Pavel Skripkin
b94def8a47
profiling: fix shift-out-of-bounds bugs ...
commit 2d186afd04d669fe9c48b994c41a7405a3c9f16d upstream.
Syzbot reported shift-out-of-bounds bug in profile_init().
The problem was in incorrect prof_shift. Since prof_shift value comes from
userspace we need to clamp this value into [0, BITS_PER_LONG -1]
boundaries.
Second possible shiht-out-of-bounds was found by Tetsuo:
sample_step local variable in read_profile() had "unsigned int" type,
but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent
possible shiht-out-of-bounds sample_step type was changed to
"unsigned long".
Also, "unsigned short int" will be sufficient for storing
[0, BITS_PER_LONG] value, that's why there is no need for
"unsigned long" prof_shift.
Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com
Fixes: 1da177e4c3syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-26 14:07:09 +02:00
bpf: Fix pointer arithmetic mask tightening under state pruning
2021-09-15 09:47:39 +02:00
cgroup/cpuset: Fix a partition bug with hotplug
2021-09-15 09:47:32 +02:00
kdb: Make memory allocations more robust
2021-03-04 10:26:10 +01:00
dma-debug: fix debugfs initialization order
2021-09-22 12:26:24 +02:00
events: Reuse value read using READ_ONCE instead of re-reading it
2021-09-22 12:26:41 +02:00
gcov: re-fix clang-11+ support
2021-04-14 08:24:10 +02:00
genirq/timings: Fix error return code in irq_timings_test_irqs()
2021-09-15 09:47:29 +02:00
locking/mutex: Fix HANDOFF condition
2021-09-15 09:47:25 +02:00
PM: EM: Increase energy calculation precision
2021-09-15 09:47:33 +02:00
printk: fix deadlock when kernel panic
2021-03-04 10:26:50 +01:00
rcu/tree: Handle VM stoppage in stall detection
2021-09-15 09:47:26 +02:00
sched: Fix UCLAMP_FLAG_IDLE setting
2021-09-15 09:47:28 +02:00
Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
2021-09-16 12:56:13 +02:00
tracing/probes: Reject events which have the same name of existing one
2021-09-22 12:26:43 +02:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
2021-09-03 10:08:16 +02:00
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
2020-10-01 13:17:32 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
cpu/hotplug: Cure the cpusets trainwreck
2021-07-19 08:53:15 +02:00
kernel/cpu_pm: Fix uninitted local in cpu_pm
2020-06-22 09:31:22 +02:00
don't dump the threads that had been already exiting when zapped.
2020-11-18 19:20:31 +01:00
fail_function: Remove a redundant mutex unlock
2020-11-24 13:29:18 +01:00
mm/hugetlb: initialize hugetlb_usage in mm_init
2021-09-22 12:26:37 +02:00
mm, futex: fix shared futex pgoff on shmem huge page
2021-06-30 08:47:55 -04:00
kbuild: add variables for compression tools
2020-09-03 11:27:10 +02:00
kallsyms: Refactor kallsyms_show_value() to take cred
2020-07-16 08:16:44 +02:00
exec: Transform exec_update_mutex into a rw_semaphore
2021-01-09 13:44:55 +01:00
kernel: kexec: remove the lock operation of system_transition_mutex
2021-02-03 23:25:56 +01:00
kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
2021-05-19 10:08:28 +02:00
kmod: make request_module() return an error when autoloading is disabled
2020-04-17 10:50:22 +02:00
tracing/kprobe: Fix to support kretprobe events on unloaded modules
2021-02-13 13:52:54 +01:00
kthread: Fix PF_KTHREAD vs to_kthread() race
2021-09-12 08:56:39 +02:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
module: limit enabling module.sig_enforce
2021-06-30 08:47:42 -04:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
2020-10-01 13:17:23 +02:00
padata: add separate cpuhp node for CPUHP_PADATA_DEAD
2020-06-17 16:40:22 +02:00
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 12:26:37 +02:00
profiling: fix shift-out-of-bounds bugs
2021-09-26 14:07:09 +02:00
ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
2021-05-26 12:05:15 +02:00
reboot: fix overflow parsing reboot cpu number
2020-11-18 19:20:30 +01:00
kernel/relay.c: fix memleak on destroy relay channel
2020-08-26 10:40:51 +02:00
/dev/mem: Revoke mappings when a driver claims the region
2020-06-24 17:50:35 +02:00
seccomp: Add missing return in non-void function
2021-03-04 10:26:45 +01:00
ptrace: fix task_join_group_stop() for the case when current is traced
2020-11-10 12:37:24 +01:00
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
kthread: Extract KTHREAD_IS_PER_CPU
2021-02-07 15:35:49 +01:00
prctl: allow to setup brk for et_dyn executables
2021-09-26 14:07:08 +02:00
kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
2020-10-01 13:17:10 +02:00
sysctl.c: fix underflow value setting risk in vm_table
2021-03-17 17:03:45 +01:00
tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2021-07-14 16:53:08 +02:00
usermodehelper: reset umask to default before executing user process
2020-10-14 10:32:58 +02:00
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
watchdog/softlockup: Enforce that timestamp is valid on boot
2020-02-24 08:36:52 +01:00
workqueue: Fix possible memory leaks in wq_numa_init()
2021-09-22 12:26:30 +02:00
b94def8a47