1. 27 8月, 2015 2 次提交
  2. 12 7月, 2015 1 次提交
  3. 06 6月, 2015 1 次提交
  4. 09 4月, 2015 1 次提交
  5. 08 3月, 2015 1 次提交
    • V
      irqchip: gic-v3: Fix out of bounds access to cpu_logical_map · 614be385
      Vladimir Murzin 提交于
      While playing with KASan support for arm64/arm the following appeared on boot:
      
      ==================================================================
      BUG: AddressSanitizer: out of bounds access in __asan_load8+0x14/0x1c at addr ffffffc000ad0dc0
      Read of size 8 by task swapper/0/1
      page:ffffffbdc202b400 count:1 mapcount:0 mapping:          (null) index:0x0
      flags: 0x400(reserved)
      page dumped because: kasan: bad access detected
      Address belongs to variable __cpu_logical_map+0x200/0x220
      CPU: 2 PID: 1 Comm: swapper/0 Not tainted 3.19.0-rc6-next-20150129+ #481
      Hardware name: FVP Base (DT)
      Call trace:
      [<ffffffc00008a794>] dump_backtrace+0x0/0x184
      [<ffffffc00008a928>] show_stack+0x10/0x1c
      [<ffffffc00075e46c>] dump_stack+0xa0/0xf8
      [<ffffffc0001df490>] kasan_report_error+0x23c/0x264
      [<ffffffc0001e0188>] check_memory_region+0xc0/0xe4
      [<ffffffc0001dedf0>] __asan_load8+0x10/0x1c
      [<ffffffc000431294>] gic_raise_softirq+0xc4/0x1b4
      [<ffffffc000091fc0>] smp_send_reschedule+0x30/0x3c
      [<ffffffc0000f0d1c>] try_to_wake_up+0x394/0x434
      [<ffffffc0000f0de8>] wake_up_process+0x2c/0x6c
      [<ffffffc0000d9570>] wake_up_worker+0x38/0x48
      [<ffffffc0000dbb50>] insert_work+0xac/0xec
      [<ffffffc0000dbd38>] __queue_work+0x1a8/0x374
      [<ffffffc0000dbf60>] queue_work_on+0x5c/0x7c
      [<ffffffc0000d8a78>] call_usermodehelper_exec+0x170/0x188
      [<ffffffc0004037b8>] kobject_uevent_env+0x650/0x6bc
      [<ffffffc000403830>] kobject_uevent+0xc/0x18
      [<ffffffc00040292c>] kset_register+0xa8/0xc8
      [<ffffffc0004d6c88>] bus_register+0x134/0x2e8
      [<ffffffc0004d73b4>] subsys_virtual_register+0x2c/0x5c
      [<ffffffc000a76a4c>] wq_sysfs_init+0x14/0x20
      [<ffffffc000082a28>] do_one_initcall+0xa8/0x1fc
      [<ffffffc000a70db4>] kernel_init_freeable+0x1ec/0x294
      [<ffffffc00075aa5c>] kernel_init+0xc/0xec
      Memory state around the buggy address:
       ffffff80003e0820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffffff80003e0830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      >ffffff80003e0840: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
                         ^
       ffffff80003e0850: 00 00 fa fa fa fa fa fa 00 00 00 00 00 00 00 00
      ==================================================================
      
      The reason for that cpumask_next() returns >= nr_cpu_ids if no further cpus
      set, but "==" condition is checked only, so we end up with out-of-bounds
      access to cpu_logical_map.
      
      Fix is by using the condition check for cpumask_next.
      Signed-off-by: NVladimir Murzin <vladimir.murzin@arm.com>
      Signed-off-by: NMarc Zyngier <marc.zyngier@arm.com>
      Link: https://lkml.kernel.org/r/1425659870-11832-7-git-send-email-marc.zyngier@arm.comSigned-off-by: NJason Cooper <jason@lakedaemon.net>
      614be385
  6. 05 3月, 2015 1 次提交
  7. 26 1月, 2015 1 次提交
  8. 21 1月, 2015 1 次提交
  9. 26 11月, 2014 3 次提交
  10. 14 9月, 2014 2 次提交
  11. 03 9月, 2014 2 次提交
  12. 18 8月, 2014 2 次提交
  13. 25 7月, 2014 1 次提交
  14. 09 7月, 2014 1 次提交