No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jeongjun Park 5f1e1573bf ipc: fix to protect IPCS lookups using RCU
commit d66adabe91803ef34a8b90613c81267b5ded1472 upstream.

syzbot reported that it discovered a use-after-free vulnerability, [0]

[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/

idr_for_each() is protected by rwsem, but this is not enough.  If it is
not protected by RCU read-critical region, when idr_for_each() calls
radix_tree_node_free() through call_rcu() to free the radix_tree_node
structure, the node will be freed immediately, and when reading the next
node in radix_tree_for_each_slot(), the already freed memory may be read.

Therefore, we need to add code to make sure that idr_for_each() is
protected within the RCU read-critical region when we call it in
shm_destroy_orphaned().

Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com
Fixes: b34a6b1da3 ("ipc: introduce shm_rmid_forced sysctl")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Reported-by: syzbot+a2b84e569d06ca3a949c@syzkaller.appspotmail.com
Cc: Jeongjun Park <aha310510@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-27 11:02:52 +01:00
arch parisc: fix building with gcc-15 2025-06-27 11:02:51 +01:00
block block: fix 'kmem_cache of name 'bio-108' already exists' 2025-04-10 14:29:37 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:11:22 +02:00
crypto crypto: algif_hash - fix double free in hash_accept 2025-06-04 14:32:35 +02:00
Documentation x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 2025-06-04 14:32:32 +02:00
drivers vgacon: Add check for vc_origin address range in vgacon_scroll() 2025-06-27 11:02:51 +01:00
fs f2fs: prevent kernel warning due to negative i_nlink from corrupted image 2025-06-27 11:02:51 +01:00
include coredump: hand a pidfd to the usermode coredump helper 2025-06-04 14:32:36 +02:00
init sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP 2025-05-02 07:39:28 +02:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:02:52 +01:00
kernel bpf: Fix WARN() in get_bpf_raw_tp_regs 2025-06-27 11:02:46 +01:00
lib dql: Fix dql->limit value when reset. 2025-06-04 14:32:30 +02:00
LICENSES
mm mm/page_alloc.c: avoid infinite retries caused by cpuset race 2025-06-04 14:32:36 +02:00
net NFC: nci: uart: Set tty->disc_data only in success path 2025-06-27 11:02:51 +01:00
samples samples/bpf: Fix a resource leak 2024-12-14 19:44:50 +01:00
scripts kbuild: fix argument parsing in scripts/config 2025-06-04 14:32:31 +02:00
security smack: recognize ipv4 CIPSO w/o categories 2025-06-04 14:32:33 +02:00
sound ALSA: pcm: Fix race of buffer access at PCM OSS layer 2025-06-04 14:32:35 +02:00
tools perf record: Fix incorrect --user-regs comments 2025-06-27 11:02:48 +01:00
usr
virt KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status 2024-12-19 18:05:04 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.294 2025-06-04 14:32:37 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.