MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-08-22 00:42:01 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
v6.6.99
linux-yocto/arch/arm64/kernel
History
Tengda Wu 21da6d3561 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() 
[ Upstream commit 39dfc971e4 ]

KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth().

Call Trace:
[   97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8
[   97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550
[   97.285732]
[   97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11
[   97.287032] Hardware name: linux,dummy-virt (DT)
[   97.287815] Call trace:
[   97.288279]  dump_backtrace+0xa0/0x128
[   97.288946]  show_stack+0x20/0x38
[   97.289551]  dump_stack_lvl+0x78/0xc8
[   97.290203]  print_address_description.constprop.0+0x84/0x3c8
[   97.291159]  print_report+0xb0/0x280
[   97.291792]  kasan_report+0x84/0xd0
[   97.292421]  __asan_load8+0x9c/0xc0
[   97.293042]  regs_get_kernel_stack_nth+0xa8/0xc8
[   97.293835]  process_fetch_insn+0x770/0xa30
[   97.294562]  kprobe_trace_func+0x254/0x3b0
[   97.295271]  kprobe_dispatcher+0x98/0xe0
[   97.295955]  kprobe_breakpoint_handler+0x1b0/0x210
[   97.296774]  call_break_hook+0xc4/0x100
[   97.297451]  brk_handler+0x24/0x78
[   97.298073]  do_debug_exception+0xac/0x178
[   97.298785]  el1_dbg+0x70/0x90
[   97.299344]  el1h_64_sync_handler+0xcc/0xe8
[   97.300066]  el1h_64_sync+0x78/0x80
[   97.300699]  kernel_clone+0x0/0x500
[   97.301331]  __arm64_sys_clone+0x70/0x90
[   97.302084]  invoke_syscall+0x68/0x198
[   97.302746]  el0_svc_common.constprop.0+0x11c/0x150
[   97.303569]  do_el0_svc+0x38/0x50
[   97.304164]  el0_svc+0x44/0x1d8
[   97.304749]  el0t_64_sync_handler+0x100/0x130
[   97.305500]  el0t_64_sync+0x188/0x190
[   97.306151]
[   97.306475] The buggy address belongs to stack of task 1.sh/2550
[   97.307461]  and is located at offset 0 in frame:
[   97.308257]  __se_sys_clone+0x0/0x138
[   97.308910]
[   97.309241] This frame has 1 object:
[   97.309873]  [48, 184) 'args'
[   97.309876]
[   97.310749] The buggy address belongs to the virtual mapping at
[   97.310749]  [ffff800089270000, ffff800089279000) created by:
[   97.310749]  dup_task_struct+0xc0/0x2e8
[   97.313347]
[   97.313674] The buggy address belongs to the physical page:
[   97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a
[   97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff)
[   97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000
[   97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[   97.319445] page dumped because: kasan: bad access detected
[   97.320371]
[   97.320694] Memory state around the buggy address:
[   97.321511]  ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   97.322681]  ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00
[   97.325023]                          ^
[   97.325683]  ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3
[   97.326856]  ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00

This issue seems to be related to the behavior of some gcc compilers and
was also fixed on the s390 architecture before:

 commit d93a855c31 ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()")

As described in that commit, regs_get_kernel_stack_nth() has confirmed that
`addr` is on the stack, so reading the value at `*addr` should be allowed.
Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case.

Fixes: 0a8ea52c3e ("arm64: Add HAVE_REGS_AND_STACK_ACCESS_API feature")
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Link: https://lore.kernel.org/r/20250604005533.1278992-1-wutengda@huaweicloud.com
[will: Use '*addr' as the argument to READ_ONCE_NOCHECK()]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-06-27 11:09:04 +01:00
..
pi arm64: unwind: add asynchronous unwind tables to kernel and modules 2022-11-09 18:06:35 +00:00
probes arm64: probes: Disable kprobes/uprobes on MOPS instructions 2024-12-09 10:31:42 +01:00
vdso arm64: Handle .ARM.attributes section in linker scripts 2025-02-21 13:57:19 +01:00
vdso32 kbuild: unify vdso_install rules 2024-06-12 11:12:32 +02:00
.gitignore
acpi_numa.c arm64: acpi: Move get_cpu_for_acpi_id() to a header 2024-09-12 11:11:42 +02:00
acpi_parking_protocol.c
acpi.c arm64: acpi: Fix possible memory leak of ffh_ctxt 2023-02-24 14:21:49 +00:00
alternative.c Merge branches 'for-next/kpti', 'for-next/missing-proto-warn', 'for-next/iss2-decode', 'for-next/kselftest', 'for-next/misc', 'for-next/feat_mops', 'for-next/module-alloc', 'for-next/sysreg', 'for-next/cpucap', 'for-next/acpi', 'for-next/kdump', 'for-next/acpi-doc', 'for-next/doc' and 'for-next/tpidr2-fix', remote-tracking branch 'arm64/for-next/perf' into for-next/core 2023-06-23 18:32:20 +01:00
armv8_deprecated.c arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process 2024-07-25 09:50:43 +02:00
asm-offsets.c arm64: ftrace: fix build error with CONFIG_FUNCTION_GRAPH_TRACER=n 2023-07-05 09:46:19 -04:00
cacheinfo.c arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array 2025-02-21 13:57:07 +01:00
compat_alignment.c arm64: Don't call NULL in do_compat_alignment_fixup() 2025-04-10 14:37:43 +02:00
cpu_errata.c arm64: errata: Expand speculative SSBS workaround once more 2024-10-10 11:58:02 +02:00
cpu_ops.c
cpu-reset.S arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text 2023-05-02 12:42:22 +01:00
cpufeature.c arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented 2025-02-21 13:57:26 +01:00
cpuidle.c arm64: Explicitly include correct DT includes 2023-07-31 14:45:38 +01:00
cpuinfo.c arm64: add HWCAP for FEAT_HBC (hinted conditional branches) 2023-08-04 17:32:13 +01:00
crash_core.c arm64: move PAC masks to <asm/pointer_auth.h> 2023-04-13 12:27:11 +01:00
crash_dump.c
debug-monitors.c arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-04-14 13:39:47 +01:00
efi-header.S arm64: efi: Enable BTI codegen and add PE/COFF annotation 2023-04-20 15:43:45 +02:00
efi-rt-wrapper.S arm64: efi: Avoid workqueue to check whether EFI runtime is live 2023-01-16 15:27:31 +01:00
efi.c drm for 6.6-rc1 2023-08-30 13:34:34 -07:00
elfcore.c arm64: mte: Avoid the racy walk of the vma list during core dump 2023-01-05 15:12:12 +00:00
entry-common.c arm64/fpsimd: Do not discard modified SVE state 2025-06-19 15:28:08 +02:00
entry-fpsimd.S arm64/sme: Implement context switching for ZT0 2023-01-20 12:23:06 +00:00
entry-ftrace.S arm64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL 2023-06-20 18:38:37 -04:00
entry.S arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD 2024-01-31 16:18:55 -08:00
fpsimd.c arm64/fpsimd: Do not discard modified SVE state 2025-06-19 15:28:08 +02:00
ftrace.c arm64: module: mandate MODULE_PLTS 2023-06-06 17:39:05 +01:00
head.S arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H 2024-04-27 17:11:41 +02:00
hibernate-asm.S
hibernate.c arm64: hibernate: remove WARN_ON in save_processor_state 2023-06-21 13:33:49 +01:00
hw_breakpoint.c hw_breakpoint: fix single-stepping when using bpf_overflow_handler 2023-08-18 17:04:09 +01:00
hyp-stub.S ARM64: 2023-07-03 15:32:22 -07:00
idle.c arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled 2023-01-13 11:48:15 +01:00
idreg-override.c arm64/sysreg: Fix broken strncpy() -> strscpy() conversion 2023-09-06 19:22:54 +01:00
image-vars.h efi/zboot: arm64: Inject kernel code size symbol into the zboot payload 2023-04-26 18:01:41 +02:00
image.h
io.c
irq.c arm64: irq: set the correct node for shadow call stack 2024-02-05 20:14:38 +00:00
jump_label.c arm64: jump_label: Ensure patched jump_labels are visible to all CPUs 2024-08-11 12:47:24 +02:00
kaslr.c Merge branch for-next/module-alloc into kvmarm/next 2023-06-15 13:04:15 +00:00
kexec_image.c arm64: Fix dangling references to Documentation/arm64 2023-06-21 08:53:31 -06:00
kgdb.c arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step 2023-04-14 13:39:47 +01:00
kuser32.S arm64: Update Documentation/arm references 2023-06-12 06:33:48 -06:00
machine_kexec_file.c
machine_kexec.c Merge branch 'for-next/misc' into for-next/core 2023-04-20 11:22:09 +01:00
Makefile - Arnd Bergmann has fixed a bunch of -Wmissing-prototypes in 2023-06-28 10:59:38 -07:00
module-plts.c arm64: module: Fix PLT counting when CONFIG_RANDOMIZE_BASE=n 2023-11-28 17:20:00 +00:00
module.c arm64: module: rework module VA range selection 2023-06-06 17:39:06 +01:00
mte.c arm64: mte: simplify swap tag restoration logic 2023-08-18 10:12:02 -07:00
paravirt.c arm64: paravirt: remove conduit check in has_pv_steal_clock 2022-11-09 18:11:56 +00:00
patch-scs.c arm64: Apply dynamic shadow call stack patching in two passes 2023-01-26 17:54:15 +00:00
patching.c arm64: patching: Add aarch64_insn_write_literal_u64() 2023-01-24 11:49:43 +00:00
pci.c arm64: Explicitly include correct DT includes 2023-07-31 14:45:38 +01:00
perf_callchain.c arm64: use XPACLRI to strip PAC 2023-04-13 12:27:11 +01:00
perf_regs.c
pointer_auth.c
process.c arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled 2024-12-09 10:32:50 +01:00
proton-pack.c arm64: Add support for HIP09 Spectre-BHB mitigation 2025-06-04 14:41:54 +02:00
psci.c
ptrace.c arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() 2025-06-27 11:09:04 +01:00
reloc_test_core.c
reloc_test_syms.S
relocate_kernel.S
return_address.c
sdei.c arm64: sdei: abort running SDEI handlers during crash 2023-08-04 17:35:33 +01:00
setup.c of/fdt: add dt_phys arg to early_init_dt_scan and early_init_dt_verify 2024-12-09 10:31:56 +01:00
signal.c arm64/signal: Don't assume that TIF_SVE means we saved SVE state 2024-02-23 09:25:13 +01:00
signal32.c x86/shstk: Add user control-protection fault handler 2023-08-02 15:01:50 -07:00
sigreturn32.S
sleep.S arm64: kernel: remove SHF_WRITE|SHF_EXECINSTR from .idmap.text 2023-05-02 12:42:22 +01:00
smccc-call.S arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-11-14 13:19:38 +01:00
smp_spin_table.c
smp.c arm64: Fix KASAN random tag seed initialization 2024-08-29 17:33:30 +02:00
stacktrace.c arm64: use XPACLRI to strip PAC 2023-04-13 12:27:11 +01:00
suspend.c arm64/sme: Restore SME registers on exit from suspend 2024-03-01 13:35:08 +01:00
sys_compat.c
sys.c
sys32.c
syscall.c randomize_kstack: Remove non-functional per-arch entropy filtering 2024-07-05 09:33:54 +02:00
time.c
topology.c
trace-events-emulation.h
traps.c - Yosry Ahmed brought back some cgroup v1 stats in OOM logs. 2023-06-28 10:28:11 -07:00
vdso-wrap.S
vdso.c arm64: vdso: Pass (void *) to virt_to_page() 2023-05-16 14:53:36 +01:00
vdso32-wrap.S
vmlinux.lds.S arm64: Handle .ARM.attributes section in linker scripts 2025-02-21 13:57:19 +01:00
watchdog_hld.c arm64: enable perf events based hard lockup detector 2023-06-09 17:44:22 -07:00