No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Daniel Thompson 8bb828229d lockdown: also lock down previous kgdb use
commit eadb2f47a3ced5c64b23b90fd2a3463f63726066 upstream.

KGDB and KDB allow read and write access to kernel memory, and thus
should be restricted during lockdown.  An attacker with access to a
serial port (for example, via a hypervisor console, which some cloud
vendors provide over the network) could trigger the debugger so it is
important that the debugger respect the lockdown mode when/if it is
triggered.

Fix this by integrating lockdown into kdb's existing permissions
mechanism.  Unfortunately kgdb does not have any permissions mechanism
(although it certainly could be added later) so, for now, kgdb is simply
and brutally disabled by immediately exiting the gdb stub without taking
any action.

For lockdowns established early in the boot (e.g. the normal case) then
this should be fine but on systems where kgdb has set breakpoints before
the lockdown is enacted than "bad things" will happen.

CVE: CVE-2022-21499
Co-developed-by: Stephen Brennan <stephen.s.brennan@oracle.com>
Signed-off-by: Stephen Brennan <stephen.s.brennan@oracle.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-06 08:33:48 +02:00
arch x86/xen: fix booting 32-bit pv guest 2022-05-25 09:14:38 +02:00
block block: return ELEVATOR_DISCARD_MERGE if possible 2022-05-25 09:14:38 +02:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: authenc - Fix sleep in atomic context in decrypt_tail 2022-04-15 14:18:04 +02:00
Documentation Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" 2022-05-25 09:14:38 +02:00
drivers i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe() 2022-05-25 09:14:38 +02:00
fs afs: Fix afs_getattr() to refetch file status if callback break occurred 2022-05-25 09:14:39 +02:00
include lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-15 14:18:35 +02:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
lib dim: initialize all struct fields 2022-05-18 09:47:25 +02:00
LICENSES
mm mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() 2022-05-15 19:54:47 +02:00
net mac80211: fix rx reordering with non explicit / psmp ack policy 2022-05-25 09:14:37 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts gcc-plugins: latent_entropy: use /dev/urandom 2022-04-20 09:19:38 +02:00
security lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
sound ALSA: wavefront: Proper check of get_user() error 2022-05-25 09:14:34 +02:00
tools x86/xen: Mark cpu_bringup_and_idle() as dead_end_function 2022-05-25 09:14:38 +02:00
usr
virt KVM: Prevent module exit until all VMs are freed 2022-04-15 14:18:27 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.196 2022-05-25 09:14:39 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.