No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Piotr Krysiuk 2da0540739 bpf: Fix off-by-one for area size in creating mask to left
commit 10d2bb2e6b1d8c4576c56a748f697dbeb8388899 upstream.

retrieve_ptr_limit() computes the ptr_limit for registers with stack and
map_value type. ptr_limit is the size of the memory area that is still
valid / in-bounds from the point of the current position and direction
of the operation (add / sub). This size will later be used for masking
the operation such that attempting out-of-bounds access in the speculative
domain is redirected to remain within the bounds of the current map value.

When masking to the right the size is correct, however, when masking to
the left, the size is off-by-one which would lead to an incorrect mask
and thus incorrect arithmetic operation in the non-speculative domain.
Piotr found that if the resulting alu_limit value is zero, then the
BPF_MOV32_IMM() from the fixup_bpf_calls() rewrite will end up loading
0xffffffff into AX instead of sign-extending to the full 64 bit range,
and as a result, this allows abuse for executing speculatively out-of-
bounds loads against 4GB window of address space and thus extracting the
contents of kernel memory via side-channel.

Fixes: 979d63d50c ("bpf: prevent out of bounds speculation on pointer arithmetic")
Signed-off-by: Piotr Krysiuk <piotras@gmail.com>
Co-developed-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-20 10:39:46 +01:00
arch KVM: arm64: nvhe: Save the SPE context early 2021-03-20 10:39:46 +01:00
block blk-settings: align max_sectors on "logical_block_size" boundary 2021-03-04 10:26:40 +01:00
certs certs: Fix blacklist flag type confusion 2021-03-04 10:26:29 +01:00
crypto crypto: tcrypt - avoid signed overflow in byte count 2021-03-07 12:20:46 +01:00
Documentation KVM: arm64: Reject VM creation when the default IPA size is unsupported 2021-03-17 17:03:57 +01:00
drivers xen/events: avoid handling the same event on two cpus at the same time 2021-03-17 17:03:58 +01:00
fs binfmt_misc: fix possible deadlock in bm_register_write 2021-03-17 17:03:57 +01:00
include include/linux/sched/mm.h: use rcu_dereference in in_vfork() 2021-03-17 17:03:56 +01:00
init fgraph: Initialize tracing_graph_pause at task creation 2021-02-10 09:25:29 +01:00
ipc
kernel bpf: Fix off-by-one for area size in creating mask to left 2021-03-20 10:39:46 +01:00
lib PCI: Fix pci_register_io_range() memory leak 2021-03-17 17:03:44 +01:00
LICENSES
mm Revert "mm, slub: consider rest of partial list if acquire_slab() fails" 2021-03-17 17:03:34 +01:00
net SUNRPC: Set memalloc_nofs_save() for sync tasks 2021-03-17 17:03:56 +01:00
samples samples, bpf: Add missing munmap in xdpsock 2021-03-17 17:03:33 +01:00
scripts ftrace: Have recordmcount use w8 to read relp->r_info in arm64_is_fake_mcount 2021-03-09 11:09:39 +01:00
security Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities") 2021-03-17 17:03:47 +01:00
sound ALSA: usb-audio: Apply the control quirk to Plantronics headsets 2021-03-17 17:03:47 +01:00
tools perf traceevent: Ensure read cmdlines are null terminated. 2021-03-17 17:03:37 +01:00
usr
virt KVM: arm64: Ensure I-cache isolation between vcpus of a same VM 2021-03-17 17:03:57 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.106 2021-03-17 17:03:58 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.