1. 30 4月, 2021 7 次提交
  2. 21 4月, 2021 2 次提交
    • V
      s390/disassembler: increase ebpf disasm buffer size · 6f3353c2
      Vasily Gorbik 提交于
      Current ebpf disassembly buffer size of 64 is too small. E.g. this line
      takes 65 bytes:
      01fffff8005822e: ec8100ed8065\tclgrj\t%r8,%r1,8,001fffff80058408\n\0
      
      Double the buffer size like it is done for the kernel disassembly buffer.
      
      Fixes the following KASAN finding:
      
      UG: KASAN: stack-out-of-bounds in print_fn_code+0x34c/0x380
      Write of size 1 at addr 001fff800ad5f970 by task test_progs/853
      
      CPU: 53 PID: 853 Comm: test_progs Not tainted
      5.12.0-rc7-23786-g23457d86b1f0-dirty #19
      Hardware name: IBM 3906 M04 704 (LPAR)
      Call Trace:
       [<0000000cd8e0538a>] show_stack+0x17a/0x1668
       [<0000000cd8e2a5d8>] dump_stack+0x140/0x1b8
       [<0000000cd8e16e74>] print_address_description.constprop.0+0x54/0x260
       [<0000000cd75a8698>] kasan_report+0xc8/0x130
       [<0000000cd6e26da4>] print_fn_code+0x34c/0x380
       [<0000000cd6ea0f4e>] bpf_int_jit_compile+0xe3e/0xe58
       [<0000000cd72c4c88>] bpf_prog_select_runtime+0x5b8/0x9c0
       [<0000000cd72d1bf8>] bpf_prog_load+0xa78/0x19c0
       [<0000000cd72d7ad6>] __do_sys_bpf.part.0+0x18e/0x768
       [<0000000cd6e0f392>] do_syscall+0x12a/0x220
       [<0000000cd8e333f8>] __do_syscall+0x98/0xc8
       [<0000000cd8e54834>] system_call+0x6c/0x94
      1 lock held by test_progs/853:
       #0: 0000000cd9bf7460 (report_lock){....}-{2:2}, at:
           kasan_report+0x96/0x130
      
      addr 001fff800ad5f970 is located in stack of task test_progs/853 at
      offset 96 in frame:
       print_fn_code+0x0/0x380
      this frame has 1 object:
       [32, 96) 'buffer'
      
      Memory state around the buggy address:
       001fff800ad5f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       001fff800ad5f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      >001fff800ad5f900: 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 f3 f3
                                                                   ^
       001fff800ad5f980: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       001fff800ad5fa00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00
      
      Cc: <stable@vger.kernel.org>
      Reviewed-by: NHeiko Carstens <hca@linux.ibm.com>
      Signed-off-by: NVasily Gorbik <gor@linux.ibm.com>
      Signed-off-by: NHeiko Carstens <hca@linux.ibm.com>
      6f3353c2
    • H
      s390/archrandom: add parameter check for s390_arch_random_generate · 28096067
      Harald Freudenberger 提交于
      A review of the code showed, that this function which is exposed
      within the whole kernel should do a parameter check for the
      amount of bytes requested. If this requested bytes is too high
      an unsigned int overflow could happen causing this function to
      try to memcpy a really big memory chunk.
      
      This is not a security issue as there are only two invocations
      of this function from arch/s390/include/asm/archrandom.h and both
      are not exposed to userland.
      Reported-by: NSven Schnelle <svens@linux.ibm.com>
      Signed-off-by: NHarald Freudenberger <freude@linux.ibm.com>
      Signed-off-by: NHeiko Carstens <hca@linux.ibm.com>
      28096067
  3. 20 4月, 2021 1 次提交
  4. 19 4月, 2021 3 次提交
  5. 15 4月, 2021 3 次提交
  6. 12 4月, 2021 21 次提交
  7. 07 4月, 2021 1 次提交
  8. 05 4月, 2021 2 次提交