Thomas Gleixner
22d7ec50ff
debugobject: Prevent init race with static objects ...
[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ]
Statically initialized objects are usually not initialized via the init()
function of the subsystem. They are special cased and the subsystem
provides a function to validate whether an object which is not yet tracked
by debugobjects is statically initialized. This means the object is started
to be tracked on first use, e.g. activation.
This works perfectly fine, unless there are two concurrent operations on
that object. Schspa decoded the problem:
T0 T1
debug_object_assert_init(addr)
lock_hash_bucket()
obj = lookup_object(addr);
if (!obj) {
unlock_hash_bucket();
- > preemption
lock_subsytem_object(addr);
activate_object(addr)
lock_hash_bucket();
obj = lookup_object(addr);
if (!obj) {
unlock_hash_bucket();
if (is_static_object(addr))
init_and_track(addr);
lock_hash_bucket();
obj = lookup_object(addr);
obj->state = ACTIVATED;
unlock_hash_bucket();
subsys function modifies content of addr,
so static object detection does
not longer work.
unlock_subsytem_object(addr);
if (is_static_object(addr)) <- Fails
debugobject emits a warning and invokes the fixup function which
reinitializes the already active object in the worst case.
This race exists forever, but was never observed until mod_timer() got a
debug_object_assert_init() added which is outside of the timer base lock
held section right at the beginning of the function to cover the lockless
early exit points too.
Rework the code so that the lookup, the static object check and the
tracking object association happens atomically under the hash bucket
lock. This prevents the issue completely as all callers are serialized on
the hash bucket lock and therefore cannot observe inconsistent state.
Fixes: 3ac7fe5a4asyzbot+5093ba19745994288b53@syzkaller.appspotmail.com
Debugged-by: Schspa Shi <schspa@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462
Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com
Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-17 11:35:39 +02:00
lib/crypto: blake2s: move hmac construction into wireguard
2022-06-22 14:11:02 +02:00
dim: initialize all struct fields
2022-05-18 09:47:25 +02:00
lib/fonts: fix undefined behavior in bit shift for get_default_font
2023-01-18 11:40:54 +01:00
lz4: fix LZ4_decompress_safe_partial read out of bound
2022-04-15 14:18:39 +02:00
lib/lzo: fix ambiguous encoding bug in lzo-rle
2020-06-17 16:40:28 +02:00
lib/mpi: Fix buffer overrun when SG is too long
2023-03-11 16:43:38 +01:00
lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3
2022-04-15 14:18:23 +02:00
lib/vdso: use "grep -E" instead of "egrep"
2022-12-08 11:22:59 +01:00
lib/xz: Validate the value before assigning it to an enum variable
2021-11-17 09:48:31 +01:00
lib/zlib: remove outdated and incorrect pre-increment optimization
2020-06-24 17:50:39 +02:00
assoc_array: Fix BUG_ON during garbage collect
2022-06-06 08:33:50 +02:00
bug: Remove redundant condition check in report_bug
2021-05-14 09:44:27 +02:00
crc-t10dif: Fix potential crypto notify dead-lock
2020-08-19 08:15:54 +02:00
lib/crc32.c: fix trivial typo in preprocessor condition
2020-10-29 09:57:52 +01:00
lib/crc32test: remove extra local_irq_disable/enable
2020-11-10 12:37:27 +01:00
debugobject: Prevent init race with static objects
2023-05-17 11:35:39 +02:00
lib/decompress_unlz4.c: correctly handle zero-padding around initrds.
2021-07-20 16:10:46 +02:00
lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
2021-11-17 09:48:31 +01:00
devres: keep both device name and resource name in pretty name
2020-08-21 13:05:32 +02:00
dump_stack: avoid the livelock of the dump_lock
2019-11-06 08:47:50 -08:00
dyndbg: let query-modname override actual module name
2022-10-26 13:22:37 +02:00
lib/extable.c: add missing prototypes
2019-09-25 17:51:39 -07:00
uapi: rename ext2_swab() to swab() and share globally in swab.h
2020-04-13 10:48:07 +02:00
lib/genalloc: fix the overflow when size is too big
2021-01-12 20:16:10 +01:00
lib/generic-radix-tree.c: add kmemleak annotations
2019-10-14 15:04:00 -07:00
hex2bin: fix access beyond string end
2022-05-09 09:03:22 +02:00
ida: don't use BUG_ON() for debugging
2022-07-12 16:30:49 +02:00
mm/highmem: Lift memcpy_[to|from]_page to core
2023-01-18 11:41:55 +01:00
ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE
2022-03-19 13:40:16 +01:00
Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
2022-12-08 11:23:05 +01:00
kasan: add memory corruption identification for software tag-based mode
2019-09-24 15:54:07 -07:00
kobject: Restore old behaviour of kobject_del(NULL)
2020-09-17 13:47:52 +02:00
kobject_uevent: remove warning in init_uevent_argv()
2021-05-19 10:08:33 +02:00
lib: vsprintf: Fix handling of number field widths in vsscanf
2021-07-14 16:53:16 +02:00
lib: vsprintf: Fix handling of number field widths in vsscanf
2021-07-14 16:53:16 +02:00
lib/list_debug.c: Detect uninitialized lists
2022-08-25 11:18:36 +02:00
lockref: stop doing cpu_relax in the cmpxchg loop
2023-02-06 07:52:42 +01:00
PCI: Fix pci_register_io_range() memory leak
2021-03-17 17:03:44 +01:00
avoid __memcat_p link failure
2021-05-07 10:51:37 +02:00
netlink: prevent potential spectre v1 gadgets
2023-02-06 07:52:45 +01:00
nodemask: Fix return values to be unsigned
2022-06-14 18:12:02 +02:00
lib/notifier-error-inject: fix error when writing -errno to debugfs file
2023-01-18 11:40:55 +01:00
once: add DO_ONCE_SLOW() for sleepable contexts
2022-10-26 13:22:27 +02:00
idr: Fix idr_alloc_u32 on 32-bit systems
2019-11-03 06:36:50 -05:00
random: replace custom notifier chain with standard one
2022-06-22 14:11:13 +02:00
ratelimit: Fix data-races in ___ratelimit().
2022-09-05 10:27:42 +02:00
augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro
2019-09-25 17:51:39 -07:00
locking/refcount: Consolidate implementations of refcount_t
2022-07-29 17:14:17 +02:00
sbitmap: only queue kyber's wait callback if not already active
2020-01-12 12:21:44 +01:00
sgl_alloc_order: fix memory leak
2020-11-05 11:43:22 +01:00
seq_buf: Fix overflow in seq_buf_putmem_hex()
2021-07-19 08:53:16 +02:00
lib/crypto: sha1: re-roll loops to reduce code size
2022-06-22 14:11:03 +02:00
mm: remove quicklist page table caches
2019-09-24 15:54:09 -07:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
lib: stackdepot: turn depot_lock spinlock to raw_spinlock
2021-05-22 11:38:30 +02:00
lib/string.c: implement stpcpy
2020-10-01 13:18:23 +02:00
lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()
2020-01-29 16:45:29 +01:00
lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()
2020-01-29 16:45:29 +01:00
lib/syscall: fix syscall registers retrieval on 32-bit platforms
2020-12-11 13:23:32 +01:00
bpf/tests: Do not PASS tests without actually testing the result
2021-09-22 12:26:29 +02:00
test_firmware: fix memory leak in test_firmware_init()
2023-01-18 11:41:23 +01:00
kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE
2020-06-22 09:31:12 +02:00
lib/test: use after free in register_test_dev_kmod()
2022-04-15 14:18:21 +02:00
lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test
2022-01-27 09:19:55 +01:00
test_objagg: Fix potential memory leak in error handling
2020-06-30 15:37:04 -04:00
vsprintf: don't obfuscate NULL and error pointers
2020-05-27 17:46:43 +02:00
lib/test_stackinit: Fix static initializer test
2021-09-22 12:26:38 +02:00
usercopy: Avoid soft lockups in test_check_nonzero_user()
2019-10-16 14:56:21 +02:00
XArray: Fix xas_create_range() when multi-order entry present
2022-04-15 14:18:28 +02:00
lib: textsearch: fix escapes in example code
2019-10-03 12:12:23 -04:00
lib/ubsan: don't serialize UBSAN report
2020-01-09 10:20:07 +01:00
uaccess: Add speculation barrier to copy_from_user()
2023-02-25 11:53:26 +01:00
random: replace custom notifier chain with standard one
2022-06-22 14:11:13 +02:00
XArray: Update the LRU list in xas_split()
2022-04-15 14:18:28 +02:00
22d7ec50ff