averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-04-03 12:05:13 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
868df4eb784c3ccc7e4340a9ea993cbbedca167e
linux-stable-mirror/kernel
History
Masami Hiramatsu (Google) 868df4eb78 tracing: fprobe events: Fix possible UAF on modules 
commit dd941507a9 upstream.

Commit ac91052f0a ("tracing: tprobe-events: Fix leakage of module
refcount") moved try_module_get() from __find_tracepoint_module_cb()
to find_tracepoint() caller, but that introduced a possible UAF
because the module can be unloaded before try_module_get(). In this
case, the module object should be freed too. Thus, try_module_get()
does not only fail but may access to the freed object.

To avoid that, try_module_get() in __find_tracepoint_module_cb()
again.

Link: https://lore.kernel.org/all/174342990779.781946.9138388479067729366.stgit@devnote2/

Fixes: ac91052f0a ("tracing: tprobe-events: Fix leakage of module refcount")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-04-20 10:15:50 +02:00
..
bpf
bpf: Fix array bounds error with may_goto
2025-04-10 14:39:21 +02:00
cgroup
cgroup/cpuset: Fix race between newly created partition and dying one
2025-04-20 10:15:04 +02:00
configs
tinyconfig: remove unnecessary 'is not set' for choice blocks
2024-09-01 20:34:38 +09:00
debug
move asm/unaligned.h to linux/unaligned.h
2024-10-02 17:23:23 -04:00
dma
dma-mapping: fix missing clear bdr in check_ram_in_range_map()
2025-03-28 22:03:26 +01:00
entry
…
events
perf: Fix hang while freeing sigtrap event
2025-04-20 10:15:10 +02:00
futex
futex: Pass in task to futex_queue()
2025-03-22 12:54:14 -07:00
gcov
…
irq
genirq: Make handle_enforce_irqctx() unconditionally available
2025-02-08 09:57:00 +01:00
kcsan
kcsan: Turn report_filterlist_lock into a raw_spinlock
2024-12-14 20:03:37 +01:00
livepatch
…
locking
locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
2025-04-20 10:15:45 +02:00
module
module: Don't fail module loading when setting ro_after_init section RO failed
2025-02-08 09:57:58 +01:00
power
PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()
2025-04-20 10:15:11 +02:00
printk
Flush console log from kernel_power_off()
2025-04-20 10:15:12 +02:00
rcu
mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq
2025-03-22 12:54:09 -07:00
sched
sched/deadline: Use online cpus for validating runtime
2025-04-10 14:39:30 +02:00
time
hrtimers: Mark is_migration_base() with __always_inline
2025-03-22 12:54:14 -07:00
trace
tracing: fprobe events: Fix possible UAF on modules
2025-04-20 10:15:50 +02:00
.gitignore
…
acct.c
acct: block access to kernel internal filesystems
2025-02-27 04:30:23 -08:00
async.c
…
audit_fsnotify.c
…
audit_tree.c
…
audit_watch.c
…
audit.c
audit: Make use of str_enabled_disabled() helper
2024-09-03 16:35:16 -04:00
audit.h
…
auditfilter.c
audit: use task_tgid_nr() instead of task_pid_nr()
2024-08-28 16:48:28 -04:00
auditsc.c
audit: use task_tgid_nr() instead of task_pid_nr()
2024-08-28 16:48:28 -04:00
backtracetest.c
…
bounds.c
…
capability.c
…
cfi.c
…
compat.c
…
configs.c
…
context_tracking.c
context_tracking, rcu: Rename rcu_dyntick trace event into rcu_watching
2024-08-15 21:30:43 +05:30
cpu_pm.c
…
cpu.c
watchdog/hardlockup/perf: Fix perf_event memory leak
2025-04-10 14:39:11 +02:00
crash_core.c
Document/kexec: generalize crash hotplug description
2024-09-01 20:43:37 -07:00
crash_reserve.c
crash: fix crash memory reserve exceed system memory bug
2024-09-01 20:43:30 -07:00
cred.c
…
delayacct.c
…
dma.c
…
elfcorehdr.c
…
exec_domain.c
…
exit.c
Merge tag 'mm-stable-2024-09-20-02-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2024-09-21 07:29:05 -07:00
exit.h
…
extable.c
…
fail_function.c
…
fork.c
x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
2025-04-10 14:39:18 +02:00
freezer.c
sched/fair: Fix external p->on_rq users
2024-10-14 09:14:35 +02:00
gen_kheaders.sh
kheaders: Ignore silly-rename files
2025-01-23 17:22:55 +01:00
groups.c
…
hung_task.c
…
iomem.c
…
irq_work.c
…
jump_label.c
jump_label: Fix static_key_slow_dec() yet again
2024-09-10 11:57:27 +02:00
kallsyms_internal.h
…
kallsyms_selftest.c
kallsyms: Match symbols exactly with CONFIG_LTO_CLANG
2024-08-15 09:33:35 -07:00
kallsyms_selftest.h
…
kallsyms.c
kallsyms: Match symbols exactly with CONFIG_LTO_CLANG
2024-08-15 09:33:35 -07:00
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.kexec
crash, powerpc: default to CRASH_DUMP=n on PPC_BOOK3S_32
2024-11-14 22:43:48 -08:00
Kconfig.locks
…
Kconfig.preempt
…
kcov.c
kcov: mark in_softirq_really() as __always_inline
2025-01-09 13:33:49 +01:00
kexec_core.c
…
kexec_elf.c
kexec: initialize ELF lowest address to ULONG_MAX
2025-04-10 14:39:24 +02:00
kexec_file.c
kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
2024-09-01 17:59:01 -07:00
kexec_internal.h
kexec: use atomic_try_cmpxchg_acquire() in kexec_trylock()
2024-09-01 20:43:23 -07:00
kexec.c
…
kheaders.c
…
kprobes.c
…
ksyms_common.c
…
ksysfs.c
…
kthread.c
kthread: unpark only parked kthread
2024-10-09 12:47:19 -07:00
latencytop.c
…
Makefile
mm: move kernel/numa.c to mm/
2024-09-03 21:15:26 -07:00
module_signature.c
…
notifier.c
…
nsproxy.c
…
padata.c
padata: avoid UAF for reorder_work
2025-02-08 09:57:35 +01:00
panic.c
Merge tag 'drm-next-2024-09-19' of https://gitlab.freedesktop.org/drm/kernel
2024-09-19 10:18:15 +02:00
params.c
…
pid_namespace.c
…
pid_sysctl.h
…
pid.c
…
profile.c
…
ptrace.c
…
range.c
…
reboot.c
Flush console log from kernel_power_off()
2025-04-20 10:15:12 +02:00
regset.c
…
relay.c
[tree-wide] finally take no_llseek out
2024-09-27 08:18:43 -07:00
resource_kunit.c
resource, kunit: fix user-after-free in resource_test_region_intersects()
2024-10-09 12:47:19 -07:00
resource.c
resource,kexec: walk_system_ram_res_rev must retain resource flags
2024-10-28 21:40:40 -07:00
rseq.c
…
scftorture.c
…
scs.c
…
seccomp.c
seccomp: passthrough uretprobe systemcall without filtering
2025-02-17 10:05:12 +01:00
signal.c
posix-timers: Target group sigqueue to current task only if not exiting
2024-12-09 10:41:16 +01:00
smp.c
smp: print only local CPU info when sched_clock goes backward
2024-08-15 00:06:48 +05:30
smpboot.c
…
smpboot.h
…
softirq.c
softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
2024-12-14 20:04:16 +01:00
stackleak.c
…
stacktrace.c
…
static_call_inline.c
x86/static-call: provide a way to do very early static-call updates
2024-12-19 18:13:23 +01:00
static_call.c
…
stop_machine.c
rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs()
2024-08-15 21:30:42 +05:30
sys_ni.c
…
sys.c
Merge tag 'pull-stable-struct_fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2024-09-23 09:35:36 -07:00
sysctl-test.c
…
sysctl.c
…
task_work.c
sched/core: Disable page allocation in task_tick_mm_cid()
2024-10-11 10:49:32 +02:00
taskstats.c
…
torture.c
…
tracepoint.c
tracepoint: Support iterating tracepoints in a loading module
2024-09-25 23:23:44 +09:00
tsacct.c
…
ucount.c
signal: restore the override_rlimit logic
2024-11-07 14:14:59 -08:00
uid16.c
…
uid16.h
…
umh.c
…
up.c
…
user_namespace.c
user_namespace: use kmemdup_array() instead of kmemdup() for multiple allocation
2024-09-09 16:47:42 -07:00
user-return-notifier.c
…
user.c
uidgid: make sure we fit into one cacheline
2024-09-12 12:16:09 +02:00
usermode_driver.c
…
utsname_sysctl.c
…
utsname.c
…
vhost_task.c
vhost: return task creation error instead of NULL
2025-03-22 12:54:21 -07:00
vmcore_info.c
mm: support only one page_type per page
2024-09-03 21:15:43 -07:00
watch_queue.c
watch_queue: fix pipe accounting mismatch
2025-04-10 14:39:10 +02:00
watchdog_buddy.c
…
watchdog_perf.c
watchdog/hardlockup/perf: Fix perf_event memory leak
2025-04-10 14:39:11 +02:00
watchdog.c
watchdog/hardlockup/perf: Fix perf_event memory leak
2025-04-10 14:39:11 +02:00
workqueue_internal.h
…
workqueue.c
workqueue: Put the pwq after detaching the rescuer from the pool
2025-02-21 14:01:18 +01:00