Marco Elver
c78abaa8fe
UPSTREAM: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE ...
Originally the addr != NULL check was meant to take care of the case
where __kfence_pool == NULL (KFENCE is disabled). However, this does
not work for addresses where addr > 0 && addr < KFENCE_POOL_SIZE.
This can be the case on NULL-deref where addr > 0 && addr < PAGE_SIZE or
any other faulting access with addr < KFENCE_POOL_SIZE. While the
kernel would likely crash, the stack traces and report might be
confusing due to double faults upon KFENCE's attempt to unprotect such
an address.
Fix it by just checking that __kfence_pool != NULL instead.
Link: https://lkml.kernel.org/r/20210818130300.2482437-1-elver@google.com
Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure")
Signed-off-by: Marco Elver <elver@google.com>
Reported-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com>
Acked-by: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org> [5.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit a7cb5d23eaea148f8582229846f8dfff192f05c3)
Bug: 196937223
Bug: 197197917
Test: local QEMU runs with init/main.c modified to access the NULL page
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I6a339e8c6b4d2bdc3ee9bd575725489a8233aade
(cherry picked from commit 228d32e2d0b730f00eb0a8950698902b3ad23daf)
2026-05-07 17:24:09 +03:00
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
2025-10-29 13:59:50 +01:00
net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
2025-06-04 14:32:33 +02:00
RDMA/mlx5: Enforce same type port association for multiport RoCE
2025-01-09 13:23:34 +01:00
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Revert "netfilter: Replace zero-length array with flexible-array member"
2025-01-14 17:17:17 +00:00
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
UPSTREAM: exit: Factor thread_group_exited out of pidfd_poll
2026-02-01 20:44:48 -08:00
Revert "spi: Fix deadlock when adding SPI controllers on SPI buses"
2024-11-21 22:00:36 +00:00
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
2024-12-14 19:44:42 +01:00
usb: Undo qcom damage
2026-04-30 21:08:27 +03:00
UPSTREAM: fs: add LSM-supporting anon-inode interface
2025-02-20 04:17:45 +02:00
ata: libata-scsi: Fix system suspend for a security locked drive
2025-12-03 12:45:21 +01:00
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
2025-09-04 14:05:54 +02:00
writeback: fix false warning in inode_to_wb()
2025-05-02 07:39:19 +02:00
Revert "coredump: hand a pidfd to the usermode coredump helper"
2025-06-05 07:57:32 +00:00
Merge 5.4.287 into android11-5.4-lts
2024-12-16 10:50:16 +00:00
UPSTREAM: bpf: Fix potentially incorrect results with bpf_get_local_storage()
2026-01-14 18:12:57 -08:00
UPSTREAM: bpf: Introduce SK_LOOKUP program type with a dedicated attach point
2026-01-14 18:12:05 -08:00
ANDROID: add kabi padding for bpf structures
2026-02-01 20:44:47 -08:00
UPSTREAM: bpf: Split bpf_local_storage to bpf_sk_storage
2026-01-14 18:12:20 -08:00
UPSTREAM: bpf: Implement bpf_local_storage for inodes
2026-01-14 18:12:21 -08:00
BACKPORT: bpf: Clean up sockmap related Kconfigs
2026-02-01 20:44:37 -08:00
ANDROID: add kabi padding for bpf_verifier structure
2026-02-01 20:44:56 -08:00
UPSTREAM: bpfilter: switch bpfilter_ip_set_sockopt to sockptr_t
2026-02-01 20:44:55 -08:00
UPSTREAM: bpf: Introduce bpf_per_cpu_ptr()
2026-01-14 18:12:39 -08:00
BACKPORT: btf: Add BTF_ID_LIST_SINGLE macro
2026-01-14 18:12:31 -08:00
UPSTREAM: bpf, capability: Introduce CAP_BPF
2026-01-14 17:44:17 -08:00
UPSTREAM: mm: memcontrol: recursive memory.low protection
2026-01-14 18:13:12 -08:00
UPSTREAM: cgroup: use cgrp->kn->id as the cgroup ID
2025-12-23 13:36:09 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: epoll: wire up syscall epoll_pwait2
2025-12-22 07:42:50 +02:00
This is the 5.4.302 stable release
2025-12-11 09:41:30 +00:00
UPSTREAM: bpf, net: Rework cookie generator as per-cpu one
2026-01-14 18:12:39 -08:00
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
BACKPORT: crypto: lib/sha1 - rename "sha" to "sha1"
2025-12-23 13:36:17 -08:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
Merge android11-5.4.295(387dbb9) into msm-5.4
2025-09-29 05:22:53 -07:00
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
2024-12-14 19:44:55 +01:00
BACKPORT: bpf: Add support for BTF pointers to x86 JIT
2025-12-23 13:35:36 -08:00
UPSTREAM: close_range(): fix the logics in descriptor table trimming
2025-12-22 04:28:18 +02:00
UPSTREAM: inet6: Run SK_LOOKUP BPF program on socket lookup
2026-01-14 18:13:17 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
ftrace: Let ftrace_enable_sysctl take a kernel pointer buffer
2026-02-01 20:38:01 -08:00
usb: Undo qcom damage
2026-04-30 21:08:27 +03:00
reverting enum-conversion, Handle CPU state and all USB patches
2025-09-29 11:14:00 +05:30
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
Revert "mm: provide speculative fault infrastructure"
2025-05-24 05:44:05 +00:00
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
2025-01-09 13:23:33 +01:00
clockevents/drivers/i8253: Fix stop sequence for timer 0
2025-04-10 14:29:34 +02:00
net: bridge: Fix for co-located mode
2025-12-01 04:15:06 -08:00
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
2025-08-28 16:21:27 +02:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
iommu: Fix invalid access in av8l_fast_unmap_public
2025-04-17 19:01:13 +05:30
BACKPORT: net: change accept_ra_min_rtr_lft to affect all RA lifetimes
2026-05-07 10:16:30 -04:00
UPSTREAM: irq_work: Convert flags to atomic_t
2025-12-23 13:35:39 -08:00
Merge 5.4.287 into android11-5.4-lts
2024-12-16 10:50:16 +00:00
This is the 5.4.291 stable release
2025-03-13 14:53:52 +00:00
UPSTREAM: kernfs: Add option to enable user xattrs
2026-01-14 18:13:12 -08:00
UPSTREAM: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE
2026-05-07 17:24:09 +03:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
2025-03-13 12:43:07 +01:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
leds: class: Protect brightness_show() with led_cdev->led_access mutex
2024-12-14 19:44:53 +01:00
BACKPORT: bpf: Verifier, do explicit ALU32 bounds tracking
2025-12-23 13:36:11 -08:00
UPSTREAM: list: Add hlist_unhashed_lockless()
2026-01-14 18:13:06 -08:00
BACKPORT: security: Refactor declaration of LSM hooks
2025-12-23 13:36:10 -08:00
BACKPORT: security: Refactor declaration of LSM hooks
2025-12-23 13:36:10 -08:00
Revert "mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()"
2025-05-24 05:44:07 +00:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
Revert "mm: make pte_unmap_same compatible with SPF"
2025-05-24 05:44:30 +00:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
module: Restore the moduleparam prefix length check
2025-08-28 16:21:21 +02:00
Merge tag 'LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina
2026-04-30 20:46:30 +03:00
netpoll: netpoll_send_skb() returns transmit status
2025-04-10 14:29:35 +02:00
nfs: add missing selections of CONFIG_CRC32
2025-05-02 07:39:20 +02:00
nfs: fix UAF in direct writes
2025-08-28 16:21:37 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
overflow: Allow mixed type arguments
2025-03-13 12:42:52 +01:00
Revert "mm: provide speculative fault infrastructure"
2025-05-24 05:44:05 +00:00
Merge android11-5.4.295(387dbb9) into msm-5.4
2025-09-29 05:22:53 -07:00
This is the 5.4.291 stable release
2025-03-13 14:53:52 +00:00
UPSTREAM: perf: Expose get/put_callchain_entry()
2026-01-14 18:12:01 -08:00
ANDROID: 16K: Don't copy data vma for maps/smaps output
2025-08-22 07:06:50 -07:00
Merge android11-5.4.295(387dbb9) into msm-5.4
2025-09-29 05:22:53 -07:00
poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
2025-02-01 18:18:51 +01:00
power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint
2025-05-25 16:53:58 +00:00
pps: fix poll support
2025-08-28 16:21:18 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: bpf: Refactor to provide aux info to bpf_iter_init_seq_priv_t
2026-01-14 18:12:07 -08:00
UPSTREAM: fs/nsfs.c: Added ns_match
2025-12-23 13:36:04 -08:00
UPSTREAM: list: Add hlist_unhashed_lockless()
2026-01-14 18:13:06 -08:00
UPSTREAM: rcu-tasks: Add an RCU-tasks rude variant
2026-01-14 18:12:25 -08:00
UPSTREAM: rcu-tasks: Add an RCU Tasks Trace to simplify protection of tracing hooks
2026-01-14 18:12:26 -08:00
rcu: fix header guard for rcu_all_qs()
2025-06-04 14:32:34 +02:00
Revert "mm: introduce __page_add_new_anon_rmap()"
2025-05-24 05:44:06 +00:00
UPSTREAM: rcu-tasks: Add an RCU Tasks Trace to simplify protection of tracing hooks
2026-01-14 18:12:26 -08:00
BACKPORT: seccomp: release filter after task is fully dead
2026-05-07 10:17:17 -04:00
BACKPORT: bpf: Add lockdown check for probe_write_user helper
2026-02-01 20:44:42 -08:00
Revert "Revert "Revert "8250: add support for ASIX devices with a FIFO bug"""
2025-05-18 11:04:18 +03:00
dmaengine: sh: setup_xref error handling
2025-12-03 12:45:11 +01:00
BACKPORT: FROMGIT: userfaultfd/shmem: combine shmem_{mcopy_atomic,mfill_zeropage}_pte
2025-05-18 08:08:42 +00:00
Merge android11-5.4.302(91d385eb) into msm-5.4
2026-01-30 11:41:11 +05:30
BACKPORT: net: sk_msg: Simplify sk_psock initialization
2026-02-01 20:44:39 -08:00
UPSTREAM: bpf, net: Rework cookie generator as per-cpu one
2026-01-14 18:12:39 -08:00
UPSTREAM: bpf: net: Change sk_getsockopt() to take the sockptr_t argument
2026-01-14 18:13:09 -08:00
stackleak: let stack_erasing_sysctl take a kernel pointer buffer
2026-02-01 20:38:37 -08:00
Revert "mm: introduce __lru_cache_add_active_or_unevictable"
2025-05-24 05:44:06 +00:00
BACKPORT: epoll: wire up syscall epoll_pwait2
2025-12-22 07:42:50 +02:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: tcp: bpf: Optionally store mac header in TCP_SAVE_SYN
2026-01-14 18:12:18 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
BACKPORT: bpf: Verifier, do explicit ALU32 bounds tracking
2025-12-23 13:36:11 -08:00
Merge android11-5.4.289(4c8fb32) into msm-5.4
2025-03-26 11:56:22 +05:30
types: Complement the aligned types with signed 64-bit one
2025-06-04 14:32:27 +02:00
BACKPORT: maccess: rename probe_user_{read,write} to copy_{from,to}_user_nofault
2026-01-14 18:13:22 -08:00
UPSTREAM: udp: do not accept non-tunnel GSO skbs landing in a tunnel
2025-03-10 16:19:50 +00:00
BACKPORT: umh: Separate the user mode driver and the user mode helper support
2026-01-14 18:12:14 -08:00
usb: Undo qcom damage
2026-04-30 21:08:27 +03:00
BACKPORT: FROMGIT: userfaultfd/shmem: modify shmem_mfill_atomic_pte to use install_pte()
2025-05-18 08:08:42 +00:00
UPSTREAM: bpf: Fix umd memory leak in copy_process()
2026-01-14 18:12:50 -08:00
util_macros.h: fix/rework find_closest() macros
2024-12-14 19:44:43 +01:00
Revert "mm: add speculative page fault vmstats"
2025-05-24 05:44:04 +00:00
BACKPORT: mm: remove the pgprot argument to __vmalloc
2026-01-14 17:48:09 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: sched/core: Add function to sample state of locked-down task
2026-01-14 18:13:18 -08:00
BACKPORT: sysctl: pass kernel pointers to ->proc_handler
2025-12-23 13:36:15 -08:00
UPSTREAM: kernfs: Add removed_size out param for simple_xattr_set
2026-01-14 18:13:12 -08:00
