org>
Signed-off-by: Qiu-ji Chen <chenqiuji666@gmail.com>
Link: https://lore.kernel.org/r/20250118070833.27201-1-chenqiuji666@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-03-13 13:02:15 +01:00
arch KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn't supported by KVM 2025-03-13 13:02:14 +01:00
block block: fix conversion of GPT partition name to 7-bit 2025-03-13 13:01:58 +01:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: api - Fix boot-up self-test race 2025-02-08 09:57:28 +01:00
Documentation coredump: Only sort VMAs when core_sort_vma sysctl is set 2025-03-13 13:02:01 +01:00
drivers cdx: Fix possible UAF error in driver_override_show() 2025-03-13 13:02:15 +01:00
fs exfat: short-circuit zero-byte writes in exfat_file_write_iter 2025-03-13 13:02:08 +01:00
include net: ethtool: plumb PHY stats to PHY drivers 2025-03-13 13:02:07 +01:00
init Compiler Attributes: disable __counted_by for clang < 19.1.3 2024-12-05 14:02:45 +01:00
io_uring io_uring/net: save msg_control for compat 2025-03-07 18:25:35 +01:00
ipc ipc: fix memleak if msg_init_ns failed in create_ipc_ns 2024-12-05 14:03:02 +01:00
kernel sched/fair: Fix potential memory corruption in child_cfs_rq_on_list 2025-03-13 13:02:09 +01:00
lib rcuref: Plug slowpath race in rcuref_put() 2025-03-07 18:25:43 +01:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm mm: memory-hotplug: check folio ref count first in do_migrate_range 2025-03-13 13:02:00 +01:00
net net: ipv6: fix missing dst ref drop in ila lwtunnel 2025-03-13 13:02:09 +01:00
rust rust: map long to isize and char to u8 2025-03-13 13:02:13 +01:00
samples rust: treewide: switch to the kernel Vec type 2025-03-13 13:01:46 +01:00
scripts kbuild: rust: remove the alloc crate and GlobalAlloc 2025-03-13 13:01:47 +01:00
security ima: Reset IMA_NONACTION_RULE_FLAGS after post_setattr 2025-03-07 18:25:44 +01:00
sound ALSA: usx2y: validate nrpacks module parameter on probe 2025-03-13 13:02:05 +01:00
tools selftests/damon/damon_nr_regions: sort collected regiosn before checking with min/max boundaries 2025-03-13 13:01:57 +01:00
usr initramfs: shorten cmd_initfs in usr/Makefile 2024-07-16 01:07:52 +09:00
virt KVM: x86: switch hugepage recovery thread to vhost_task 2024-12-05 14:02:43 +01:00
.clang-format clang-format: Update with v6.11-rc1's for_each macro list 2024-08-02 13:20:31 +02:00
.clippy.toml rust: enable Clippy's check-private-items 2025-03-13 13:01:42 +01:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore Add Jeff Kirsher to .get_maintainer.ignore 2024-03-08 11:36:54 +00:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore rust: introduce .clippy.toml 2025-03-13 13:01:42 +01:00
.mailmap mailmap: add entry for Thorsten Blum 2024-11-07 14:14:59 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Remove self from DSA entry 2024-11-03 12:52:38 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS MAINTAINERS: add entry for the Rust alloc module 2025-03-13 13:01:47 +01:00
Makefile kbuild: userprogs: use correct lld when linking through clang 2025-03-13 13:02:12 +01:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.