A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity
No description
892,275 commits 10 branches 0 tags 2.1 GiB
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Pablo Neira Ayuso f36736fbd4 netfilter: nf_tables: disallow non-stateful expression in sets earlier 
commit 520778042ccca019f3ffa136dd0ca565c486cedd upstream.

Since 3e135cd499 ("netfilter: nft_dynset: dynamic stateful expression
instantiation"), it is possible to attach stateful expressions to set
elements.

cd5125d8f5 ("netfilter: nf_tables: split set destruction in deactivate
and destroy phase") introduces conditional destruction on the object to
accomodate transaction semantics.

nft_expr_init() calls expr->ops->init() first, then check for
NFT_STATEFUL_EXPR, this stills allows to initialize a non-stateful
lookup expressions which points to a set, which might lead to UAF since
the set is not properly detached from the set->binding for this case.
Anyway, this combination is non-sense from nf_tables perspective.

This patch fixes this problem by checking for NFT_STATEFUL_EXPR before
expr->ops->init() is called.

The reporter provides a KASAN splat and a poc reproducer (similar to
those autogenerated by syzbot to report use-after-free errors). It is
unknown to me if they are using syzbot or if they use similar automated
tool to locate the bug that they are reporting.

For the record, this is the KASAN splat.

[   85.431824] ==================================================================
[   85.432901] BUG: KASAN: use-after-free in nf_tables_bind_set+0x81b/0xa20
[   85.433825] Write of size 8 at addr ffff8880286f0e98 by task poc/776
[   85.434756]
[   85.434999] CPU: 1 PID: 776 Comm: poc Tainted: G        W         5.18.0+ #2
[   85.436023] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014

Fixes: 0b2d8a7b63 ("netfilter: nf_tables: add helper functions for expression handling")
Reported-and-tested-by: Aaron Adams <edg-e@nccgroup.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[Ajay: Regenerated the patch for v5.4.y]
Signed-off-by: Ajay Kaher <akaher@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-14 18:11:45 +02:00
arch powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup 2022-06-14 18:11:42 +02:00
block bfq: Track whether bfq_group is still online 2022-06-14 18:11:45 +02:00
certs
crypto crypto: cryptd - Protect per-CPU resource by disabling BH. 2022-06-14 18:11:41 +02:00
Documentation hwmon: Make chip parameter for with_info API mandatory 2022-06-14 18:11:29 +02:00
drivers iwlwifi: mvm: fix assert 1F04 upon reconfig 2022-06-14 18:11:44 +02:00
fs fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages 2022-06-14 18:11:44 +02:00
include mailbox: forward the hrtimer if not queued and under a lock 2022-06-14 18:11:42 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-15 14:18:35 +02:00
ipc ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() 2022-06-14 18:11:41 +02:00
kernel sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq 2022-06-14 18:11:33 +02:00
lib assoc_array: Fix BUG_ON during garbage collect 2022-06-06 08:33:50 +02:00
LICENSES
mm zsmalloc: fix races between asynchronous zspage free and page migration 2022-06-06 08:33:50 +02:00
net netfilter: nf_tables: disallow non-stateful expression in sets earlier 2022-06-14 18:11:45 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts scripts/faddr2line: Fix overlapping text section failures 2022-06-14 18:11:37 +02:00
security efi: Do not import certificates from UEFI Secure Boot for T2 Macs 2022-06-14 18:11:44 +02:00
sound ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() 2022-06-14 18:11:38 +02:00
tools perf jevents: Fix event syntax error caused by ExtSel 2022-06-14 18:11:44 +02:00
usr
virt KVM: Prevent module exit until all VMs are freed 2022-04-15 14:18:27 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.197 2022-06-06 08:33:51 +02:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.