microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/lib
История
Wang Hai 89a0079049 kobject: Fix slab-out-of-bounds in fill_kobj_path() 
[ Upstream commit 3bb2a01caa ]

In kobject_get_path(), if kobj->name is changed between calls
get_kobj_path_length() and fill_kobj_path() and the length becomes
longer, then fill_kobj_path() will have an out-of-bounds bug.

The actual current problem occurs when the ixgbe probe.

In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name
length becomes longer, out-of-bounds will occur.

cpu0                                         cpu1
ixgbe_probe
 register_netdev(netdev)
  netdev_register_kobject
   device_add
    kobject_uevent // Sending ADD events
                                             systemd-udevd // rename netdev
                                              dev_change_name
                                               device_rename
                                                kobject_rename
 ixgbe_mii_bus_init                             |
  mdiobus_register                              |
   __mdiobus_register                           |
    device_register                             |
     device_add                                 |
      kobject_uevent                            |
       kobject_get_path                         |
        len = get_kobj_path_length // old name  |
        path = kzalloc(len, gfp_mask);          |
                                                kobj->name = name;
                                                /* name length becomes
                                                 * longer
                                                 */
        fill_kobj_path /* kobj path length is
                        * longer than path,
                        * resulting in out of
                        * bounds when filling path
                        */

This is the kasan report:

==================================================================
BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0
Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673

 Workqueue: events work_for_cpu_fn
 Call Trace:
 <TASK>
 dump_stack_lvl+0x34/0x48
 print_address_description.constprop.0+0x86/0x1e7
 print_report+0x36/0x4f
 kasan_report+0xad/0x130
 kasan_check_range+0x35/0x1c0
 memcpy+0x39/0x60
 fill_kobj_path+0x50/0xc0
 kobject_get_path+0x5a/0xc0
 kobject_uevent_env+0x140/0x460
 device_add+0x5c7/0x910
 __mdiobus_register+0x14e/0x490
 ixgbe_probe.cold+0x441/0x574 [ixgbe]
 local_pci_probe+0x78/0xc0
 work_for_cpu_fn+0x26/0x40
 process_one_work+0x3b6/0x6a0
 worker_thread+0x368/0x520
 kthread+0x165/0x1a0
 ret_from_fork+0x1f/0x30

This reproducer triggers that bug:

while:
do
    rmmod ixgbe
    sleep 0.5
    modprobe ixgbe
    sleep 0.5

When calling fill_kobj_path() to fill path, if the name length of
kobj becomes longer, return failure and retry. This fixes the problem.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2023-03-10 09:39:35 +01:00
..
842
…
crypto crypto: lib - remove unneeded selection of XOR_BLOCKS 2022-09-05 10:30:03 +02:00
dim dim: initialize all struct fields 2022-05-18 10:26:49 +02:00
fonts lib/fonts: fix undefined behavior in bit shift for get_default_font 2022-12-31 13:14:02 +01:00
kunit kunit: fix debugfs code to use enum kunit_status, not bool 2022-06-09 10:22:53 +02:00
livepatch selftests/livepatch: better synchronize test_klp_callbacks_busy 2022-08-17 14:24:03 +02:00
lz4 lz4: fix LZ4_decompress_safe_partial read out of bound 2022-04-13 20:59:21 +02:00
lzo lib/lzo/lzo1x_compress.c: make lzogeneric1x_1_compress() static 2020-12-15 22:46:19 -08:00
math math: make RATIONAL tristate 2021-09-08 11:50:26 -07:00
mpi lib/mpi: Fix buffer overrun when SG is too long 2023-03-10 09:39:09 +01:00
pldmfw lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
raid6 lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 2022-04-08 14:23:56 +02:00
reed_solomon lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
vdso lib/vdso: use "grep -E" instead of "egrep" 2022-12-02 17:41:08 +01:00
xz lib/xz: Validate the value before assigning it to an enum variable 2021-11-18 19:16:17 +01:00
zlib_deflate
…
zlib_dfltcc zlib: move EXPORT_SYMBOL() and MODULE_LICENSE() out of dfltcc_syms.c 2020-12-29 15:36:49 -08:00
zlib_inflate lib/zlib_inflate/inffast: check config in C to avoid unused function warning 2021-09-24 16:13:35 -07:00
zstd lib/decompressors: fix spelling mistakes 2021-07-01 11:06:05 -07:00
.gitignore .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
Kconfig crypto: memneq - move into lib/ 2022-06-22 14:22:03 +02:00
Kconfig.debug lib/Kconfig.debug: Allow BTF + DWARF5 with pahole 1.21+ 2023-02-25 12:06:46 +01:00
Kconfig.kasan kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS 2021-09-24 16:13:34 -07:00
Kconfig.kcsan kcsan: Make strict mode imply interruptible watchers 2021-07-20 13:49:44 -07:00
Kconfig.kfence kfence: default to dynamic branch instead of static keys mode 2021-11-12 15:05:49 +01:00
Kconfig.kgdb
…
Kconfig.ubsan ubsan: remove CONFIG_UBSAN_OBJECT_SIZE 2022-04-13 20:59:27 +02:00
Makefile crypto: memneq - move into lib/ 2022-06-22 14:22:03 +02:00
argv_split.c
…
ashldi3.c
…
ashrdi3.c
…
asn1_decoder.c Revert "lib: Revert use of fallthrough pseudo-keyword in lib/" 2020-11-18 14:15:17 -06:00
asn1_encoder.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
assoc_array.c assoc_array: Fix BUG_ON during garbage collect 2022-06-06 08:43:37 +02:00
atomic64.c locking/atomic: atomic64: support ARCH_ATOMIC 2021-05-26 13:20:50 +02:00
atomic64_test.c
…
audit.c
…
bcd.c
…
bch.c lib/bch.c: fix a typo in the file bch.c 2021-05-06 19:24:12 -07:00
bitfield_kunit.c
…
bitmap.c bitmap: extend comment to bitmap_print_bitmask/list_to_buf 2021-08-13 10:27:50 +02:00
bitrev.c
…
bootconfig.c memblock: introduce saner 'memblock_free_ptr()' interface 2021-09-14 13:23:22 -07:00
bsearch.c
…
btree.c
…
bucket_locks.c
…
bug.c bug: Assign values once in bug_get_file_line() 2021-04-01 09:54:37 +01:00
build_OID_registry
…
buildid.c kdump: use vmlinux_build_id to simplify 2021-07-08 11:48:22 -07:00
bust_spinlocks.c
…
check_signature.c
…
checksum.c
…
clz_ctz.c
…
clz_tab.c
…
cmdline.c lib/cmdline: Export next_arg() for being used in modules 2021-05-05 16:07:40 +02:00
cmdline_kunit.c lib/cmdline_kunit: Remove a cast which are no-longer required 2021-06-23 16:41:41 -06:00
cmpdi2.c
…
compat_audit.c
…
cpu_rmap.c
…
cpumask.c Revert "lib: Restrict cpumask_local_spread to houskeeping CPUs" 2021-02-05 23:28:29 +01:00
crc-ccitt.c
…
crc-itu-t.c
…
crc-t10dif.c
…
crc4.c
…
crc7.c lib/crc7: fix a kernel-doc markup 2021-01-21 14:06:00 -07:00
crc8.c lib: crc8: pointer to data block should be const 2021-05-06 19:24:12 -07:00
crc16.c
…
crc32.c
…
crc32defs.h
…
crc32test.c
…
crc64.c lib: crc64: fix kernel-doc warning 2021-06-05 08:58:12 -07:00
ctype.c
…
debug_info.c isystem: ship and use stdarg.h 2021-08-19 09:02:55 +09:00
debug_locks.c locking/lockdep: Improve noinstr vs errors 2021-06-22 13:56:43 +02:00
debugobjects.c lib/debugobjects: fix stat count and optimize debug_objects_mem_init 2022-12-31 13:14:01 +01:00
dec_and_lock.c
…
decompress.c
…
decompress_bunzip2.c lib/decompressors: fix spelling mistakes 2021-07-01 11:06:05 -07:00
decompress_inflate.c
…
decompress_unlz4.c lib/decompress_unlz4.c: correctly handle zero-padding around initrds. 2021-07-01 11:06:06 -07:00
decompress_unlzma.c lib: fix inconsistent indenting in process_bit1() 2021-05-06 19:24:12 -07:00
decompress_unlzo.c lib/decompressors: remove set but not used variabled 'level' 2021-07-01 11:06:06 -07:00
decompress_unxz.c lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression 2021-11-18 19:16:17 +01:00
decompress_unzstd.c lib/decompressors: fix spelling mistakes 2021-07-01 11:06:05 -07:00
devmem_is_allowed.c lib: use PFN_PHYS() in devmem_is_allowed() 2021-08-13 14:09:32 -10:00
devres.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
digsig.c crypto: sha - split sha.h into sha1.h and sha2.h 2020-11-20 14:45:33 +11:00
dump_stack.c lib/dump_stack: correct kernel-doc notation 2021-09-08 11:50:26 -07:00
dynamic_debug.c dyndbg: drop EXPORTed dynamic_debug_exec_queries 2022-10-26 12:35:08 +02:00
dynamic_queue_limits.c
…
earlycpio.c lib: remove "expecting prototype" kernel-doc warnings 2021-04-16 16:10:37 -07:00
errname.c printf: fix errname.c list 2023-03-10 09:39:33 +01:00
error-inject.c fault-injection: handle EI_ETYPE_TRUE 2020-12-15 22:46:19 -08:00
errseq.c kernel.h: split out mathematical helpers 2020-12-15 22:46:15 -08:00
extable.c sparc32: switch to generic extables 2021-01-03 20:05:18 -05:00
fault-inject-usercopy.c
…
fault-inject.c
…
fdt.c
…
fdt_addresses.c
…
fdt_empty_tree.c
…
fdt_ro.c
…
fdt_rw.c
…
fdt_strerror.c
…
fdt_sw.c
…
fdt_wip.c
…
find_bit.c lib: add fast path for find_first_*_bit() and find_last_bit() 2021-05-06 19:24:12 -07:00
find_bit_benchmark.c
…
flex_proportions.c
…
gen_crc32table.c
…
gen_crc64table.c
…
genalloc.c lib/genalloc: add parameter description to fix doc compile warning 2021-05-06 19:24:12 -07:00
generic-radix-tree.c
…
glob.c Revert "lib: Revert use of fallthrough pseudo-keyword in lib/" 2020-11-18 14:15:17 -06:00
globtest.c
…
hexdump.c hex2bin: fix access beyond string end 2022-05-09 09:14:30 +02:00
hweight.c
…
idr.c ida: don't use BUG_ON() for debugging 2022-07-12 16:35:18 +02:00
inflate.c
…
interval_tree.c
…
interval_tree_test.c
…
iomap.c
…
iomap_copy.c
…
iommu-helper.c
…
iov_iter.c fix short copy handling in copy_mc_pipe_to_iter() 2022-08-17 14:22:51 +02:00
irq_poll.c
…
irq_regs.c
…
is_single_threaded.c
…
kasprintf.c isystem: ship and use stdarg.h 2021-08-19 09:02:55 +09:00
kfifo.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
klist.c
…
kobject.c kobject: Fix slab-out-of-bounds in fill_kobj_path() 2023-03-10 09:39:35 +01:00
kobject_uevent.c kobject_uevent: remove warning in init_uevent_argv() 2021-04-10 11:09:41 +02:00
kstrtox.c Merge branch 'akpm' (patches from Andrew) 2021-07-02 12:08:10 -07:00
kstrtox.h lib: vsprintf: Fix handling of number field widths in vsscanf 2021-05-19 15:05:11 +02:00
libcrc32c.c
…
linear_ranges.c lib: add linear range get selector within 2021-08-13 18:37:38 +02:00
list-test.c list: test: Add a test for list_is_head() 2022-06-09 10:23:31 +02:00
list_debug.c lib/list_debug.c: Detect uninitialized lists 2022-08-25 11:40:40 +02:00
list_sort.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
llist.c
…
locking-selftest-hardirq.h
…
locking-selftest-mutex.h
…
locking-selftest-rlock-hardirq.h
…
locking-selftest-rlock-softirq.h
…
locking-selftest-rlock.h
…
locking-selftest-rsem.h
…
locking-selftest-rtmutex.h
…
locking-selftest-softirq.h
…
locking-selftest-spin-hardirq.h
…
locking-selftest-spin-softirq.h
…
locking-selftest-spin.h
…
locking-selftest-wlock-hardirq.h
…
locking-selftest-wlock-softirq.h
…
locking-selftest-wlock.h
…
locking-selftest-wsem.h
…
locking-selftest.c lockdep/selftest: Remove wait-type RCU_CALLBACK tests 2021-06-22 16:42:08 +02:00
lockref.c lockref: stop doing cpu_relax in the cmpxchg loop 2023-02-01 08:27:19 +01:00
logic_iomem.c lib/logic_iomem: correct fallback config references 2022-04-13 20:58:59 +02:00
logic_pio.c PCI: Fix pci_register_io_range() memory leak 2021-02-17 17:31:06 -06:00
lru_cache.c lib: remove "expecting prototype" kernel-doc warnings 2021-04-16 16:10:37 -07:00
lshrdi3.c
…
memcat_p.c
…
memneq.c crypto: memneq - move into lib/ 2022-06-22 14:22:03 +02:00
memory-notifier-error-inject.c
…
memregion.c
…
memweight.c
…
muldi3.c
…
net_utils.c
…
netdev-notifier-error-inject.c
…
nlattr.c netlink: prevent potential spectre v1 gadgets 2023-02-01 08:27:26 +01:00
nmi_backtrace.c printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces 2021-11-25 09:48:45 +01:00
nodemask.c nodemask: Fix return values to be unsigned 2022-06-14 18:36:24 +02:00
notifier-error-inject.c lib/notifier-error-inject: fix error when writing -errno to debugfs file 2022-12-31 13:14:03 +01:00
notifier-error-inject.h
…
objagg.c
…
of-reconfig-notifier-error-inject.c
…
oid_registry.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
once.c once: add DO_ONCE_SLOW() for sleepable contexts 2022-10-26 12:34:49 +02:00
packing.c net: update NXP copyright text 2021-09-17 13:52:17 +01:00
parman.c lib: remove "expecting prototype" kernel-doc warnings 2021-04-16 16:10:37 -07:00
parser.c kernel.h: split out kstrtox() and simple_strtox() to a separate header 2021-07-01 11:06:05 -07:00
pci_iomap.c pci_iounmap'2: Electric Boogaloo: try to make sense of it all 2021-09-19 17:13:35 -07:00
percpu-refcount.c percpu_ref_init(): clean ->percpu_count_ref on failure 2022-06-06 08:43:36 +02:00
percpu_counter.c lib/percpu_counter: tame kernel-doc compile warning 2021-05-06 19:24:12 -07:00
percpu_test.c
…
plist.c
…
pm-notifier-error-inject.c
…
radix-tree.c lib: remove "expecting prototype" kernel-doc warnings 2021-04-16 16:10:37 -07:00
random32.c random: replace custom notifier chain with standard one 2022-05-30 09:29:10 +02:00
ratelimit.c ratelimit: Fix data-races in ___ratelimit(). 2022-08-31 17:16:43 +02:00
rbtree.c
…
rbtree_test.c
…
refcount.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
rhashtable.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
sbitmap.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
scatterlist.c Merge branch 'akpm' (patches from Andrew) 2021-09-03 10:08:28 -07:00
seq_buf.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
sg_pool.c lib/scatterlist: Fix wrong update of orig_nents 2021-08-24 19:52:40 -03:00
sg_split.c
…
sha1.c lib/crypto: sha1: re-roll loops to reduce code size 2022-05-30 09:28:59 +02:00
show_mem.c
…
siphash.c siphash: use one source of truth for siphash permutations 2022-05-30 09:29:15 +02:00
slub_kunit.c mm/slub, kunit: add a KUnit test for SLUB debugging functionality 2021-06-29 10:53:46 -07:00
smp_processor_id.c lib/smp_processor_id: fix imbalanced instrumentation_end() call 2022-08-17 14:24:08 +02:00
sort.c lib: fix spelling mistakes 2021-07-08 11:48:20 -07:00
stackdepot.c stacktrace: move filter_irq_stacks() to kernel/stacktrace.c 2022-04-13 20:59:28 +02:00
stmp_device.c
…
string.c string: improve default out-of-line memcmp() implementation 2021-08-30 07:50:56 -07:00
string_helpers.c string: uninline memcpy_and_pad 2021-11-21 13:44:12 +01:00
strncpy_from_user.c lib/strncpy_from_user.c: Mask out bytes after NUL terminator. 2020-11-19 11:56:16 -08:00
strnlen_user.c
…
syscall.c sched: Change task_struct::state 2021-06-18 11:43:09 +02:00
test-kstrtox.c
…
test-string_helpers.c string_helpers: Escape double quotes in escape_special 2021-07-19 11:39:28 +02:00
test_bitmap.c lib: test_bitmap: add bitmap_print_bitmask/list_to_buf test cases 2021-08-13 10:27:49 +02:00
test_bitops.c lib/test: fix spelling mistakes 2021-07-08 11:48:20 -07:00
test_bits.c
…
test_blackhole_dev.c
…
test_bpf.c test_bpf: fix incorrect netdev features 2022-08-17 14:23:23 +02:00
test_debug_virtual.c
…
test_firmware.c test_firmware: fix memory leak in test_firmware_init() 2022-12-31 13:14:29 +01:00
test_fpu.c selftests/fpu: Fix debugfs_simple_attr.cocci warning 2021-01-18 11:03:26 +01:00
test_free_pages.c lib/test_free_pages.c: add basic progress indicators 2020-12-15 22:46:16 -08:00
test_hash.c
…
test_hexdump.c
…
test_hmm.c lib/test_hmm: avoid accessing uninitialized pages 2022-08-17 14:23:43 +02:00
test_hmm_uapi.h mm: selftests for exclusive device memory 2021-07-01 11:06:03 -07:00
test_ida.c
…
test_kasan.c kasan: test: Silence GCC 12 warnings 2022-08-17 14:23:05 +02:00
test_kasan_module.c kasan: test: avoid corrupting memory in kasan_rcu_uaf 2021-09-03 09:58:15 -07:00
test_kmod.c lib/test: use after free in register_test_dev_kmod() 2022-04-08 14:23:54 +02:00
test_linear_ranges.c
…
test_list_sort.c lib/test: convert lib/test_list_sort.c to use KUnit 2021-06-25 11:31:03 -06:00
test_lockup.c lib/test_lockup: fix kernel pointer check for separate address spaces 2022-04-08 14:24:01 +02:00
test_memcat_p.c
…
test_meminit.c lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test 2022-01-27 11:05:44 +01:00
test_min_heap.c
…
test_module.c
…
test_objagg.c
…
test_overflow.c overflow: Implement size_t saturating arithmetic helpers 2022-12-31 13:14:33 +01:00
test_parman.c
…
test_printf.c Merge branch 'akpm' (patches from Andrew) 2021-09-08 12:55:35 -07:00
test_rhashtable.c rhashtable: avoid -Wrestrict warning on overlapping sprintf output 2021-03-24 15:16:09 -07:00
test_scanf.c lib/test_scanf: split up number parsing test routines 2021-09-06 11:04:03 -07:00
test_siphash.c
…
test_sort.c lib/test: convert test_sort.c to use KUnit 2021-09-08 11:50:26 -07:00
test_stackinit.c lib/test_stackinit: Add assigned initializers 2021-08-22 00:21:36 -07:00
test_static_key_base.c
…
test_static_keys.c
…
test_string.c lib/test_string.c: allow module removal 2021-07-01 11:06:05 -07:00
test_strscpy.c
…
test_sysctl.c
…
test_ubsan.c ubsan: remove CONFIG_UBSAN_OBJECT_SIZE 2022-04-13 20:59:27 +02:00
test_user_copy.c
…
test_uuid.c
…
test_vmalloc.c lib/test_vmalloc.c: add a new 'nr_pages' parameter 2021-09-03 09:58:14 -07:00
test_xarray.c XArray: Fix xas_create_range() when multi-order entry present 2022-04-08 14:24:09 +02:00
textsearch.c
…
timerqueue.c rbtree, timerqueue: Use rb_add_cached() 2021-02-17 14:08:01 +01:00
ts_bm.c
…
ts_fsm.c Revert "lib: Revert use of fallthrough pseudo-keyword in lib/" 2020-11-18 14:15:17 -06:00
ts_kmp.c
…
ubsan.c panic: Consolidate open-coded panic_on_warn checks 2023-02-01 08:27:22 +01:00
ubsan.h ubsan: implement __ubsan_handle_alignment_assumption 2021-02-05 11:03:47 -08:00
ucmpdi2.c
…
ucs2_string.c
…
usercopy.c uaccess: Add speculation barrier to copy_from_user() 2023-02-25 12:06:44 +01:00
uuid.c
…
vsprintf.c random: replace custom notifier chain with standard one 2022-05-30 09:29:10 +02:00
win_minmax.c
…
xarray.c XArray: Update the LRU list in xas_split() 2022-04-08 14:24:09 +02:00
xxhash.c
…