kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/arch/arm64/kernel
History
Mark Rutland 96035c0093 arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL 
commit ca62d90085 upstream.

Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl'
variable, and a SETREGSET call with a length of zero will leave this
uninitialized. Consequently tagged_addr_ctrl_set() will consume an
arbitrary value, potentially leaking up to 64 bits of memory from the
kernel stack. The read is limited to a specific slot on the stack, and
the issue does not provide a write mechanism.

As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and
rejects other values, a partial SETREGSET attempt will randomly succeed
or fail depending on the value of the uninitialized value, and the
exposure is significantly limited.

Fix this by initializing the temporary value before copying the regset
from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,
NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing
value of the tagged address ctrl will be retained.

The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the
user_aarch64_view used by a native AArch64 task to manipulate another
native AArch64 task. As get_tagged_addr_ctrl() only returns an error
value when called for a compat task, tagged_addr_ctrl_get() and
tagged_addr_ctrl_set() should never observe an error value from
get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that
such an error would be unexpected, and error handlnig is not missing in
either case.

Fixes: 2200aa7154 ("arm64: mte: ptrace: Add NT_ARM_TAGGED_ADDR_CTRL regset")
Cc: <stable@vger.kernel.org> # 5.10.x
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20241205121655.1824269-2-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-12-14 19:59:52 +01:00
..
pi arm64: unwind: add asynchronous unwind tables to kernel and modules 2022-11-09 18:06:35 +00:00
probes arm64: probes: Disable kprobes/uprobes on MOPS instructions 2024-12-09 10:31:42 +01:00
vdso kbuild: unify vdso_install rules 2024-06-12 11:12:32 +02:00
vdso32 kbuild: unify vdso_install rules 2024-06-12 11:12:32 +02:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
acpi.c arm64: acpi: Fix possible memory leak of ffh_ctxt 2023-02-24 14:21:49 +00:00
acpi_numa.c arm64: acpi: Move get_cpu_for_acpi_id() to a header 2024-09-12 11:11:42 +02:00
acpi_parking_protocol.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
alternative.c Merge branches 'for-next/kpti', 'for-next/missing-proto-warn', 'for-next/iss2-decode', 'for-next/kselftest', 'for-next/misc', 'for-next/feat_mops', 'for-next/module-alloc', 'for-next/sysreg', 'for-next/cpucap', 'for-next/acpi', 'for-next/kdump', 'for-next/acpi-doc', 'for-next/doc' and 'for-next/tpidr2-fix', remote-tracking branch 'arm64/for-next/perf' into for-next/core 2023-06-23 18:32:20 +01:00
armv8_deprecated.c arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process 2024-07-25 09:50:43 +02:00
asm-offsets.c arm64: ftrace: fix build error with CONFIG_FUNCTION_GRAPH_TRACER=n 2023-07-05 09:46:19 -04:00
cacheinfo.c cacheinfo: Add arm64 early level initializer implementation 2023-04-13 09:32:33 +01:00
compat_alignment.c arm64: compat: Work around uninitialized variable warning 2023-04-05 17:51:47 +01:00
cpu-reset.S arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text 2023-05-02 12:42:22 +01:00
cpu_errata.c arm64: errata: Expand speculative SSBS workaround once more 2024-10-10 11:58:02 +02:00
cpu_ops.c arm64: Introduce get_cpu_ops() helper function 2020-03-24 17:24:19 +00:00
cpufeature.c arm64: errata: Add workaround for Arm errata 3194386 and 3312417 2024-08-14 13:58:48 +02:00
cpuidle.c arm64: Explicitly include correct DT includes 2023-07-31 14:45:38 +01:00
cpuinfo.c arm64: add HWCAP for FEAT_HBC (hinted conditional branches) 2023-08-04 17:32:13 +01:00
crash_core.c arm64: move PAC masks to <asm/pointer_auth.h> 2023-04-13 12:27:11 +01:00
crash_dump.c vmcore: convert copy_oldmem_page() to take an iov_iter 2022-04-29 14:37:59 -07:00
debug-monitors.c arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-04-14 13:39:47 +01:00
efi-header.S arm64: efi: Enable BTI codegen and add PE/COFF annotation 2023-04-20 15:43:45 +02:00
efi-rt-wrapper.S arm64: efi: Avoid workqueue to check whether EFI runtime is live 2023-01-16 15:27:31 +01:00
efi.c drm for 6.6-rc1 2023-08-30 13:34:34 -07:00
elfcore.c arm64: mte: Avoid the racy walk of the vma list during core dump 2023-01-05 15:12:12 +00:00
entry-common.c arm64: syscall: unmask DAIF earlier for SVCs 2023-08-11 12:23:48 +01:00
entry-fpsimd.S arm64/sme: Implement context switching for ZT0 2023-01-20 12:23:06 +00:00
entry-ftrace.S arm64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL 2023-06-20 18:38:37 -04:00
entry.S arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD 2024-01-31 16:18:55 -08:00
fpsimd.c arm64/sve: Discard stale CPU state when handling SVE traps 2024-11-14 13:19:38 +01:00
ftrace.c arm64: module: mandate MODULE_PLTS 2023-06-06 17:39:05 +01:00
head.S arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H 2024-04-27 17:11:41 +02:00
hibernate-asm.S arm64: kexec: install a copy of the linear-map 2021-10-01 13:31:00 +01:00
hibernate.c arm64: hibernate: remove WARN_ON in save_processor_state 2023-06-21 13:33:49 +01:00
hw_breakpoint.c hw_breakpoint: fix single-stepping when using bpf_overflow_handler 2023-08-18 17:04:09 +01:00
hyp-stub.S ARM64: 2023-07-03 15:32:22 -07:00
idle.c arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled 2023-01-13 11:48:15 +01:00
idreg-override.c arm64/sysreg: Fix broken strncpy() -> strscpy() conversion 2023-09-06 19:22:54 +01:00
image-vars.h efi/zboot: arm64: Inject kernel code size symbol into the zboot payload 2023-04-26 18:01:41 +02:00
image.h arm64: get rid of TEXT_OFFSET 2020-09-07 15:00:52 +01:00
io.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
irq.c arm64: irq: set the correct node for shadow call stack 2024-02-05 20:14:38 +00:00
jump_label.c arm64: jump_label: Ensure patched jump_labels are visible to all CPUs 2024-08-11 12:47:24 +02:00
kaslr.c Merge branch for-next/module-alloc into kvmarm/next 2023-06-15 13:04:15 +00:00
kexec_image.c arm64: Fix dangling references to Documentation/arm64 2023-06-21 08:53:31 -06:00
kgdb.c arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-04-14 13:39:47 +01:00
kuser32.S arm64: Update Documentation/arm references 2023-06-12 06:33:48 -06:00
machine_kexec.c Merge branch 'for-next/misc' into for-next/core 2023-04-20 11:22:09 +01:00
machine_kexec_file.c arm64/kexec: Fix missing extra range for crashkres_low. 2022-09-01 11:50:00 +01:00
Makefile - Arnd Bergmann has fixed a bunch of -Wmissing-prototypes in 2023-06-28 10:59:38 -07:00
module-plts.c arm64: module: Fix PLT counting when CONFIG_RANDOMIZE_BASE=n 2023-11-28 17:20:00 +00:00
module.c arm64: module: rework module VA range selection 2023-06-06 17:39:06 +01:00
mte.c arm64: mte: simplify swap tag restoration logic 2023-08-18 10:12:02 -07:00
paravirt.c arm64: paravirt: remove conduit check in has_pv_steal_clock 2022-11-09 18:11:56 +00:00
patch-scs.c arm64: Apply dynamic shadow call stack patching in two passes 2023-01-26 17:54:15 +00:00
patching.c arm64: patching: Add aarch64_insn_write_literal_u64() 2023-01-24 11:49:43 +00:00
pci.c arm64: Explicitly include correct DT includes 2023-07-31 14:45:38 +01:00
perf_callchain.c arm64: use XPACLRI to strip PAC 2023-04-13 12:27:11 +01:00
perf_regs.c perf: arm64: Add SVE vector granule register to user regs 2022-09-22 15:06:02 +01:00
pointer_auth.c arm64: move preemption disablement to prctl handlers 2021-07-28 18:33:49 +01:00
process.c arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled 2024-12-09 10:32:50 +01:00
proton-pack.c arm64: errata: Unify speculative SSBS errata logic 2024-08-14 13:58:49 +02:00
psci.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
ptrace.c arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL 2024-12-14 19:59:52 +01:00
reloc_test_core.c ARM64: reloc_test: add __init/__exit annotations to module init/exit funcs 2022-09-29 18:04:25 +01:00
reloc_test_syms.S arm64: kernel: Convert to modern annotations for assembly functions 2020-05-04 12:46:03 +01:00
relocate_kernel.S arm64: kexec: load from kimage prior to clobbering 2022-05-17 14:25:35 +01:00
return_address.c arm64: Make return_address() use arch_stack_walk() 2021-12-10 14:06:04 +00:00
sdei.c arm64: sdei: abort running SDEI handlers during crash 2023-08-04 17:35:33 +01:00
setup.c of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify 2024-12-09 10:31:56 +01:00
signal.c arm64/signal: Don't assume that TIF_SVE means we saved SVE state 2024-02-23 09:25:13 +01:00
signal32.c x86/shstk: Add user control-protection fault handler 2023-08-02 15:01:50 -07:00
sigreturn32.S arm64: compat: Move sigreturn32.S to .rodata section 2022-07-01 12:05:45 +01:00
sleep.S arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text 2023-05-02 12:42:22 +01:00
smccc-call.S arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-11-14 13:19:38 +01:00
smp.c arm64: Fix KASAN random tag seed initialization 2024-08-29 17:33:30 +02:00
smp_spin_table.c treewide: Drop function_nocfi 2022-09-26 10:13:14 -07:00
stacktrace.c arm64: use XPACLRI to strip PAC 2023-04-13 12:27:11 +01:00
suspend.c arm64/sme: Restore SME registers on exit from suspend 2024-03-01 13:35:08 +01:00
sys.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234 2019-06-19 17:09:07 +02:00
sys32.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 452 2019-06-19 17:09:08 +02:00
sys_compat.c arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall 2022-04-29 19:26:27 +01:00
syscall.c randomize_kstack: Remove non-functional per-arch entropy filtering 2024-07-05 09:33:54 +02:00
time.c arm64: Make profile_pc() use arch_stack_walk() 2021-12-10 14:06:04 +00:00
topology.c RISC-V Patches for the 6.1 Merge Window, Part 1 2022-10-09 13:24:01 -07:00
trace-events-emulation.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
traps.c - Yosry Ahmed brought back some cgroup v1 stats in OOM logs. 2023-06-28 10:28:11 -07:00
vdso-wrap.S arm64: do not descend to vdso directories twice 2021-01-20 12:18:46 +00:00
vdso.c arm64: vdso: Pass (void *) to virt_to_page() 2023-05-16 14:53:36 +01:00
vdso32-wrap.S arm64: do not descend to vdso directories twice 2021-01-20 12:18:46 +00:00
vmlinux.lds.S arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG 2024-12-09 10:31:44 +01:00
watchdog_hld.c arm64: enable perf events based hard lockup detector 2023-06-09 17:44:22 -07:00