No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Taehee Yoo fddd3f73ad netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init()
[ Upstream commit 6fb8852b1298200da39bd85788bc5755d1d56f32 ]

When netdevsim dev is being created, a debugfs directory is created.
The variable "dev_ddir_name" is 16bytes device name pointer and device
name is "netdevsim<dev id>".
The maximum dev id length is 10.
So, 16bytes for device name isn't enough.

Test commands:
    modprobe netdevsim
    echo "1000000000 0" > /sys/bus/netdevsim/new_device

Splat looks like:
[  249.622710][  T900] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880
[  249.623658][  T900] Write of size 1 at addr ffff88804c527988 by task bash/900
[  249.624521][  T900]
[  249.624830][  T900] CPU: 1 PID: 900 Comm: bash Not tainted 5.5.0+ #322
[  249.625691][  T900] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  249.626712][  T900] Call Trace:
[  249.627103][  T900]  dump_stack+0x96/0xdb
[  249.627639][  T900]  ? number+0x824/0x880
[  249.628173][  T900]  print_address_description.constprop.5+0x1be/0x360
[  249.629022][  T900]  ? number+0x824/0x880
[  249.629569][  T900]  ? number+0x824/0x880
[  249.630105][  T900]  __kasan_report+0x12a/0x170
[  249.630717][  T900]  ? number+0x824/0x880
[  249.631201][  T900]  kasan_report+0xe/0x20
[  249.631723][  T900]  number+0x824/0x880
[  249.632235][  T900]  ? put_dec+0xa0/0xa0
[  249.632716][  T900]  ? rcu_read_lock_sched_held+0x90/0xc0
[  249.633392][  T900]  vsnprintf+0x63c/0x10b0
[  249.633983][  T900]  ? pointer+0x5b0/0x5b0
[  249.634543][  T900]  ? mark_lock+0x11d/0xc40
[  249.635200][  T900]  sprintf+0x9b/0xd0
[  249.635750][  T900]  ? scnprintf+0xe0/0xe0
[  249.636370][  T900]  nsim_dev_probe+0x63c/0xbf0 [netdevsim]
[ ... ]

Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Fixes: ab1d0cc004 ("netdevsim: change debugfs tree topology")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:06 -08:00
arch sparc32: fix struct ipc64_perm type definition 2020-02-11 04:35:03 -08:00
block block: fix memleak of bio integrity data 2020-01-26 10:01:09 +01:00
certs
crypto crypto: pcrypt - Fix user-after-free on module unload 2020-02-01 09:34:52 +00:00
Documentation PM / devfreq: Add new name attribute for sysfs 2020-02-05 21:22:40 +00:00
drivers netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init() 2020-02-11 04:35:06 -08:00
fs btrfs: do not zero f_bavail if we have available space 2020-02-05 21:22:52 +00:00
include cfg80211: Fix radar event during another phy CAC 2020-02-05 21:22:46 +00:00
init Revert "um: Enable CONFIG_CONSTRUCTORS" 2020-02-01 09:34:53 +00:00
ipc
kernel tracing/uprobe: Fix to make trace_uprobe_filter alignment safe 2020-02-05 21:22:53 +00:00
lib XArray: Fix xas_pause at ULONG_MAX 2020-02-05 21:22:47 +00:00
LICENSES
mm mm/migrate.c: also overwrite error when it is bigger than zero 2020-02-05 21:22:53 +00:00
net tcp: clear tp->segs_{in|out} in tcp_disconnect() 2020-02-11 04:35:06 -08:00
samples samples/bpf: Fix broken xdp_rxq_info due to map order assumptions 2020-01-26 10:00:58 +01:00
scripts ARM: 8950/1: ftrace/recordmcount: filter relocation types 2020-01-29 16:45:27 +01:00
security tomoyo: Use atomic_t for statistics counter 2020-02-05 21:22:41 +00:00
sound ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order 2020-02-05 21:22:53 +00:00
tools perf report: Fix no libunwind compiled warning break s390 issue 2020-02-05 21:22:53 +00:00
usr gen_initramfs_list.sh: fix 'bad variable name' error 2020-01-09 10:20:00 +01:00
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: correct entries for ISDN/mISDN section 2020-02-11 04:35:06 -08:00
Makefile Linux 5.4.18 2020-02-05 21:22:53 +00:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.