kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Jens Wiklander 58c008d4d3 tee: add overflow check in register_shm_helper() 
commit 573ae4f13f upstream.

With special lengths supplied by user space, register_shm_helper() has
an integer overflow when calculating the number of pages covered by a
supplied user space memory region.

This causes internal_get_user_pages_fast() a helper function of
pin_user_pages_fast() to do a NULL pointer dereference:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
  Modules linked in:
  CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11
  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
  pc : internal_get_user_pages_fast+0x474/0xa80
  Call trace:
   internal_get_user_pages_fast+0x474/0xa80
   pin_user_pages_fast+0x24/0x4c
   register_shm_helper+0x194/0x330
   tee_shm_register_user_buf+0x78/0x120
   tee_ioctl+0xd0/0x11a0
   __arm64_sys_ioctl+0xa8/0xec
   invoke_syscall+0x48/0x114

Fix this by adding an an explicit call to access_ok() in
tee_shm_register_user_buf() to catch an invalid user space address
early.

Fixes: 033ddf12bc ("tee: add register user memory")
Cc: stable@vger.kernel.org
Reported-by: Nimish Mishra <neelam.nimish@gmail.com>
Reported-by: Anirban Chakraborty <ch.anirban00727@gmail.com>
Reported-by: Debdeep Mukhopadhyay <debdeep.mukhopadhyay@gmail.com>
Suggested-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2022-08-21 15:20:08 +02:00
..
accessibility Revert "speakup: Generate speakupmap.h automatically" 2022-05-20 21:07:05 +02:00
acpi ACPI: CPPC: Do not prevent CPPC from working in the future 2022-08-17 15:16:13 +02:00
amba ARM: 9207/1: amba: fix refcount underflow if amba_device_add() fails 2022-07-14 13:17:48 +01:00
android android: binder: stop saving a pointer to the VMA 2022-08-17 15:15:40 +02:00
ata ata: sata_mv: Fixes expected number of resources now IRQs are gone 2022-08-11 13:22:03 +02:00
atm net: atm: remove support for ZeitNet ZN122x ATM devices 2022-04-27 12:22:56 +01:00
auxdisplay auxdisplay: lcd2s: Use array size explicitly in lcd2s_gotoxy() 2022-03-18 20:31:14 +01:00
base Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm" 2022-08-17 15:16:19 +02:00
bcma bcma: gpio: Switch to use fwnode instead of of_node 2022-05-09 14:41:43 +03:00
block xen-blkfront: Apply 'feature_persistent' parameter when connect 2022-08-17 15:16:18 +02:00
bluetooth Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm" 2022-08-17 15:16:19 +02:00
bus bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() 2022-08-17 15:14:13 +02:00
cdrom cdrom: remove obsolete TODO list 2022-05-15 18:31:28 -06:00
char tpm: Add check for Failure mode for TPM2 modules 2022-08-17 15:16:17 +02:00
clk clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk 2022-08-17 15:15:35 +02:00
clocksource clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() 2022-06-08 12:27:08 +00:00
comedi comedi: vmk80xx: fix expression for tx buffer size 2022-06-10 15:21:23 +02:00
connector connector/cn_proc: Use task_is_in_init_pid_ns() 2022-01-26 18:57:09 -08:00
counter Char/Misc and other driver updates for 5.18-rc1 2022-03-28 12:27:35 -07:00
cpufreq cpufreq: mediatek: fix error return code in mtk_cpu_dvfs_info_init() 2022-08-17 15:15:52 +02:00
cpuidle Merge branches 'pm-em' and 'pm-cpuidle' 2022-05-23 19:18:51 +02:00
crypto crypto: hisilicon/sec - fix auth key size error 2022-08-17 15:14:58 +02:00
cxl cxl/mbox: Fix missing variable payload checks in cmd size validation 2022-06-28 22:03:18 -07:00
dax dax: add .recovery_write dax_operation 2022-05-16 13:37:59 -07:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: exynos-bus: Fix NULL pointer dereference 2022-07-08 04:32:26 +09:00
dio drivers: dio: add missing iounmap() in dio_init() 2022-05-19 18:56:51 +02:00
dma dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) 2022-08-17 15:15:36 +02:00
dma-buf Three mode setting fixes for fsl-ldb, a fbdev removal use-after-free fix, 2022-07-12 10:44:40 +10:00
edac EDAC/ghes: Set the DIMM label unconditionally 2022-07-27 10:42:52 +02:00
eisa EISA: use DEVICE_ATTR_RO() helper macro 2021-06-04 15:28:34 +02:00
extcon extcon: Modify extcon device to be created after driver data is set 2022-05-13 17:03:41 +09:00
firewire firewire: convert sysfs sprintf/snprintf family to sysfs_emit 2022-06-17 10:43:20 +02:00
firmware firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails 2022-08-17 15:16:07 +02:00
fpga fpga: altera-pr-ip: fix unsigned comparison with less than zero 2022-08-17 15:15:04 +02:00
fsi FSI changes for v5.18 2022-02-21 17:47:42 +01:00
gnss gnss: usb: add support for Sierra Wireless XM1210 2021-12-22 15:38:12 +01:00
gpio gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() 2022-08-17 15:15:36 +02:00
gpu Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm" 2022-08-17 15:16:19 +02:00
greybus greybus: svc: clean up link configuration hack at hello 2022-02-04 15:27:44 +01:00
hid HID: amd_sfh: Handle condition of "no sensors" 2022-08-17 15:15:38 +02:00
hsi HSI: core: Fix return freed object in hsi_new_client 2021-11-26 00:27:06 +01:00
hte hte: Uninitialized variable in hte_ts_get() 2022-05-20 15:54:41 +02:00
hv Drivers: hv: vmbus: Release cpu lock in error case 2022-06-10 08:41:28 +00:00
hwmon hwmon: (drivetemp) Add module alias 2022-08-17 15:14:17 +02:00
hwspinlock hwspinlock: sprd: Use struct_size() helper in devm_kzalloc() 2022-03-11 14:56:57 -06:00
hwtracing intel_th: pci: Add Raptor Lake-S CPU support 2022-08-17 15:16:07 +02:00
i2c i2c: mux-gpmux: Add of_node_put() when breaking out of loop 2022-08-17 15:14:55 +02:00
i3c i3c: master: svc: fix returnvar.cocci warning 2022-05-17 22:34:42 +02:00
idle intel_idle: make SPR C1 and C1E be independent 2022-08-17 15:16:13 +02:00
iio iio: adc: max1027: unlock on error path in max1027_read_single_value() 2022-08-17 15:15:36 +02:00
infiniband RDMA/rxe: Fix error unwind in rxe_create_qp() 2022-08-17 15:15:41 +02:00
input Input: gscps2 - check return value of ioremap() in gscps2_probe() 2022-08-17 15:16:06 +02:00
interconnect interconnect: imx: fix max_node_id 2022-08-17 15:15:33 +02:00
iommu iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) 2022-08-17 15:16:08 +02:00
ipack ipack: ipoctal: rename tty-driver pointer 2021-10-04 11:21:24 +02:00
irqchip irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() 2022-08-17 15:14:01 +02:00
isdn net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
leds leds: pwm-multicolor: Don't show -EPROBE_DEFER as errors 2022-08-17 15:15:54 +02:00
macintosh macintosh/adb: fix oob read in do_adb_query() function 2022-08-11 13:22:05 +02:00
mailbox mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n 2022-05-24 08:08:24 -05:00
mcb mcb: fix error handling in mcb_alloc_bus() 2021-09-14 11:22:26 +02:00
md dm: fix dm-raid crash if md_handle_request() splits bio 2022-08-17 15:16:14 +02:00
media Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm" 2022-08-17 15:16:19 +02:00
memory memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings 2022-06-06 11:18:20 +02:00
memstick memstick/ms_block: Fix a memory leak 2022-08-17 15:15:31 +02:00
message scsi: message: fusion: Remove unused variable retval 2022-04-25 23:26:32 -04:00
mfd mfd: max77620: Fix refcount leak in max77620_initialise_fps 2022-08-17 15:15:55 +02:00
misc eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() 2022-08-17 15:15:33 +02:00
mmc mmc: cavium-thunderx: Add of_node_put() when breaking out of loop 2022-08-17 15:15:37 +02:00
most most: usb: replace snprintf in show functions with sysfs_emit 2021-11-26 17:03:47 +01:00
mtd mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() 2022-08-17 15:15:38 +02:00
mux mux: Fix struct mux_state kernel-doc comment 2022-02-04 15:47:12 +01:00
net vxlan: Use ip_tunnel_key flow flags in route lookups 2022-08-17 15:16:21 +02:00
nfc NFC: nxp-nci: don't print header length mismatch on i2c error 2022-06-29 14:05:00 +01:00
ntb ntb: intel: fix port config status offset for SPR 2022-01-28 10:19:16 -05:00
nubus proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
nvdimm nvdimm: Fix badblocks clear off-by-one error 2022-06-24 11:57:19 -07:00
nvme nvme: catch -ENODEV from nvme_revalidate_zones again 2022-08-17 15:15:42 +02:00
nvmem nvmem: sfp: Add support for TA 2.1 devices 2022-05-09 15:46:29 +02:00
of of/fdt: declared return type does not match actual return type 2022-08-17 15:15:41 +02:00
opp opp: Fix error check in dev_pm_opp_attach_genpd() 2022-08-17 15:15:43 +02:00
parisc parisc: Check the return value of ioremap() in lba_driver_probe() 2022-08-17 15:13:48 +02:00
parport parport_pc: Also enable driver for PCI systems 2022-03-18 14:01:41 +01:00
pci PCI: qcom: Power on PHY before IPQ8074 DBI register accesses 2022-08-17 15:16:08 +02:00
pcmcia ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
peci peci: Add peci-cpu driver 2022-02-09 08:04:44 +01:00
perf drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX 2022-08-17 15:14:19 +02:00
phy phy: rockchip-inno-usb2: Ignore OTG IRQs in host mode 2022-08-17 15:15:33 +02:00
pinctrl pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context 2022-07-19 00:57:38 +02:00
platform platform/olpc: Fix uninitialized data in debugfs write 2022-08-17 15:15:39 +02:00
pnp PNP update for 5.18-rc1 2022-03-21 14:46:01 -07:00
power power: supply: core: Fix boundary conditions in interpolation 2022-06-09 21:08:38 +02:00
powercap PM: EM: convert power field to micro-Watts precision and align drivers 2022-08-17 15:14:05 +02:00
pps pps: generators: pps_gen_parport: Switch to use module_parport_driver() 2022-03-18 14:01:19 +01:00
ps3 powerpc/ps3: Warn on PS3 device errors 2021-06-10 21:44:58 +10:00
ptp ptp: ocp: Select CRC16 in the Kconfig. 2022-07-27 18:11:34 -07:00
pwm pwm: lpc18xx: Fix period handling 2022-08-17 15:14:21 +02:00
rapidio rapidio: remove unnecessary use of list iterator 2022-04-29 14:38:03 -07:00
ras RAS/CEC: Remove a repeated 'an' in a comment 2021-12-11 11:55:27 +01:00
regulator regulator: of: Fix refcount leak bug in of_get_regulation_constraints() 2022-08-17 15:14:18 +02:00
remoteproc Revert "devcoredump: remove the useless gfp_t parameter in dev_coredumpv and dev_coredumpm" 2022-08-17 15:16:19 +02:00
reset TI Driver updates for v5.19 2022-05-09 23:09:10 +02:00
rpmsg rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge 2022-08-17 15:15:53 +02:00
rtc rtc: rx8025: fix 12/24 hour mode detection on RX-8035 2022-08-17 15:13:50 +02:00
s390 scsi: zfcp: Fix missing auto port scan and thus missing target ports 2022-08-17 15:16:03 +02:00
sbus module: remove never implemented MODULE_SUPPORTED_DEVICE 2021-03-17 13:16:18 -07:00
scsi scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests 2022-08-17 15:16:05 +02:00
sh maple: fix wrong return value of maple_bus_init(). 2021-09-17 14:00:09 -04:00
siox bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
slimbus Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
soc soc: qcom: socinfo: Fix the id of SA8540P SoC 2022-08-17 15:14:18 +02:00
soundwire soundwire: revisit driver bind/unbind and callbacks 2022-08-17 15:15:28 +02:00
spi spi: tegra20-slink: fix UAF in tegra_slink_remove() 2022-08-17 15:14:17 +02:00
spmi spmi: spmi-pmic-arb: fix irq_set_type race condition 2021-12-17 17:18:18 +01:00
ssb ssb: remove unreachable code 2022-05-11 08:29:11 +03:00
staging staging: fbtft: core: set smem_len before fb_deferred_io_init call 2022-08-17 15:15:38 +02:00
target scsi: target: Fix WRITE_SAME No Data Buffer crash 2022-07-07 16:38:14 -04:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: add overflow check in register_shm_helper() 2022-08-21 15:20:08 +02:00
thermal PM: EM: convert power field to micro-Watts precision and align drivers 2022-08-17 15:14:05 +02:00
thunderbolt USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
tty tty: serial: qcom-geni-serial: Fix %lu -> %u in print statements 2022-08-17 15:16:01 +02:00
ufs scsi: ufs: core: Correct ufshcd_shutdown() flow 2022-08-17 15:16:03 +02:00
uio uio: dfl: add HSSI subsystem feature id 2022-05-09 15:42:57 +02:00
usb usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() 2022-08-17 15:15:43 +02:00
vdpa vduse: Tie vduse mgmtdev and its device 2022-06-24 02:49:48 -04:00
vfio vfio: Split migration ops from main device ops 2022-08-17 15:15:48 +02:00
vhost vhost-vdpa: call vhost_vdpa_cleanup during the release 2022-06-27 08:05:35 -04:00
video video: fbdev: s3fb: Check the size of screen before memset_io() 2022-08-17 15:16:03 +02:00
virt virt: sev-guest: Pass the appropriate argument type to iounmap() 2022-07-19 22:26:02 +02:00
virtio virtio: replace restricted mem access flag with callback 2022-08-17 15:15:41 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
vme staging: vme: Move vme_user to staging KConfig 2022-04-22 16:47:29 +02:00
w1 w1/ds2490: remove dump from ds_recv_status, pr_ to dev_XXX logging. 2022-04-24 17:30:22 +02:00
watchdog watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() 2022-08-17 15:15:57 +02:00
xen xen: don't require virtio with grants for non-PV guests 2022-08-17 15:15:41 +02:00
zorro proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
Kconfig SCSI misc on 20220604 2022-06-05 09:25:12 -07:00
Makefile SCSI misc on 20220604 2022-06-05 09:25:12 -07:00