Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-11 06:31:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
9484e2aef4
linux/mm/kasan
History
Walter Wu 13384f6125 kasan: fix null pointer dereference in kasan_record_aux_stack 
Syzbot reported the following [1]:

  BUG: kernel NULL pointer dereference, address: 0000000000000008
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 2d993067 P4D 2d993067 PUD 19a3c067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP KASAN
  CPU: 1 PID: 3852 Comm: kworker/1:2 Not tainted 5.10.0-syzkaller #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  Workqueue: events free_ipc
  RIP: 0010:kasan_record_aux_stack+0x77/0xb0

Add null checking slab object from kasan_get_alloc_meta() in order to
avoid null pointer dereference.

[1] https://syzkaller.appspot.com/x/log.txt?x=10a82a50d00000

Link: https://lkml.kernel.org/r/20201228080018.23041-1-walter-zh.wu@mediatek.com
Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com>
Suggested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Alexander Potapenko <glider@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-12-29 15:36:49 -08:00
..
common.c kasan, mm: allow cache merging with no metadata 2020-12-22 12:55:09 -08:00
generic.c kasan: fix null pointer dereference in kasan_record_aux_stack 2020-12-29 15:36:49 -08:00
hw_tags.c kasan: sanitize objects when metadata doesn't fit 2020-12-22 12:55:09 -08:00
init.c kasan: define KASAN_MEMORY_PER_SHADOW_PAGE 2020-12-22 12:55:06 -08:00
kasan.h kasan: sanitize objects when metadata doesn't fit 2020-12-22 12:55:09 -08:00
Makefile kasan, arm64: implement HW_TAGS runtime 2020-12-22 12:55:08 -08:00
quarantine.c kasan: sanitize objects when metadata doesn't fit 2020-12-22 12:55:09 -08:00
report_generic.c kasan: separate metadata_fetch_row for each mode 2020-12-22 12:55:07 -08:00
report_hw_tags.c kasan: inline kasan_reset_tag for tag-based modes 2020-12-22 12:55:08 -08:00
report_sw_tags.c kasan: sanitize objects when metadata doesn't fit 2020-12-22 12:55:09 -08:00
report.c kasan: sanitize objects when metadata doesn't fit 2020-12-22 12:55:09 -08:00
shadow.c kasan: don't round_up too much 2020-12-22 12:55:09 -08:00
sw_tags.c kasan: sanitize objects when metadata doesn't fit 2020-12-22 12:55:09 -08:00