Philipp Stanner 22260dabcf kernel: watch_queue: copy user-array safely ...

[ Upstream commit ca0776571d ]

Currently, there is no overflow-check with memdup_user().

Use the new function memdup_array_user() instead of memdup_user() for
duplicating the user-space array safely.

Suggested-by: David Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230920123612.16914-5-pstanner@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-11-28 16:56:16 +00:00

..

bpf

bpf: Detect IP == ksym.end as part of BPF program

2023-11-28 16:56:15 +00:00

cgroup

cgroup: Remove duplicates in cgroup v1 tasks file

2023-10-19 23:05:37 +02:00

configs

…

debug

lockdown: also lock down previous kgdb use

2022-05-25 09:57:37 +02:00

dma

dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock

2023-10-06 13:18:14 +02:00

entry

entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up

2023-03-30 12:47:51 +02:00

events

perf/core: Bail out early if the request AUX area is out of bound

2023-11-28 16:56:15 +00:00

futex

futex: Don't include process MM in futex key on no-MMU

2023-11-20 11:08:13 +01:00

gcov

gcov: add support for checksum field

2022-12-31 13:14:47 +01:00

irq

genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()

2023-11-20 11:08:13 +01:00

kcsan

kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures

2023-07-23 13:47:12 +02:00

livepatch

livepatch: Fix missing newline character in klp_resolve_symbols()

2023-11-20 11:08:25 +01:00

locking

locking/ww_mutex/test: Fix potential workqueue corruption

2023-11-28 16:56:15 +00:00

power

workqueue: Introduce show_one_worker_pool and show_one_workqueue.

2023-05-11 23:00:35 +09:00

printk

printk: Consolidate console deferred printing

2023-09-23 11:09:59 +02:00

rcu

rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()

2023-09-23 11:09:55 +02:00

sched

sched: Fix stop_one_cpu_nowait() vs hotplug

2023-11-20 11:08:13 +01:00

time

timers/nohz: Last resort update jiffies on nohz_full IRQ entry

2023-08-16 18:22:04 +02:00

trace

tracing/kprobes: Fix the order of argument descriptions

2023-11-20 11:08:30 +01:00

.gitignore

…

acct.c

acct: fix potential integer overflow in encode_comp_t()

2022-12-31 13:14:40 +01:00

async.c

…

audit_fsnotify.c

audit: fix potential double free on error path from fsnotify_add_inode_mark

2022-08-31 17:16:33 +02:00

audit_tree.c

…

audit_watch.c

…

audit.c

…

audit.h

audit: log AUDIT_TIME_* records only from rules

2022-04-08 14:23:06 +02:00

auditfilter.c

…

auditsc.c

audit: fix possible soft lockup in __audit_inode_child()

2023-09-19 12:22:39 +02:00

backtracetest.c

…

bounds.c

…

capability.c

…

cfi.c

cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle

2022-06-22 14:22:04 +02:00

compat.c

sched_getaffinity: don't assume 'cpumask_size()' is fully initialized

2023-04-05 11:24:53 +02:00

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

cpu/hotplug: Do not bail-out in DYING/STARTING sections

2022-12-31 13:14:04 +01:00

crash_core.c

…

crash_dump.c

…

cred.c

…

delayacct.c

…

dma.c

…

exec_domain.c

…

exit.c

exit: Use READ_ONCE() for all oops/warn limit reads

2023-02-01 08:27:22 +01:00

extable.c

…

fail_function.c

kernel/fail_function: fix memory leak with using debugfs_lookup()

2023-03-11 13:57:38 +01:00

fork.c

kernel/fork: beware of __put_task_struct() calling context

2023-09-23 11:09:55 +02:00

freezer.c

…

gen_kheaders.sh

…

groups.c

…

hung_task.c

…

iomem.c

…

irq_work.c

…

jump_label.c

…

kallsyms.c

…

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

…

kexec_core.c

kexec: fix a memory leak in crash_shrink_memory()

2023-07-23 13:46:52 +02:00

kexec_elf.c

…

kexec_file.c

kexec: support purgatories with .text.hot sections

2023-06-21 15:59:14 +02:00

kexec_internal.h

panic, kexec: make __crash_kexec() NMI safe

2023-04-20 12:13:57 +02:00

kexec.c

kernel: kexec: copy user-array safely

2023-11-28 16:56:16 +00:00

kheaders.c

kheaders: Use array declaration instead of char

2023-05-11 23:00:17 +09:00

kmod.c

…

kprobes.c

kprobes: Prohibit probing on CFI preamble symbol

2023-09-19 12:22:28 +02:00

ksysfs.c

kexec: turn all kexec_mutex acquisitions into trylocks

2023-04-20 12:13:57 +02:00

kthread.c

kthread: add the helper function kthread_run_on_cpu()

2023-03-30 12:47:42 +02:00

latencytop.c

…

Makefile

futex: Move to kernel/futex/

2022-12-31 13:14:04 +01:00

module_signature.c

…

module_signing.c

…

module-internal.h

…

module.c

modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules

2023-09-06 21:28:38 +01:00

notifier.c

…

nsproxy.c

…

padata.c

padata: Fix refcnt handling in padata_free_shell()

2023-11-20 11:08:24 +01:00

panic.c

exit: Use READ_ONCE() for all oops/warn limit reads

2023-02-01 08:27:22 +01:00

params.c

…

pid_namespace.c

rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()

2023-03-10 09:39:09 +01:00

pid.c

…

profile.c

profiling: fix shift too large makes kernel panic

2022-08-17 14:24:04 +02:00

ptrace.c

ptrace: Reimplement PTRACE_KILL by always sending SIGKILL

2022-06-09 10:22:29 +02:00

range.c

…

reboot.c

…

regset.c

…

relay.c

relayfs: fix out-of-bounds access in relay_file_read

2023-05-11 23:00:18 +09:00

resource_kunit.c

…

resource.c

dax/kmem: Fix leak of memory-hotplug resources

2023-03-10 09:40:08 +01:00

rseq.c

rseq: Remove broken uapi field layout on 32-bit little endian

2022-04-08 14:23:10 +02:00

scftorture.c

scftorture: Forgive memory-allocation failure if KASAN

2023-09-23 11:09:55 +02:00

scs.c

…

seccomp.c

…

signal.c

signal handling: don't use BUG_ON() for debugging

2022-07-21 21:24:42 +02:00

smp.c

locking/csd_lock: Change csdlock_debug from early_param to __setup

2022-08-17 14:24:24 +02:00

smpboot.c

…

smpboot.h

…

softirq.c

timers/nohz: Last resort update jiffies on nohz_full IRQ entry

2023-08-16 18:22:04 +02:00

stackleak.c

…

stacktrace.c

stacktrace: move filter_irq_stacks() to kernel/stacktrace.c

2022-04-13 20:59:28 +02:00

static_call_inline.c

static_call: Don't make __static_call_return0 static

2022-04-13 20:59:28 +02:00

static_call.c

static_call: Don't make __static_call_return0 static

2022-04-13 20:59:28 +02:00

stop_machine.c

…

sys_ni.c

kernel/sys_ni: add compat entry for fadvise64_64

2022-08-31 17:16:33 +02:00

sys.c

kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()

2023-04-26 13:51:52 +02:00

sysctl-test.c

…

sysctl.c

kernel/panic: move panic sysctls to its own file

2023-02-01 08:27:20 +01:00

task_work.c

…

taskstats.c

…

test_kprobes.c

…

torture.c

torture: Fix hang during kthread shutdown phase

2023-08-30 16:18:19 +02:00

tracepoint.c

…

tsacct.c

…

ucount.c

…

uid16.c

…

uid16.h

…

umh.c

…

up.c

…

user_namespace.c

…

user-return-notifier.c

…

user.c

…

usermode_driver.c

…

utsname_sysctl.c

…

utsname.c

…

watch_queue.c

kernel: watch_queue: copy user-array safely

2023-11-28 16:56:16 +00:00

watchdog_hld.c

watchdog/perf: more properly prevent false positives with turbo modes

2023-07-23 13:46:52 +02:00

watchdog.c

watchdog: export lockup_detector_reconfigure

2022-08-25 11:40:43 +02:00

workqueue_internal.h

…

workqueue.c

workqueue: Provide one lock class key per work_on_cpu() callsite

2023-11-28 16:56:15 +00:00