Kees Cook
5bc391944d
uaccess: Add minimum bounds check on kernel buffer size ...
[ Upstream commit 04ffde1319a715bd0550ded3580d4ea3bc003776 ]
While there is logic about the difference between ksize and usize,
copy_struct_from_user() didn't check the size of the destination buffer
(when it was known) against ksize. Add this check so there is an upper
bounds check on the possible memset() call, otherwise lower bounds
checks made by callers will trigger bounds warnings under -Warray-bounds.
Seen under GCC 13:
In function 'copy_struct_from_user',
inlined from 'iommufd_fops_ioctl' at
../drivers/iommu/iommufd/main.c:333:8:
../include/linux/fortify-string.h:59:33: warning: '__builtin_memset' offset [57, 4294967294] is out of the bounds [0, 56] of object 'buf' with type 'union ucmd_buffer' [-Warray-bounds=]
59 | #define __underlying_memset __builtin_memset
| ^
../include/linux/fortify-string.h:453:9: note: in expansion of macro '__underlying_memset'
453 | __underlying_memset(p, c, __fortify_size); \
| ^~~~~~~~~~~~~~~~~~~
../include/linux/fortify-string.h:461:25: note: in expansion of macro '__fortify_memset_chk'
461 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \
| ^~~~~~~~~~~~~~~~~~~~
../include/linux/uaccess.h:334:17: note: in expansion of macro 'memset'
334 | memset(dst + size, 0, rest);
| ^~~~~~
../drivers/iommu/iommufd/main.c: In function 'iommufd_fops_ioctl':
../drivers/iommu/iommufd/main.c:311:27: note: 'buf' declared here
311 | union ucmd_buffer buf;
| ^~~
Cc: Christian Brauner <brauner@kernel.org>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Dinh Nguyen <dinguyen@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Alexander Potapenko <glider@google.com>
Acked-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/lkml/20230203193523.never.667-kees@kernel.org/
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-11 16:43:56 +01:00
can: sja1000: fix size of OCR_MODE_MASK define
2022-12-19 12:24:16 +01:00
iio: st_sensors: Add a local lock for protecting odr
2022-06-14 18:11:59 +02:00
net: xgene: Move shared header file into include/linux
2023-02-06 07:52:47 +01:00
mfd: t7l66xb: Drop platform disable callback
2022-08-25 11:18:04 +02:00
RDMA/mlx4: Do not map the core_clock page to user space unless enabled
2021-06-16 11:59:44 +02:00
net/mlx5: Fix possible use-after-free in async command interface
2022-11-03 23:56:56 +09:00
mmc: core: Fix ambiguous TRIM and DISCARD arg
2022-12-08 11:23:04 +01:00
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
2022-06-14 18:12:03 +02:00
netfilter: ebtables: reject blobs that don't provide all entry points
2022-09-05 10:27:41 +02:00
platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
2022-09-15 12:04:50 +02:00
power: supply: max17042_battery: fix typo in MAx17042_TOFF
2021-09-15 09:47:27 +02:00
exit: Add and use make_task_dead.
2023-02-06 07:52:49 +01:00
SUNRPC: ensure the matching upcall is in-flight upon downcall
2023-01-18 11:41:56 +01:00
usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles
2022-09-15 12:04:52 +02:00
arm64: entry: Add vectors that have the bhb mitigation sequences
2022-03-19 13:40:15 +01:00
ata: fix ata_id_has_dipm()
2022-10-26 13:22:39 +02:00
block: return the correct bvec when checking for gaps
2021-07-14 16:53:48 +02:00
bitfield.h: Fix "type of reg too small for mask" test
2022-07-29 17:14:18 +02:00
block: don't merge across cgroup boundaries if blkcg is enabled
2022-04-15 14:18:01 +02:00
block: return ELEVATOR_DISCARD_MERGE if possible
2022-05-25 09:14:38 +02:00
x86/speculation: Add missing prototype for unpriv_ebpf_notify()
2022-06-14 18:11:34 +02:00
bpf: Fix pointer arithmetic mask tightening under state pruning
2021-09-15 09:47:39 +02:00
fs: only do a memory barrier for the first set_buffer_uptodate()
2022-09-15 12:04:49 +02:00
drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
2021-09-26 14:07:10 +02:00
cgroup: Use separate src/dst nodes when preloading css_sets for migration
2022-07-21 20:59:17 +02:00
memcg: fix possible use-after-free in memcg_write_event_control()
2022-12-14 11:30:43 +01:00
clk: Provide new devm_clk helpers for prepared and enabled clocks
2023-02-06 07:52:34 +01:00
compiler.h: Introduce absolute_pointer macro
2021-09-30 10:09:25 +02:00
serial: core: Fix initializing and restoring termios speed
2021-11-17 09:48:25 +01:00
vt: Fix character height handling with VT_RESIZEX
2021-05-26 12:05:20 +02:00
x86/bugs: Report AMD retbleed vulnerability
2022-10-07 09:16:54 +02:00
random: clear fast pool, crng, and batches in cpuhp bring up
2022-06-22 14:11:12 +02:00
debugfs: fix error when writing negative value to atomic_t debugfs file
2023-01-18 11:40:56 +01:00
PM/devfreq: governor: Add a private governor_data for governor
2023-01-18 11:41:52 +01:00
dm: remove special-casing of bio-based immutable singleton target on NVMe
2022-06-25 12:44:35 +02:00
PCI/MSI: Protect msi_desc::masked for multi-MSI
2021-08-18 08:57:03 +02:00
linux/dim: Fix divide by 0 in RDMA DIM
2022-07-07 17:36:49 +02:00
dma-mapping: add generic helpers for mapping sgtable objects
2023-02-25 11:53:25 +01:00
dyndbg: fix module.dyndbg handling
2022-10-26 13:22:37 +02:00
efi: random: reduce seed size to 32 bytes
2022-11-10 17:57:55 +01:00
kyber: fix out of bounds access when preempted
2021-05-19 10:08:30 +02:00
elfcore: correct reference to CONFIG_UML
2021-10-27 09:54:27 +02:00
PM: EM: Increase energy calculation precision
2021-09-15 09:47:33 +02:00
etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
2022-04-27 13:50:45 +02:00
eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
2023-01-18 11:40:58 +01:00
fbcon: Prevent that screen size is smaller than font size
2022-07-12 16:30:47 +02:00
bpf: Prevent increasing bpf_jit_limit above max
2021-11-17 09:48:20 +01:00
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
2023-01-18 11:40:55 +01:00
devtmpfs regression fix: reconfigure on each mount
2022-01-20 09:19:17 +01:00
fscrypt: add fscrypt_symlink_getattr() for computing st_size
2021-09-12 08:56:38 +02:00
fsnotify: invalidate dcache before IN_DELETE event
2022-02-01 17:24:39 +01:00
module/ftrace: handle patchable-function-entry
2022-02-23 11:59:56 +01:00
HID: quirks: Allow inverting the absolute X/Y values
2022-01-27 09:19:43 +01:00
mm/highmem: Lift memcpy_[to|from]_page to core
2023-01-18 11:41:55 +01:00
hrtimer: Ensure timerfd notification for HIGHRES=n
2021-09-15 09:47:26 +02:00
mm/thp: make is_huge_zero_pmd() safe and quicker
2021-06-30 08:47:52 -04:00
hugetlb: check for undefined shift on 32 bit architectures
2023-02-22 12:50:39 +01:00
random: pull add_hwgenerator_randomness() declaration into random.h
2022-06-22 14:11:12 +02:00
i2c: Add I2C_AQ_NO_REP_START adapter quirk
2021-05-19 10:08:22 +02:00
net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
2022-03-23 09:12:07 +01:00
net: igmp: increase size of mr_ifc_count
2021-08-18 08:57:01 +02:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-03-11 16:43:42 +01:00
iomap: iomap that extends beyond EOF should be marked dirty
2022-09-28 11:03:58 +02:00
iommu: Add gfp parameter to iommu_ops::map
2023-02-22 12:50:31 +01:00
iommu/iova: Fix module config properly
2022-10-26 13:22:46 +02:00
shm: extend forced shm destroy to support objects from several IPC nses
2021-12-01 09:23:35 +01:00
ipv6: make mc_forwarding atomic
2022-04-15 14:18:32 +02:00
genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
2021-08-18 08:57:02 +02:00
panic: Consolidate open-coded panic_on_warn checks
2023-02-06 07:52:50 +01:00
genirq: Fix the return type of kstat_cpu_irqs_sum()
2023-03-11 16:43:38 +01:00
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
2022-07-02 16:28:50 +02:00
kfifo: fix kfifo_to_user() return type
2022-08-25 11:18:04 +02:00
kprobes: Limit max data_size of the kretprobe instances
2021-12-08 09:01:10 +01:00
x86/kvm/vmx: Make noinstr clean
2022-10-07 09:16:54 +02:00
libata: fix read log timeout value
2021-11-17 09:48:17 +01:00
include/linux/list.h: add a macro to test if entry is pointing to the head
2021-09-22 12:26:20 +02:00
binder: use cred instead of task for selinux checks
2021-11-17 09:48:16 +01:00
mailbox: forward the hrtimer if not queued and under a lock
2022-06-14 18:11:42 +02:00
ext4: fix deadlock due to mbcache entry corruption
2023-01-18 11:41:56 +01:00
rtc: mc146818-lib: Fix the AltCentury for AMD platforms
2022-05-25 09:14:32 +02:00
net: mdio: introduce a shutdown method to mdio device drivers
2021-10-09 14:39:49 +02:00
memblock: fix memblock_phys_alloc() section mismatch error
2022-01-05 12:37:44 +01:00
mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
2021-08-26 08:36:22 -04:00
mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
2021-09-22 12:26:43 +02:00
mmap locking API: initial implementation as rwsem wrappers
2022-07-29 17:14:18 +02:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
mmap locking API: initial implementation as rwsem wrappers
2022-07-29 17:14:18 +02:00
mm: Fix '.data.once' orphan section warning
2022-12-08 11:23:04 +01:00
arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
2022-05-15 19:54:46 +02:00
x86/cpu: Add a steppings field to struct x86_cpu_id
2022-10-07 09:16:54 +02:00
PCI/MSI: Protect msi_desc::masked for multi-MSI
2021-08-18 08:57:03 +02:00
net: Fix features skip in for_each_netdev_feature()
2022-05-18 09:47:24 +02:00
net: add atomic_long_t to net_device_stats fields
2023-01-18 11:41:37 +01:00
NFS: swap IO handling is slightly different for O_DIRECT IO
2022-04-15 14:18:35 +02:00
watchdog: export lockup_detector_reconfigure
2022-08-25 11:18:37 +02:00
nodemask: Fix return values to be unsigned
2022-06-14 18:12:02 +02:00
uaccess: Add speculation barrier to copy_from_user()
2023-02-25 11:53:26 +01:00
nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
2023-01-18 11:41:43 +01:00
of: clk: Make <linux/of_clk.h> self-contained
2021-12-08 09:01:08 +01:00
once: fix section mismatch on clang builds
2022-11-01 19:06:42 +01:00
mm, oom: make the calculation of oom badness more accurate
2021-09-03 10:08:12 +02:00
mm, futex: fix shared futex pgoff on shmem huge page
2021-06-30 08:47:55 -04:00
PCI/ACPI: Add Ampere Altra SOC MCFG quirk
2021-09-26 14:07:05 +02:00
PCI: Reduce warnings on possible RW1C corruption
2022-04-15 14:18:15 +02:00
PCI: Add defines for normal and subtractive PCI bridges
2022-08-25 11:17:25 +02:00
perf: Protect perf_guest_cbs with RCU
2022-01-20 09:19:18 +01:00
PM: runtime: Fix unpaired parent child_count for force_resume
2021-05-19 10:08:20 +02:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
2023-01-18 11:41:02 +01:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
ptp: improve max_adj check against unreasonable values
2021-06-23 14:41:26 +02:00
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
2022-06-14 18:11:24 +02:00
quota: Factor out setup of quota inode
2023-01-18 11:42:02 +01:00
random: always mix cycle counter in add_latent_entropy()
2023-02-25 11:53:25 +01:00
random: quiet urandom warning ratelimit suppression message
2022-06-29 08:58:45 +02:00
locking/refcount: Consolidate implementations of refcount_t
2022-07-29 17:14:17 +02:00
tracing/ring-buffer: Have polling block on watermark
2022-12-08 11:23:05 +01:00
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
2022-09-05 10:27:46 +02:00
rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
2021-11-17 09:48:44 +01:00
misc: rtsx_usb: use separate command and response buffers
2022-07-12 16:30:49 +02:00
scatterlist: add generic wrappers for iterating over sgtable objects
2023-02-25 11:53:25 +01:00
kernel/sched: Remove dl_boosted flag comment
2022-09-05 10:27:39 +02:00
lockdown: also lock down previous kgdb use
2022-06-06 08:33:48 +02:00
serial: Create uart_xmit_advance()
2022-09-28 11:04:08 +02:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
io_uring/af_unix: defer registered files gc to io_uring release
2022-10-26 13:22:59 +02:00
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
2023-02-22 12:50:34 +01:00
PM: s2idle: ACPI: Fix wakeup interrupts handling
2022-02-16 12:52:50 +01:00
sysctl: add a new register_sysctl_init() interface
2023-02-06 07:52:48 +01:00
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
2022-10-26 13:22:26 +02:00
tee: export teedev_open() and teedev_close_context()
2022-03-02 11:41:04 +01:00
thermal/core: Fix thermal_cooling_device_register() prototype
2021-09-26 14:07:10 +02:00
Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
2021-09-16 12:56:13 +02:00
timerqueue: Use rb_entry_safe() in timerqueue_getnext()
2023-01-18 11:40:53 +01:00
timekeeping: Add raw clock fallback for random_get_entropy()
2022-06-22 14:11:15 +02:00
sched/topology: Make sched_init_numa() use a set for the deduplicating sort
2022-03-08 19:07:48 +01:00
efi: tpm: Avoid READ_ONCE() for accessing the event log
2023-01-18 11:42:00 +01:00
tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2021-07-14 16:53:08 +02:00
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
2022-07-29 17:14:20 +02:00
uaccess: Add minimum bounds check on kernel buffer size
2023-03-11 16:43:56 +01:00
usb: acpi: add helper to check port lpm capability using acpi _DSM
2023-01-24 07:17:59 +01:00
virtio: unexport virtio_finalize_features
2022-03-16 13:21:48 +01:00
virtio: acknowledge all features before access
2022-03-16 13:21:48 +01:00
net: skip virtio_net_hdr_set_proto if protocol already set
2021-12-29 12:23:34 +01:00
wait: Fix __wait_event_hrtimeout for RT/DL tasks
2022-08-25 11:17:29 +02:00
XArray: add xas_split
2021-06-10 13:37:14 +02:00
