Oleg Nesterov 0f008dc311 uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned ... commit 013b2deba9a6b80ca02f4fafd7dedf875e9b4450 upstream. uprobe_write_opcode() must not cross page boundary; prepare_uprobe() relies on arch_uprobe_analyze_insn() which should validate "vaddr" but some architectures (csky, s390, and sparc) don't do this. We can remove the BUG_ON() check in prepare_uprobe() and validate the offset early in __uprobe_register(). The new IS_ALIGNED() check matches the alignment check in arch_prepare_kprobe() on supported architectures, so I think that all insns must be aligned to UPROBE_SWBP_INSN_SIZE. Another problem is __update_ref_ctr() which was wrong from the very beginning, it can read/write outside of kmap'ed page unless "vaddr" is aligned to sizeof(short), __uprobe_register() should check this too. Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com> Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Tested-by: Sven Schnelle <svens@linux.ibm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [ check for ref_ctr_offset removed for backport - gregkh ] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-06-10 21:35:01 +02:00
..
bpf	cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled	2020-05-02 17:25:53 +02:00
cgroup	Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race window"	2020-06-07 13:17:53 +02:00
configs
debug	kdb: do a sanity check on the cpu in kdb_per_cpu()	2020-01-27 14:50:48 +01:00
dma	dma-debug: add a schedule point in debug_dma_dump_mappings()	2020-01-04 19:12:43 +01:00
events	uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned	2020-06-10 21:35:01 +02:00
gcov	kernel/gcov/fs.c: gcov_seq_next() should increase position index	2020-04-29 16:31:12 +02:00
irq	genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()	2020-04-17 10:48:41 +02:00
livepatch	livepatch: Nullify obj->mod in klp_module_coming()'s error path	2019-10-07 18:57:10 +02:00
locking	locktorture: Print ratio of acquisitions, not failures	2020-04-23 10:30:23 +02:00
power	PM: hibernate: Freeze kernel threads in software_resume()	2020-05-06 08:13:28 +02:00
printk	printk: fix exclusive_console replaying	2020-02-11 04:33:51 -08:00
rcu	rcu: Avoid data-race in rcu_gp_fqs_check_wake()	2020-02-11 04:33:55 -08:00
sched	sched: Avoid scale real weight down to zero	2020-04-17 10:48:40 +02:00
time	clocksource: Prevent double add_timer_on() for watchdog_timer	2020-02-11 04:34:18 -08:00
trace	Stop the ad-hoc games with -Wno-maybe-initialized	2020-05-20 08:18:45 +02:00
.gitignore
acct.c	acct_on(): don't mess with freeze protection	2019-05-31 06:46:05 -07:00
async.c
audit.c	audit: check the length of userspace generated audit records	2020-04-29 16:31:31 +02:00
audit.h
audit_fsnotify.c
audit_tree.c	audit: Embed key into chunk	2019-12-13 08:51:11 +01:00
audit_watch.c	audit_get_nd(): don't unlock parent too early	2019-12-13 08:51:02 +01:00
auditfilter.c	audit: fix error handling in audit_data_to_entry()	2020-03-05 16:42:17 +01:00
auditsc.c	audit: print empty EXECVE args	2019-12-01 09:17:17 +01:00
backtracetest.c
bounds.c	kbuild: fix kernel/bounds.c 'W=1' warning	2018-11-13 11:08:47 -08:00
capability.c	LSM: generalize flag passing to security_capable	2020-01-23 08:21:29 +01:00
compat.c
configs.c
context_tracking.c
cpu.c	x86/speculation: Remove redundant arch_smt_update() invocation	2020-04-17 10:48:50 +02:00
cpu_pm.c
crash_core.c	kernel/crash_core.c: print timestamp using time64_t	2018-08-22 10:52:47 -07:00
crash_dump.c
cred.c	memcg: account security cred as well to kmemcg	2020-01-09 10:19:00 +01:00
delayacct.c
dma.c
elfcore.c	kernel/elfcore.c: include proper prototypes	2019-10-11 18:21:23 +02:00
exec_domain.c
exit.c	exit: panic before exit_mm() on global init exit	2020-01-09 10:19:02 +01:00
extable.c
fail_function.c
fork.c	fork,memcg: alloc_thread_stack_node needs to set tsk->stack	2020-01-27 14:50:58 +01:00
freezer.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
futex.c	futex: Unbreak futex hashing	2020-03-25 08:06:14 +01:00
groups.c
hung_task.c	kernel: hung_task.c: disable on suspend	2019-04-20 09:16:02 +02:00
iomem.c
irq_work.c	irq_work: Do not raise an IPI when queueing work on the local CPU	2019-05-31 06:46:19 -07:00
jump_label.c	jump_label: move 'asm goto' support test to Kconfig	2019-06-04 08:02:34 +02:00
kallsyms.c	kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol	2019-09-21 07:17:02 +02:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt	kconfig: include kernel/Kconfig.preempt from init/Kconfig	2018-08-02 08:06:54 +09:00
kcov.c	kernel/kcov.c: mark write_comp_data() as notrace	2019-02-12 19:47:20 +01:00
kexec.c	kexec: add call to LSM hook in original kexec_load syscall	2018-07-16 12:31:57 -07:00
kexec_core.c	kexec: Allocate decrypted control pages for kdump if SME is enabled	2019-11-24 08:20:29 +01:00
kexec_file.c
kexec_internal.h
kmod.c	kmod: make request_module() return an error when autoloading is disabled	2020-04-17 10:48:52 +02:00
kprobes.c	kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic	2020-03-11 14:14:47 +01:00
ksysfs.c
kthread.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
latencytop.c
Makefile	y2038: futex: Move compat implementation into futex.c	2019-12-01 09:17:38 +01:00
memremap.c	mm/memory_hotplug: shrink zones when offlining memory	2020-01-29 16:43:27 +01:00
module-internal.h
module.c	module: avoid setting info->name early in case we can fall back to info->mod->name	2020-02-24 08:34:49 +01:00
module_signing.c
notifier.c	x86/mm: split vmalloc_sync_all()	2020-03-25 08:06:13 +01:00
nsproxy.c
padata.c	padata: purge get_cpu and reorder_via_wq from padata_do_serial	2020-05-27 17:37:36 +02:00
panic.c	kernel/panic.c: do not append newline to the stack protector panic string	2019-12-01 09:17:10 +01:00
params.c
pid.c	Fix failure path in alloc_pid()	2019-01-13 09:51:06 +01:00
pid_namespace.c	signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig	2019-07-26 09:14:01 +02:00
profile.c
ptrace.c	ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()	2020-01-23 08:21:29 +01:00
range.c
reboot.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
relay.c	kernel/relay.c: handle alloc_percpu returning NULL in relay_open	2020-06-07 13:17:54 +02:00
resource.c	resource: fix locking in find_next_iomem_res()	2019-09-16 08:22:20 +02:00
rseq.c	rseq: uapi: Declare rseq_cs field as union, update includes	2018-07-10 22:18:52 +02:00
seccomp.c	LSM: generalize flag passing to security_capable	2020-01-23 08:21:29 +01:00
signal.c	signal: Extend exec_id to 64bits	2020-04-17 10:48:47 +02:00
smp.c	cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM	2019-02-12 19:47:25 +01:00
smpboot.c
smpboot.h
softirq.c	nohz: Fix missing tick reprogram when interrupting an inline softirq	2018-08-03 15:52:10 +02:00
stacktrace.c
stop_machine.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
sys.c	kernel/sys.c: prctl: fix false positive in validate_prctl_map()	2019-06-15 11:54:01 +02:00
sys_ni.c
sysctl.c	kernel: sysctl: make drop_caches write-only	2020-01-04 19:13:17 +01:00
sysctl_binary.c
task_work.c
taskstats.c	taskstats: fix data-race	2020-01-09 10:18:59 +01:00
test_kprobes.c
torture.c
tracepoint.c	tracepoint: Fix tracepoint array element size mismatch	2018-10-17 15:35:29 -04:00
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c	coredump: fix crash when umh is disabled	2020-05-14 07:57:21 +02:00
up.c
user-return-notifier.c
user.c	userns: use irqsave variant of refcount_dec_and_lock()	2018-08-22 10:52:47 -07:00
user_namespace.c	userns: also map extents in the reverse map to kernel IDs	2018-11-13 11:09:00 -08:00
utsname.c
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-08-11 02:05:53 -05:00
watchdog.c	watchdog/softlockup: Enforce that timestamp is valid on boot	2020-02-24 08:34:49 +01:00
watchdog_hld.c	watchdog: Mark watchdog touch functions as notrace	2018-08-30 12:56:40 +02:00
workqueue.c	workqueue: don't use wq_select_unbound_cpu() for bound works	2020-03-18 07:14:20 +01:00
workqueue_internal.h