Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Eli Cohen cc2d2b3dbf lib: cpu_rmap: Avoid use after free on rmap->obj array entries ... [ Upstream commit 4e0473f1060aa49621d40a113afde24818101d37 ] When calling irq_set_affinity_notifier() with NULL at the notify argument, it will cause freeing of the glue pointer in the corresponding array entry but will leave the pointer in the array. A subsequent call to free_irq_cpu_rmap() will try to free this entry again leading to possible use after free. Fix that by setting NULL to the array entry and checking that we have non-zero at the array entry when iterating over the array in free_irq_cpu_rmap(). The current code does not suffer from this since there are no cases where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the notify arg) is called, followed by a call to free_irq_cpu_rmap() so we don't hit and issue. Subsequent patches in this series excersize this flow, hence the required fix. Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Eli Cohen <elic@nvidia.com> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-05-30 12:44:03 +01:00
..
842
crypto	lib/crypto: blake2s: move hmac construction into wireguard	2022-06-22 14:11:02 +02:00
dim	linux/dim: Do nothing if no time delta between samples	2023-05-30 12:44:01 +01:00
fonts	lib/fonts: fix undefined behavior in bit shift for get_default_font	2023-01-18 11:40:54 +01:00
livepatch
lz4	lz4: fix LZ4_decompress_safe_partial read out of bound	2022-04-15 14:18:39 +02:00
lzo
math
mpi	lib/mpi: Fix buffer overrun when SG is too long	2023-03-11 16:43:38 +01:00
raid6	lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3	2022-04-15 14:18:23 +02:00
reed_solomon
vdso	lib/vdso: use "grep -E" instead of "egrep"	2022-12-08 11:22:59 +01:00
xz	lib/xz: Validate the value before assigning it to an enum variable	2021-11-17 09:48:31 +01:00
zlib_deflate
zlib_inflate
zstd
.gitignore
argv_split.c
ashldi3.c
ashrdi3.c
asn1_decoder.c
assoc_array.c	assoc_array: Fix BUG_ON during garbage collect	2022-06-06 08:33:50 +02:00
atomic64.c
atomic64_test.c
audit.c
bcd.c
bch.c
bitmap.c
bitrev.c
bsearch.c
btree.c
bucket_locks.c
bug.c	bug: Remove redundant condition check in report_bug	2021-05-14 09:44:27 +02:00
build_OID_registry
bust_spinlocks.c
chacha.c
check_signature.c
checksum.c
clz_ctz.c
clz_tab.c
cmdline.c
cmpdi2.c
compat_audit.c
cpu_rmap.c	lib: cpu_rmap: Avoid use after free on rmap->obj array entries	2023-05-30 12:44:03 +01:00
cpumask.c
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
crc4.c
crc7.c
crc8.c
crc16.c
crc32.c	lib/crc32.c: fix trivial typo in preprocessor condition	2020-10-29 09:57:52 +01:00
crc32defs.h
crc32test.c	lib/crc32test: remove extra local_irq_disable/enable	2020-11-10 12:37:27 +01:00
crc64.c
ctype.c
debug_info.c
debug_locks.c
debugobjects.c	debugobject: Ensure pool refill (again)	2023-05-17 11:35:56 +02:00
dec_and_lock.c
decompress.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c	lib/decompress_unlz4.c: correctly handle zero-padding around initrds.	2021-07-20 16:10:46 +02:00
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c	lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression	2021-11-17 09:48:31 +01:00
devres.c
digsig.c
dump_stack.c
dynamic_debug.c	dyndbg: let query-modname override actual module name	2022-10-26 13:22:37 +02:00
dynamic_queue_limits.c
earlycpio.c
error-inject.c
errseq.c
extable.c
fault-inject.c
fdt.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_bit.c
find_bit_benchmark.c
flex_proportions.c
gen_crc32table.c
gen_crc64table.c
genalloc.c	lib/genalloc: fix the overflow when size is too big	2021-01-12 20:16:10 +01:00
generic-radix-tree.c
glob.c
globtest.c
hexdump.c	hex2bin: fix access beyond string end	2022-05-09 09:03:22 +02:00
hweight.c
idr.c	ida: don't use BUG_ON() for debugging	2022-07-12 16:30:49 +02:00
inflate.c
interval_tree.c
interval_tree_test.c
iomap.c
iomap_copy.c
iommu-helper.c
ioremap.c
iov_iter.c	mm/highmem: Lift memcpy_[to|from]_page to core	2023-01-18 11:41:55 +01:00
irq_poll.c
irq_regs.c
is_single_threaded.c
kasprintf.c
Kconfig	ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE	2022-03-19 13:40:16 +01:00
Kconfig.debug	Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled	2022-12-08 11:23:05 +01:00
Kconfig.kasan
Kconfig.kgdb
Kconfig.ubsan
kfifo.c
klist.c
kobject.c	kobject: Restore old behaviour of kobject_del(NULL)	2020-09-17 13:47:52 +02:00
kobject_uevent.c	kobject_uevent: remove warning in init_uevent_argv()	2021-05-19 10:08:33 +02:00
kstrtox.c	lib: vsprintf: Fix handling of number field widths in vsscanf	2021-07-14 16:53:16 +02:00
kstrtox.h	lib: vsprintf: Fix handling of number field widths in vsscanf	2021-07-14 16:53:16 +02:00
libcrc32c.c
list_debug.c	lib/list_debug.c: Detect uninitialized lists	2022-08-25 11:18:36 +02:00
list_sort.c
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-rtmutex.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lockref.c	lockref: stop doing cpu_relax in the cmpxchg loop	2023-02-06 07:52:42 +01:00
logic_pio.c	PCI: Fix pci_register_io_range() memory leak	2021-03-17 17:03:44 +01:00
lru_cache.c
lshrdi3.c
Makefile	avoid __memcat_p link failure	2021-05-07 10:51:37 +02:00
memcat_p.c
memory-notifier-error-inject.c
memweight.c
muldi3.c
net_utils.c
netdev-notifier-error-inject.c
nlattr.c	netlink: prevent potential spectre v1 gadgets	2023-02-06 07:52:45 +01:00
nmi_backtrace.c
nodemask.c	nodemask: Fix return values to be unsigned	2022-06-14 18:12:02 +02:00
notifier-error-inject.c	lib/notifier-error-inject: fix error when writing -errno to debugfs file	2023-01-18 11:40:55 +01:00
notifier-error-inject.h
objagg.c
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c	once: add DO_ONCE_SLOW() for sleepable contexts	2022-10-26 13:22:27 +02:00
packing.c
parman.c
parser.c
pci_iomap.c
percpu-refcount.c
percpu_counter.c
percpu_test.c
plist.c
pm-notifier-error-inject.c
radix-tree.c
random32.c	random: replace custom notifier chain with standard one	2022-06-22 14:11:13 +02:00
ratelimit.c	ratelimit: Fix data-races in ___ratelimit().	2022-09-05 10:27:42 +02:00
rbtree.c
rbtree_test.c
refcount.c	locking/refcount: Consolidate implementations of refcount_t	2022-07-29 17:14:17 +02:00
rhashtable.c
sbitmap.c
scatterlist.c	sgl_alloc_order: fix memory leak	2020-11-05 11:43:22 +01:00
seq_buf.c	seq_buf: Fix overflow in seq_buf_putmem_hex()	2021-07-19 08:53:16 +02:00
sg_pool.c
sg_split.c
sha1.c	lib/crypto: sha1: re-roll loops to reduce code size	2022-06-22 14:11:03 +02:00
show_mem.c
siphash.c	siphash: use one source of truth for siphash permutations	2022-06-22 14:11:16 +02:00
smp_processor_id.c
sort.c
stackdepot.c	lib: stackdepot: turn depot_lock spinlock to raw_spinlock	2021-05-22 11:38:30 +02:00
stmp_device.c
string.c	lib/string.c: implement stpcpy	2020-10-01 13:18:23 +02:00
string_helpers.c
strncpy_from_user.c
strnlen_user.c
syscall.c	lib/syscall: fix syscall registers retrieval on 32-bit platforms	2020-12-11 13:23:32 +01:00
test-kstrtox.c
test-string_helpers.c
test_bitfield.c
test_bitmap.c
test_blackhole_dev.c
test_bpf.c	bpf/tests: Do not PASS tests without actually testing the result	2021-09-22 12:26:29 +02:00
test_debug_virtual.c
test_firmware.c	test_firmware: fix memory leak in test_firmware_init()	2023-01-18 11:41:23 +01:00
test_hash.c
test_hexdump.c
test_ida.c
test_kasan.c
test_kmod.c	lib/test: use after free in register_test_dev_kmod()	2022-04-15 14:18:21 +02:00
test_list_sort.c
test_memcat_p.c
test_meminit.c	lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test	2022-01-27 09:19:55 +01:00
test_module.c
test_objagg.c
test_overflow.c
test_parman.c
test_printf.c
test_rhashtable.c
test_siphash.c
test_sort.c
test_stackinit.c	lib/test_stackinit: Fix static initializer test	2021-09-22 12:26:38 +02:00
test_static_key_base.c
test_static_keys.c
test_string.c
test_strscpy.c
test_sysctl.c
test_ubsan.c
test_user_copy.c
test_uuid.c
test_vmalloc.c
test_xarray.c	XArray: Fix xas_create_range() when multi-order entry present	2022-04-15 14:18:28 +02:00
textsearch.c
timerqueue.c
ts_bm.c
ts_fsm.c
ts_kmp.c
ubsan.c
ubsan.h
ucmpdi2.c
ucs2_string.c
usercopy.c	uaccess: Add speculation barrier to copy_from_user()	2023-02-25 11:53:26 +01:00
uuid.c
vsprintf.c	random: replace custom notifier chain with standard one	2022-06-22 14:11:13 +02:00
win_minmax.c
xarray.c	XArray: Update the LRU list in xas_split()	2022-04-15 14:18:28 +02:00
xxhash.c