Matthew Wilcox 7a4deea1aa idr: fix invalid ptr dereference on item delete ... If the radix tree underlying the IDR happens to be full and we attempt to remove an id which is larger than any id in the IDR, we will call __radix_tree_delete() with an uninitialised 'slot' pointer, at which point anything could happen. This was easiest to hit with a single entry at id 0 and attempting to remove a non-0 id, but it could have happened with 64 entries and attempting to remove an id >= 64. Roman said: The syzcaller test boils down to opening /dev/kvm, creating an eventfd, and calling a couple of KVM ioctls. None of this requires superuser. And the result is dereferencing an uninitialized pointer which is likely a crash. The specific path caught by syzbot is via KVM_HYPERV_EVENTD ioctl which is new in 4.17. But I guess there are other user-triggerable paths, so cc:stable is probably justified. Matthew added: We have around 250 calls to idr_remove() in the kernel today. Many of them pass an ID which is embedded in the object they're removing, so they're safe. Picking a few likely candidates: drivers/firewire/core-cdev.c looks unsafe; the ID comes from an ioctl. drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c is similar drivers/atm/nicstar.c could be taken down by a handcrafted packet Link: http://lkml.kernel.org/r/20180518175025.GD6361@bombadil.infradead.org Fixes: 0a835c4f09 ("Reimplement IDR and IDA using the radix tree") Reported-by: <syzbot+35666cba7f0a337e2e79@syzkaller.appspotmail.com> Debugged-by: Roman Kagan <rkagan@virtuozzo.com> Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2018-05-25 18:12:10 -07:00
..
842	…
fonts	…
lz4	…
lzo	…
mpi	…
raid6	powerpc updates for 4.17	2018-04-07 12:08:19 -07:00
reed_solomon	…
xz	…
zlib_deflate	…
zlib_inflate	…
zstd	lib: zstd: clean up Makefile for simpler composite object handling	2018-03-26 02:01:27 +09:00
.gitignore	…
Kconfig	lib: Add generic PIO mapping method	2018-03-21 17:18:34 -05:00
Kconfig.debug	lib/Kconfig.debug: Debug Lockups and Hangs: keep SOFTLOCKUP options together	2018-04-11 10:28:35 -07:00
Kconfig.kasan	…
Kconfig.kgdb	…
Kconfig.ubsan	lib: add testing module for UBSAN	2018-04-11 10:28:35 -07:00
Makefile	lib: add testing module for UBSAN	2018-04-11 10:28:35 -07:00
argv_split.c	…
ashldi3.c	…
ashrdi3.c	…
asn1_decoder.c	…
assoc_array.c	…
atomic64.c	…
atomic64_test.c	…
audit.c	…
bcd.c	…
bch.c	…
bitmap.c	lib: fix stall in __bitmap_parselist()	2018-04-05 21:36:21 -07:00
bitrev.c	…
bsearch.c	…
btree.c	btree: avoid variable-length allocations	2018-03-14 16:55:29 -07:00
bucket_locks.c	…
bug.c	lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()	2018-03-09 16:40:01 -08:00
build_OID_registry	…
bust_spinlocks.c	…
chacha20.c	…
check_signature.c	…
checksum.c	…
clz_ctz.c	…
clz_tab.c	…
cmdline.c	…
cmpdi2.c	…
compat_audit.c	…
cordic.c	…
cpu_rmap.c	…
cpumask.c	…
crc-ccitt.c	…
crc-itu-t.c	…
crc-t10dif.c	…
crc4.c	…
crc7.c	…
crc8.c	…
crc16.c	…
crc32.c	…
crc32defs.h	…
crc32test.c	…
ctype.c	…
debug_info.c	…
debug_locks.c	…
debugobjects.c	debugobjects: Avoid another unused variable warning	2018-03-14 20:20:01 +01:00
dec_and_lock.c	…
decompress.c	…
decompress_bunzip2.c	…
decompress_inflate.c	…
decompress_unlz4.c	…
decompress_unlzma.c	…
decompress_unlzo.c	…
decompress_unxz.c	…
devres.c	devres: combine function devm_ioremap*	2018-03-15 18:08:55 +01:00
digsig.c	…
div64.c	…
dma-debug.c	…
dma-direct.c	dma-direct: don't retry allocation for no-op GFP_DMA	2018-04-23 14:43:27 +02:00
dma-virt.c	…
dump_stack.c	printk: move dump stack related code to lib/dump_stack.c	2018-03-15 13:25:36 +01:00
dynamic_debug.c	…
dynamic_queue_limits.c	…
earlycpio.c	…
error-inject.c	…
errseq.c	errseq: Always report a writeback error once	2018-04-27 08:51:26 -04:00
extable.c	…
fault-inject.c	…
fdt.c	…
fdt_empty_tree.c	…
fdt_ro.c	…
fdt_rw.c	…
fdt_strerror.c	…
fdt_sw.c	…
fdt_wip.c	…
find_bit.c	…
find_bit_benchmark.c	lib/find_bit_benchmark.c: avoid soft lockup in test_find_first_bit()	2018-05-11 17:28:45 -07:00
flex_array.c	…
flex_proportions.c	…
gcd.c	…
gen_crc32table.c	…
genalloc.c	…
glob.c	…
globtest.c	…
hexdump.c	…
hweight.c	…
idr.c	…
inflate.c	…
int_sqrt.c	…
interval_tree.c	…
interval_tree_test.c	…
iomap.c	…
iomap_copy.c	…
iommu-common.c	…
iommu-helper.c	…
ioremap.c	mm/vmalloc: add interfaces to free unmapped page table	2018-03-22 17:07:01 -07:00
iov_iter.c	iov_iter: fix memory leak in pipe_get_pages_alloc()	2018-05-02 15:43:19 -04:00
irq_poll.c	…
irq_regs.c	…
is_single_threaded.c	…
jedec_ddr_data.c	…
kasprintf.c	…
kfifo.c	kfifo: fix inaccurate comment	2018-03-27 11:15:42 +02:00
klist.c	…
kobject.c	kobject: don't use WARN for registration failures	2018-04-23 13:14:55 +02:00
kobject_uevent.c	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
kstrtox.c	…
kstrtox.h	…
lcm.c	…
libcrc32c.c	libcrc32c: Add crc32c_impl function	2018-03-26 15:09:38 +02:00
list_debug.c	lib/list_debug.c: print unmangled addresses	2018-04-11 10:28:35 -07:00
list_sort.c	…
llist.c	…
locking-selftest-hardirq.h	…
locking-selftest-mutex.h	…
locking-selftest-rlock-hardirq.h	…
locking-selftest-rlock-softirq.h	…
locking-selftest-rlock.h	…
locking-selftest-rsem.h	…
locking-selftest-rtmutex.h	…
locking-selftest-softirq.h	…
locking-selftest-spin-hardirq.h	…
locking-selftest-spin-softirq.h	…
locking-selftest-spin.h	…
locking-selftest-wlock-hardirq.h	…
locking-selftest-wlock-softirq.h	…
locking-selftest-wlock.h	…
locking-selftest-wsem.h	…
locking-selftest.c	…
lockref.c	lockref: Add lockref_put_not_zero	2018-04-12 09:41:19 -07:00
logic_pio.c	lib: Add generic PIO mapping method	2018-03-21 17:18:34 -05:00
lru_cache.c	…
lshrdi3.c	…
memory-notifier-error-inject.c	…
memweight.c	…
muldi3.c	…
net_utils.c	…
netdev-notifier-error-inject.c	…
nlattr.c	…
nmi_backtrace.c	…
nodemask.c	…
notifier-error-inject.c	…
notifier-error-inject.h	…
of-reconfig-notifier-error-inject.c	…
oid_registry.c	…
once.c	…
parman.c	…
parser.c	…
pci_iomap.c	…
percpu-refcount.c	percpu_ref: Update doc to dissuade users from depending on internal RCU grace periods	2018-03-19 10:09:44 -07:00
percpu_counter.c	…
percpu_ida.c	…
percpu_test.c	…
plist.c	…
pm-notifier-error-inject.c	…
prime_numbers.c	…
radix-tree.c	idr: fix invalid ptr dereference on item delete	2018-05-25 18:12:10 -07:00
random32.c	…
ratelimit.c	…
rational.c	…
rbtree.c	…
rbtree_test.c	…
reciprocal_div.c	…
refcount.c	…
rhashtable.c	rhashtable: add schedule points	2018-03-31 23:25:39 -04:00
sbitmap.c	…
scatterlist.c	lib/scatterlist: add sg_init_marker() helper	2018-03-30 22:50:15 +02:00
seq_buf.c	…
sg_pool.c	…
sg_split.c	…
sha1.c	…
sha256.c	kernel/kexec_file.c: move purgatories sha256 to common code	2018-04-13 17:10:28 -07:00
show_mem.c	…
siphash.c	…
smp_processor_id.c	…
sort.c	…
stackdepot.c	…
stmp_device.c	…
string.c	…
string_helpers.c	…
strncpy_from_user.c	…
strnlen_user.c	…
swiotlb.c	swiotlb: silent unwanted warning "buffer is full"	2018-05-12 11:57:37 +02:00
syscall.c	…
test-kstrtox.c	…
test-string_helpers.c	…
test_bitmap.c	lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly	2018-05-18 17:17:12 -07:00
test_bpf.c	test_bpf: Fix NULL vs IS_ERR() check in test_skb_segment()	2018-03-29 14:33:29 -04:00
test_debug_virtual.c	…
test_firmware.c	headers: untangle kmemleak.h from mm.h	2018-04-05 21:36:27 -07:00
test_hash.c	…
test_hexdump.c	…
test_kasan.c	kasan: fix invalid-free test crashing the kernel	2018-04-11 10:28:32 -07:00
test_kmod.c	lib/test_kmod.c: fix limit check on number of test devices created	2018-03-09 16:40:02 -08:00
test_list_sort.c	…
test_module.c	…
test_parman.c	…
test_printf.c	…
test_rhashtable.c	test_rhashtable: add test case for rhltable with duplicate objects	2018-03-07 10:44:03 -05:00
test_siphash.c	…
test_sort.c	…
test_static_key_base.c	…
test_static_keys.c	…
test_string.c	…
test_sysctl.c	…
test_ubsan.c	lib/test_ubsan.c: make test_ubsan_misaligned_access() static	2018-04-11 10:28:35 -07:00
test_user_copy.c	treewide: simplify Kconfig dependencies for removed archs	2018-03-26 15:55:57 +02:00
test_uuid.c	…
textsearch.c	textsearch: fix kernel-doc warnings and add kernel-api section	2018-04-16 18:53:13 -04:00
timerqueue.c	…
ts_bm.c	…
ts_fsm.c	…
ts_kmp.c	…
ubsan.c	…
ubsan.h	…
ucmpdi2.c	…
ucs2_string.c	…
usercopy.c	…
uuid.c	…
vsprintf.c	vsprintf: Replace memory barrier with static_key for random_ptr_key update	2018-05-16 09:01:41 -04:00
win_minmax.c	…
xxhash.c	…