kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/arch/arm64/kernel
History
Tengda Wu 01f91d415a arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() 
[ Upstream commit 39dfc971e4 ]

KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth().

Call Trace:
[   97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8
[   97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550
[   97.285732]
[   97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11
[   97.287032] Hardware name: linux,dummy-virt (DT)
[   97.287815] Call trace:
[   97.288279]  dump_backtrace+0xa0/0x128
[   97.288946]  show_stack+0x20/0x38
[   97.289551]  dump_stack_lvl+0x78/0xc8
[   97.290203]  print_address_description.constprop.0+0x84/0x3c8
[   97.291159]  print_report+0xb0/0x280
[   97.291792]  kasan_report+0x84/0xd0
[   97.292421]  __asan_load8+0x9c/0xc0
[   97.293042]  regs_get_kernel_stack_nth+0xa8/0xc8
[   97.293835]  process_fetch_insn+0x770/0xa30
[   97.294562]  kprobe_trace_func+0x254/0x3b0
[   97.295271]  kprobe_dispatcher+0x98/0xe0
[   97.295955]  kprobe_breakpoint_handler+0x1b0/0x210
[   97.296774]  call_break_hook+0xc4/0x100
[   97.297451]  brk_handler+0x24/0x78
[   97.298073]  do_debug_exception+0xac/0x178
[   97.298785]  el1_dbg+0x70/0x90
[   97.299344]  el1h_64_sync_handler+0xcc/0xe8
[   97.300066]  el1h_64_sync+0x78/0x80
[   97.300699]  kernel_clone+0x0/0x500
[   97.301331]  __arm64_sys_clone+0x70/0x90
[   97.302084]  invoke_syscall+0x68/0x198
[   97.302746]  el0_svc_common.constprop.0+0x11c/0x150
[   97.303569]  do_el0_svc+0x38/0x50
[   97.304164]  el0_svc+0x44/0x1d8
[   97.304749]  el0t_64_sync_handler+0x100/0x130
[   97.305500]  el0t_64_sync+0x188/0x190
[   97.306151]
[   97.306475] The buggy address belongs to stack of task 1.sh/2550
[   97.307461]  and is located at offset 0 in frame:
[   97.308257]  __se_sys_clone+0x0/0x138
[   97.308910]
[   97.309241] This frame has 1 object:
[   97.309873]  [48, 184) 'args'
[   97.309876]
[   97.310749] The buggy address belongs to the virtual mapping at
[   97.310749]  [ffff800089270000, ffff800089279000) created by:
[   97.310749]  dup_task_struct+0xc0/0x2e8
[   97.313347]
[   97.313674] The buggy address belongs to the physical page:
[   97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a
[   97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff)
[   97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000
[   97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   97.319445] page dumped because: kasan: bad access detected
[   97.320371]
[   97.320694] Memory state around the buggy address:
[   97.321511]  ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   97.322681]  ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00
[   97.325023]                          ^
[   97.325683]  ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3
[   97.326856]  ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00

This issue seems to be related to the behavior of some gcc compilers and
was also fixed on the s390 architecture before:

 commit d93a855c31 ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()")

As described in that commit, regs_get_kernel_stack_nth() has confirmed that
`addr` is on the stack, so reading the value at `*addr` should be allowed.
Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case.

Fixes: 0a8ea52c3e ("arm64: Add HAVE_REGS_AND_STACK_ACCESS_API feature")
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Link: https://lore.kernel.org/r/20250604005533.1278992-1-wutengda@huaweicloud.com
[will: Use '*addr' as the argument to READ_ONCE_NOCHECK()]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-06-27 11:07:41 +01:00
..
pi arm64: adjust KASLR relocation after ARCH_RANDOM removal 2022-08-17 14:52:50 +01:00
probes arm64: probes: Fix uprobes for big-endian kernels 2024-11-01 01:56:01 +01:00
vdso arm64: Handle .ARM.attributes section in linker scripts 2025-02-21 13:50:05 +01:00
vdso32 kbuild: Drop -Wdeclaration-after-statement 2024-02-23 09:12:52 +01:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
acpi.c arm64: mm: Convert to GENERIC_IOREMAP 2022-06-27 12:22:31 +01:00
acpi_numa.c arm64: acpi: Move get_cpu_for_acpi_id() to a header 2024-09-12 11:10:28 +02:00
acpi_parking_protocol.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
alternative.c arm64 updates for 6.1: 2022-10-06 11:51:49 -07:00
armv8_deprecated.c arm64: fix oops in concurrently setting insn_emulation sysctls 2022-07-04 12:18:47 +01:00
asm-offsets.c KVM: arm64: Drop unused workaround_flags vcpu field 2021-12-08 14:54:07 +00:00
cacheinfo.c arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array 2025-02-21 13:49:57 +01:00
compat_alignment.c arm64: Don't call NULL in do_compat_alignment_fixup() 2025-04-10 14:33:43 +02:00
cpu-reset.S arm64: Add types to indirect called assembly functions 2022-09-26 10:13:13 -07:00
cpu_errata.c arm64: errata: Expand speculative SSBS workaround once more 2024-10-17 15:22:05 +02:00
cpu_ops.c arm64: Introduce get_cpu_ops() helper function 2020-03-24 17:24:19 +00:00
cpufeature.c arm64: errata: Add workaround for Arm errata 3194386 and 3312417 2024-08-14 13:52:51 +02:00
cpuidle.c arm64: cpuidle: remove generic cpuidle support 2022-06-23 14:19:33 +01:00
cpuinfo.c arm64/sysreg: Add hwcap for SVE EBF16 2022-09-06 18:53:52 +01:00
crash_core.c arm64: crash_core: Export MODULES, VMALLOC, and VMEMMAP ranges 2022-03-07 21:25:47 +00:00
crash_dump.c vmcore: convert copy_oldmem_page() to take an iov_iter 2022-04-29 14:37:59 -07:00
debug-monitors.c arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-05-11 23:03:16 +09:00
efi-entry.S arm64: Rename arm64-internal cache maintenance functions 2021-05-25 19:27:49 +01:00
efi-header.S arm64: efi: Set NX compat flag in PE/COFF header 2023-04-06 12:10:37 +02:00
efi-rt-wrapper.S arm64: efi: Avoid workqueue to check whether EFI runtime is live 2023-02-01 08:34:34 +01:00
efi.c arm64: efi: Make efi_rt_lock a raw_spinlock 2023-03-11 13:55:43 +01:00
elfcore.c arm64: mte: Fix/clarify the PG_mte_tagged semantics 2023-03-11 13:55:44 +01:00
entry-common.c arm64: entry: avoid kprobe recursion 2022-11-01 17:43:31 +00:00
entry-fpsimd.S arm64/sme: Implement ZA context switching 2022-04-22 18:51:02 +01:00
entry-ftrace.S arm64: ftrace: Define ftrace_stub_graph only with FUNCTION_GRAPH_TRACER 2022-11-14 12:28:52 +00:00
entry.S arm64: Rename ARM64_WORKAROUND_2966298 2024-01-31 16:17:01 -08:00
fpsimd.c arm64/fpsimd: Fix merging of FPSIMD state during signal return 2025-06-27 11:07:08 +01:00
ftrace.c arm64 updates for 6.1: 2022-10-06 11:51:49 -07:00
head.S arm64: Always load shadow stack pointer directly from the task struct 2023-05-11 23:02:59 +09:00
hibernate-asm.S arm64: kexec: install a copy of the linear-map 2021-10-01 13:31:00 +01:00
hibernate.c arm64: mte: Fix/clarify the PG_mte_tagged semantics 2023-03-11 13:55:44 +01:00
hw_breakpoint.c hw_breakpoint: fix single-stepping when using bpf_overflow_handler 2023-09-23 11:11:00 +02:00
hyp-stub.S arm64/sysreg: Standardise naming for ID_AA64MMFR1_EL1 fields 2022-09-09 10:59:03 +01:00
idle.c Merge branch 'for-next/entry' into for-next/core 2021-06-24 14:01:55 +01:00
idreg-override.c arm64/sysreg: Standardise naming for ID_AA64MMFR1_EL1 fields 2022-09-09 10:59:03 +01:00
image-vars.h EFI updates for v6.1 2022-10-09 08:56:54 -07:00
image.h arm64: get rid of TEXT_OFFSET 2020-09-07 15:00:52 +01:00
io.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
irq.c arm64: irq: set the correct node for shadow call stack 2024-02-05 20:13:02 +00:00
jump_label.c arm64: jump_label: Ensure patched jump_labels are visible to all CPUs 2024-08-11 12:35:59 +02:00
kaslr.c random: handle archrandom with multiple longs 2022-07-25 13:26:14 +02:00
kexec_image.c arm64: kexec_file: use more system keyrings to verify kernel image signature 2022-07-15 12:21:16 -04:00
kgdb.c arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-05-11 23:03:16 +09:00
kuser32.S arm64: compat: Move kuser32.S to .rodata section 2022-06-23 16:01:42 +01:00
machine_kexec.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
machine_kexec_file.c arm64/kexec: Fix missing extra range for crashkres_low. 2022-09-01 11:50:00 +01:00
Makefile Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
module-plts.c arm64: module: Use module_init_layout_section() to spot init sections 2023-09-02 09:16:19 +02:00
module.c arm64: module: move find_section to header 2022-09-09 12:27:25 +01:00
mte.c arm64: mte: Do not set PG_mte_tagged if tags were not initialized 2023-05-24 17:32:52 +01:00
paravirt.c arm64: paravirt: Use RCU read locks to guard stolen_time 2022-05-17 14:23:37 +01:00
patching.c arm64: patch_text: Fixup last cpu should be master 2022-04-08 11:43:46 +01:00
pci.c arm64: PCI: Support root bridge preparation for Hyper-V 2021-08-23 10:59:26 +01:00
perf_callchain.c Peter Zijlstra says: 2022-01-12 16:26:58 -08:00
perf_event.c drivers/perf: pmuv3: don't expose SW_INCR event in sysfs 2024-02-05 20:12:46 +00:00
perf_regs.c perf: arm64: Add SVE vector granule register to user regs 2022-09-22 15:06:02 +01:00
pointer_auth.c arm64: move preemption disablement to prctl handlers 2021-07-28 18:33:49 +01:00
process.c arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE 2025-04-25 10:43:58 +02:00
proton-pack.c arm64: Add support for HIP09 Spectre-BHB mitigation 2025-06-04 14:40:02 +02:00
psci.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
ptrace.c arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() 2025-06-27 11:07:41 +01:00
reloc_test_core.c ARM64: reloc_test: add __init/__exit annotations to module init/exit funcs 2022-09-29 18:04:25 +01:00
reloc_test_syms.S arm64: kernel: Convert to modern annotations for assembly functions 2020-05-04 12:46:03 +01:00
relocate_kernel.S arm64: kexec: load from kimage prior to clobbering 2022-05-17 14:25:35 +01:00
return_address.c arm64: Make return_address() use arch_stack_walk() 2021-12-10 14:06:04 +00:00
sdei.c arm64: sdei: abort running SDEI handlers during crash 2023-09-13 09:43:03 +02:00
setup.c arm64: Fix KASAN random tag seed initialization 2024-08-29 17:30:33 +02:00
signal.c arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE 2025-04-25 10:43:58 +02:00
signal32.c signal: Deliver SIGTRAP on perf event asynchronously if blocked 2022-04-22 12:14:05 +02:00
sigreturn32.S arm64: compat: Move sigreturn32.S to .rodata section 2022-07-01 12:05:45 +01:00
sleep.S arm64: mm: fix resume for 52-bit enabled builds 2022-09-10 14:46:28 +01:00
smccc-call.S arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-12-14 19:54:53 +01:00
smp.c arm64: Fix KASAN random tag seed initialization 2024-08-29 17:30:33 +02:00
smp_spin_table.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
stacktrace.c arm64: efi: Account for the EFI runtime stack in stack unwinder 2023-02-01 08:34:35 +01:00
suspend.c arm64/sme: Restore SME registers on exit from suspend 2024-03-01 13:26:37 +01:00
sys.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
sys32.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 452 2019-06-19 17:09:08 +02:00
sys_compat.c arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall 2022-04-29 19:26:27 +01:00
syscall.c randomize_kstack: Remove non-functional per-arch entropy filtering 2024-07-05 09:31:51 +02:00
time.c arm64: Make profile_pc() use arch_stack_walk() 2021-12-10 14:06:04 +00:00
topology.c RISC-V Patches for the 6.1 Merge Window, Part 1 2022-10-09 13:24:01 -07:00
trace-events-emulation.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
traps.c arm64 updates for 6.1: 2022-10-06 11:51:49 -07:00
vdso-wrap.S arm64: do not descend to vdso directories twice 2021-01-20 12:18:46 +00:00
vdso.c arm64: vdso: Pass (void *) to virt_to_page() 2023-06-09 10:34:14 +02:00
vdso32-wrap.S arm64: do not descend to vdso directories twice 2021-01-20 12:18:46 +00:00
vmlinux.lds.S arm64: Handle .ARM.attributes section in linker scripts 2025-02-21 13:50:05 +01:00