mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 23:13:01 +02:00

Go to file

Shigeru Yoshida f615fccfc6 bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() [ Upstream commit `6b3d638ca8` ] KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's data that didn't contain an Ethernet header. This occurs when bpf_prog_test_run_xdp() passes an invalid value as the user_data argument to bpf_test_init(). Fix this by returning an error when user_data is less than ETH_HLEN in bpf_test_init(). Additionally, remove the check for "if (user_size > size)" as it is unnecessary. [1] BUG: KMSAN: use-after-free in eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] BUG: KMSAN: use-after-free in eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 eth_skb_pkt_type include/linux/etherdevice.h:627 [inline] eth_type_trans+0x4ee/0x980 net/ethernet/eth.c:165 __xdp_build_skb_from_frame+0x5a8/0xa50 net/core/xdp.c:635 xdp_recv_frames net/bpf/test_run.c:272 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2954/0x3330 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0x148e/0x1b10 net/bpf/test_run.c:1318 bpf_prog_test_run+0x5b7/0xa30 kernel/bpf/syscall.c:4371 __sys_bpf+0x6a6/0xe20 kernel/bpf/syscall.c:5777 __do_sys_bpf kernel/bpf/syscall.c:5866 [inline] __se_sys_bpf kernel/bpf/syscall.c:5864 [inline] __x64_sys_bpf+0xa4/0xf0 kernel/bpf/syscall.c:5864 x64_sys_call+0x2ea0/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: free_pages_prepare mm/page_alloc.c:1056 [inline] free_unref_page+0x156/0x1320 mm/page_alloc.c:2657 __free_pages+0xa3/0x1b0 mm/page_alloc.c:4838 bpf_ringbuf_free kernel/bpf/ringbuf.c:226 [inline] ringbuf_map_free+0xff/0x1e0 kernel/bpf/ringbuf.c:235 bpf_map_free kernel/bpf/syscall.c:838 [inline] bpf_map_free_deferred+0x17c/0x310 kernel/bpf/syscall.c:862 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa2b/0x1b60 kernel/workqueue.c:3310 worker_thread+0xedf/0x1550 kernel/workqueue.c:3391 kthread+0x535/0x6b0 kernel/kthread.c:389 ret_from_fork+0x6e/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 CPU: 1 UID: 0 PID: 17276 Comm: syz.1.16450 Not tainted 6.12.0-05490-g9bb88c659673 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Fixes: `be3d72a289` ("bpf: move user_size out of bpf_test_init") Reported-by: syzkaller <syzkaller@googlegroups.com> Suggested-by: Martin KaFai Lau <martin.lau@linux.dev> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20250121150643.671650-1-syoshida@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-03-07 16:56:37 +01:00
arch	powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC	2025-03-07 16:56:34 +01:00
block	partitions: mac: fix handling of bogus partition table	2025-02-21 13:50:05 +01:00
certs
crypto	crypto: api - Add crypto_clone_tfm	2024-12-14 19:53:51 +01:00
Documentation	kconfig: add warn-unknown-symbols sanity check	2025-02-21 13:49:24 +01:00
drivers	drm/rcar-du: dsi: Fix PHY lock bit check	2025-03-07 16:56:37 +01:00
fs	f2fs: fix to wait dio completion	2025-02-21 13:50:12 +01:00
include	tcp: drop secpath at the same time as we currently drop dst	2025-03-07 16:56:36 +01:00
init	initramfs: avoid filename buffer overrun	2024-12-14 19:53:14 +01:00
io_uring	io_uring/rw: commit provided buffer state on async	2025-02-21 13:49:53 +01:00
ipc	ipc: fix memleak if msg_init_ns failed in create_ipc_ns	2024-12-14 19:54:06 +01:00
kernel	kdb: Do not assume write() callback available	2025-02-21 13:50:09 +01:00
lib	maple_tree: simplify split calculation	2025-02-21 13:49:55 +01:00
LICENSES
mm	memcg: fix soft lockup in the OOM process	2025-03-07 16:56:29 +01:00
net	bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()	2025-03-07 16:56:37 +01:00
rust	rust: macros: provide correct provenance when constructing THIS_MODULE	2024-10-17 15:22:24 +02:00
samples	samples/landlock: Fix possible NULL dereference in parse_path()	2025-02-21 13:49:03 +01:00
scripts	kbuild: Move -Wenum-enum-conversion to W=2	2025-02-21 13:49:46 +01:00
security	tomoyo: don't emit warning in tomoyo_write_control()	2025-02-21 13:49:31 +01:00
sound	ALSA: hda/cirrus: Correct the full scale volume set logic	2025-03-07 16:56:34 +01:00
tools	selftests: rtnetlink: update netdevsim ipsec output format	2025-02-21 13:50:11 +01:00
usr
virt	KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()	2024-06-27 13:46:21 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore	Remove *.orig pattern from .gitignore	2024-10-17 15:21:15 +02:00
.mailmap
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS	MAINTAINERS: add leah to 6.1 MAINTAINERS file	2024-05-17 11:56:16 +02:00
Makefile	Linux 6.1.129	2025-02-21 13:50:12 +01:00
README

README

Linux kernel

There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first.

In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentation can also be read online at:

https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory, several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the requirements for building and running the kernel, and information about the problems which may result by upgrading your kernel.