linux

mirror of https://github.com/torvalds/linux.git synced 2026-03-08 05:24:39 +01:00

Linux kernel source tree

Find a file

Chen Zhongjin 0fe6ee8f12 profiling: fix shift too large makes kernel panic `2d186afd04` ("profiling: fix shift-out-of-bounds bugs") limits shift value by [0, BITS_PER_LONG -1], which means [0, 63]. However, syzbot found that the max shift value should be the bit number of (_etext - _stext). If shift is outside of this, the "buffer_bytes" will be zero and will cause kzalloc(0). Then the kernel panics due to dereferencing the returned pointer 16. This can be easily reproduced by passing a large number like 60 to enable profiling and then run readprofile. LOGS: BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 6148067 P4D 6148067 PUD 6142067 PMD 0 PREEMPT SMP CPU: 4 PID: 184 Comm: readprofile Not tainted 5.18.0+ #162 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_profile+0x104/0x220 RSP: 0018:ffffc900006fbe80 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888006150000 RSI: 0000000000000001 RDI: ffffffff82aba4a0 RBP: 000000000188bb60 R08: 0000000000000010 R09: ffff888006151000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82aba4a0 R13: 0000000000000000 R14: ffffc900006fbf08 R15: 0000000000020c30 FS: 000000000188a8c0(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000006144000 CR4: 00000000000006e0 Call Trace: <TASK> proc_reg_read+0x56/0x70 vfs_read+0x9a/0x1b0 ksys_read+0xa1/0xe0 ? fpregs_assert_state_consistent+0x1e/0x40 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x4d4b4e RSP: 002b:00007ffebb668d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000000000188a8a0 RCX: 00000000004d4b4e RDX: 0000000000000400 RSI: 000000000188bb60 RDI: 0000000000000003 RBP: 0000000000000003 R08: 000000000000006e R09: 0000000000000000 R10: 0000000000000041 R11: 0000000000000246 R12: 000000000188bb60 R13: 0000000000000400 R14: 0000000000000000 R15: 000000000188bb60 </TASK> Modules linked in: CR2: 0000000000000010 Killed ---[ end trace 0000000000000000 ]--- Check prof_len in profile_init() to prevent it be zero. Link: https://lkml.kernel.org/r/20220531012854.229439-1-chenzhongjin@huawei.com Fixes: `1da177e4c3` ("Linux-2.6.12-rc2") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>		2022-06-16 19:58:20 -07:00
arch	virtio,vdpa: fixes	2022-06-11 16:32:47 -07:00
block	block: remove bioset_init_from_src	2022-06-08 14:04:14 -04:00
certs	certs: Convert spaces in certs/Makefile to a tab	2022-06-10 11:42:02 -07:00
crypto	This update includes the following changes:	2022-05-27 18:06:49 -07:00
Documentation	Kbuild fixes for v5.19	2022-06-12 11:10:07 -07:00
drivers	platform-drivers-x86 for v5.19-2	2022-06-12 11:33:42 -07:00
fs	3 smb3 reconnect fixes	2022-06-12 11:05:44 -07:00
include	Workqueue fixes for v5.19-rc1	2022-06-12 11:16:00 -07:00
init	gcc-12: disable '-Warray-bounds' universally for now	2022-06-09 10:11:12 -07:00
ipc	These changes update the ipc sysctls so that they are fundamentally	2022-06-03 15:54:57 -07:00
kernel	profiling: fix shift too large makes kernel panic	2022-06-16 19:58:20 -07:00
lib	Random number generator fixes for Linux 5.19-rc2.	2022-06-12 10:33:38 -07:00
LICENSES	LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers	2021-12-16 14:33:10 +01:00
mm	mm/huge_memory: Fix xarray node memory leak	2022-06-09 16:24:25 -04:00
net	Notable changes:	2022-06-10 17:28:43 -07:00
samples	drm for 5.19-rc1	2022-05-25 16:18:27 -07:00
scripts	checkpatch: add XA_STATE and XA_STATE_ORDER to the macro declaration list	2022-06-16 19:58:19 -07:00
security	KEYS: trusted: tpm2: Fix migratable logic	2022-06-08 14:12:13 +03:00
sound	sound fixes for 5.19-rc2	2022-06-10 10:20:57 -07:00
tools	Random number generator fixes for Linux 5.19-rc2.	2022-06-12 10:33:38 -07:00
usr	Not a lot of material this cycle. Many singleton patches against various	2022-05-27 11:22:03 -07:00
virt	* Fix syzkaller NULL pointer dereference	2022-06-08 09:16:31 -07:00
.clang-format	clang-format: Fix space after for_each macros	2022-05-20 19:27:16 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	kbuild: split the second line of .mod into .usyms	2022-05-08 03:16:59 +09:00
.mailmap	Hot fixes for 5.19-rc1.	2022-06-05 17:05:38 -07:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: replace a Microchip AT91 maintainer	2022-02-09 11:30:01 +01:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	Notable changes:	2022-06-10 17:28:43 -07:00
Makefile	Linux 5.19-rc2	2022-06-12 16:11:37 -07:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.