iMX/i2som-imx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
647c19bc61023b305389f5b027b2f7edab0feca2
i2som-imx-linux/kernel
History
Pavel Skripkin 74190973ab profiling: fix shift-out-of-bounds bugs 
commit 2d186afd04 upstream.

Syzbot reported shift-out-of-bounds bug in profile_init().
The problem was in incorrect prof_shift. Since prof_shift value comes from
userspace we need to clamp this value into [0, BITS_PER_LONG -1]
boundaries.

Second possible shiht-out-of-bounds was found by Tetsuo:
sample_step local variable in read_profile() had "unsigned int" type,
but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent
possible shiht-out-of-bounds sample_step type was changed to
"unsigned long".

Also, "unsigned short int" will be sufficient for storing
[0, BITS_PER_LONG] value, that's why there is no need for
"unsigned long" prof_shift.

Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-26 14:08:58 +02:00
..
bpf
bpf: Fix possible out of bound write in narrow load handling
2021-09-15 09:50:43 +02:00
cgroup
cgroup/cpuset: Fix violation of cpuset locking rule
2021-09-15 09:50:38 +02:00
configs
…
debug
…
dma
dma-debug: fix debugfs initialization order
2021-09-18 13:40:13 +02:00
entry
…
events
events: Reuse value read using READ_ONCE instead of re-reading it
2021-09-22 12:27:57 +02:00
gcov
gcov: re-fix clang-11+ support
2021-04-14 08:41:58 +02:00
irq
genirq/timings: Fix error return code in irq_timings_test_irqs()
2021-09-15 09:50:29 +02:00
kcsan
kcsan: Fix debugfs initcall return type
2021-05-26 12:06:54 +02:00
livepatch
…
locking
locking/lockdep: Mark local_lock_t
2021-09-15 09:50:41 +02:00
power
PM: EM: Increase energy calculation precision
2021-09-15 09:50:37 +02:00
printk
…
rcu
rcu: Fix macro name CONFIG_TASKS_RCU_TRACE
2021-09-18 13:40:19 +02:00
sched
sched: Fix UCLAMP_FLAG_IDLE setting
2021-09-15 09:50:28 +02:00
time
Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
2021-09-16 12:51:23 +02:00
trace
tracing/boot: Fix a hist trigger dependency for boot time tracing
2021-09-22 12:28:03 +02:00
.gitignore
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:47:37 +02:00
acct.c
…
async.c
…
audit_fsnotify.c
…
audit_tree.c
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
2021-09-03 10:09:31 +02:00
audit_watch.c
…
audit.c
…
audit.h
…
auditfilter.c
…
auditsc.c
…
backtracetest.c
…
bounds.c
…
capability.c
…
compat.c
…
configs.c
…
context_tracking.c
…
cpu_pm.c
PM: cpu: Make notifier chain use a raw_spinlock_t
2021-09-15 09:50:40 +02:00
cpu.c
cpu/hotplug: Cure the cpusets trainwreck
2021-07-19 09:44:59 +02:00
crash_core.c
crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo
2021-06-23 14:42:52 +02:00
crash_dump.c
…
cred.c
Revert "Add a reference to ucounts for each cred"
2021-09-08 08:49:00 +02:00
delayacct.c
…
dma.c
…
exec_domain.c
…
exit.c
…
extable.c
…
fail_function.c
…
fork.c
mm/hugetlb: initialize hugetlb_usage in mm_init
2021-09-18 13:40:36 +02:00
freezer.c
Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing"
2021-04-07 15:00:14 +02:00
futex.c
mm, futex: fix shared futex pgoff on shmem huge page
2021-06-30 08:47:29 -04:00
gen_kheaders.sh
…
groups.c
…
hung_task.c
…
iomem.c
…
irq_work.c
…
jump_label.c
jump_label: Fix jump_label_text_reserved() vs __init
2021-07-20 16:05:58 +02:00
kallsyms.c
…
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
…
Kconfig.preempt
…
kcov.c
…
kexec_core.c
…
kexec_elf.c
…
kexec_file.c
kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
2021-05-19 10:13:09 +02:00
kexec_internal.h
…
kexec.c
…
kheaders.c
…
kmod.c
…
kprobes.c
…
ksysfs.c
…
kthread.c
kthread: Fix PF_KTHREAD vs to_kthread() race
2021-09-03 10:09:31 +02:00
latencytop.c
…
Makefile
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:47:37 +02:00
module_signature.c
module: harden ELF info handling
2021-03-25 09:04:11 +01:00
module_signing.c
module: harden ELF info handling
2021-03-25 09:04:11 +01:00
module-internal.h
…
module.c
module: limit enabling module.sig_enforce
2021-06-30 08:47:15 -04:00
notifier.c
…
nsproxy.c
…
padata.c
…
panic.c
…
params.c
…
pid_namespace.c
memcg: enable accounting for pids in nested pid namespaces
2021-09-18 13:40:36 +02:00
pid.c
…
profile.c
profiling: fix shift-out-of-bounds bugs
2021-09-26 14:08:58 +02:00
ptrace.c
ptrace: make ptrace() fail if the tracee changed its pid unexpectedly
2021-05-26 12:06:49 +02:00
range.c
…
reboot.c
…
regset.c
…
relay.c
…
resource.c
kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM resources
2021-05-19 10:13:09 +02:00
rseq.c
…
scftorture.c
…
scs.c
…
seccomp.c
seccomp: Fix setting loaded filter count during TSYNC
2021-08-18 08:59:06 +02:00
signal.c
…
smp.c
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:50:46 +02:00
smpboot.c
sched/core: Initialize the idle task with preemption disabled
2021-07-14 16:55:50 +02:00
smpboot.h
…
softirq.c
…
stackleak.c
…
stacktrace.c
…
static_call.c
static_call: Fix unused variable warn w/o MODULE
2021-09-08 08:49:00 +02:00
stop_machine.c
…
sys_ni.c
…
sys.c
prctl: allow to setup brk for et_dyn executables
2021-09-26 14:08:57 +02:00
sysctl-test.c
…
sysctl.c
…
task_work.c
…
taskstats.c
…
test_kprobes.c
…
torture.c
…
tracepoint.c
tracepoint: Use rcu get state and cond sync for static call updates
2021-09-03 10:09:30 +02:00
tsacct.c
…
ucount.c
Revert "Add a reference to ucounts for each cred"
2021-09-08 08:49:00 +02:00
uid16.c
…
uid16.h
…
umh.c
…
up.c
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:50:46 +02:00
user_namespace.c
Revert "Add a reference to ucounts for each cred"
2021-09-08 08:49:00 +02:00
user-return-notifier.c
…
user.c
…
usermode_driver.c
bpf: Fix umd memory leak in copy_process()
2021-03-30 14:32:03 +02:00
utsname_sysctl.c
…
utsname.c
…
watch_queue.c
…
watchdog_hld.c
…
watchdog.c
watchdog: fix barriers when printing backtraces from all CPUs
2021-05-19 10:13:00 +02:00
workqueue_internal.h
…
workqueue.c
workqueue: Fix possible memory leaks in wq_numa_init()
2021-09-18 13:40:23 +02:00