Enlin Mu dc2f60de9a pstore/ram: Check start of empty przs during init ... commit fe8c3623ab06603eb760444a032d426542212021 upstream. After commit 30696378f6 ("pstore/ram: Do not treat empty buffers as valid"), initialization would assume a prz was valid after seeing that the buffer_size is zero (regardless of the buffer start position). This unchecked start value means it could be outside the bounds of the buffer, leading to future access panics when written to: sysdump_panic_event+0x3b4/0x5b8 atomic_notifier_call_chain+0x54/0x90 panic+0x1c8/0x42c die+0x29c/0x2a8 die_kernel_fault+0x68/0x78 __do_kernel_fault+0x1c4/0x1e0 do_bad_area+0x40/0x100 do_translation_fault+0x68/0x80 do_mem_abort+0x68/0xf8 el1_da+0x1c/0xc0 __raw_writeb+0x38/0x174 __memcpy_toio+0x40/0xac persistent_ram_update+0x44/0x12c persistent_ram_write+0x1a8/0x1b8 ramoops_pstore_write+0x198/0x1e8 pstore_console_write+0x94/0xe0 ... To avoid this, also check if the prz start is 0 during the initialization phase. If not, the next prz sanity check case will discover it (start > size) and zap the buffer back to a sane state. Fixes: 30696378f6 ("pstore/ram: Do not treat empty buffers as valid") Cc: Yunlong Xing <yunlong.xing@unisoc.com> Cc: stable@vger.kernel.org Signed-off-by: Enlin Mu <enlin.mu@unisoc.com> Link: https://lore.kernel.org/r/20230801060432.1307717-1-yunlong.xing@unisoc.com [kees: update commit log with backtrace and clarifications] Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-09-19 12:20:22 +02:00
..
9p	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"	2022-06-22 14:13:12 +02:00
adfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
affs	affs: initialize fsdata in affs_truncate()	2023-02-01 08:23:11 +01:00
afs	afs: Fix vlserver probe RTT handling	2023-06-21 15:45:40 +02:00
autofs
befs
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:56:52 +01:00
btrfs	btrfs: fix BUG_ON condition in btrfs_cancel_balance	2023-08-26 15:26:51 +02:00
cachefiles	fs/cachefiles: Remove wait_bit_key layout dependency	2021-03-30 14:32:07 +02:00
ceph	ceph: defer stopping mdsc delayed_work	2023-08-11 11:57:52 +02:00
cifs	cifs: Release folio lock on fscache read hit.	2023-08-26 15:26:55 +02:00
coda	coda: Avoid partial allocation of sig_inputArgs	2023-03-11 16:39:51 +01:00
configfs	configfs: fix a race in configfs_lookup()	2023-09-19 12:20:03 +02:00
cramfs
crypto	fscrypt: fix keyring memory leak on mount failure	2022-11-10 18:14:25 +01:00
debugfs	debugfs: fix error when writing negative value to atomic_t debugfs file	2023-01-14 10:15:19 +01:00
devpts	fsnotify: fix fsnotify hooks in pseudo filesystems	2022-02-01 17:25:39 +01:00
dlm	dlm: fix plock lookup when using multiple lockspaces	2023-09-19 12:20:22 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 12:06:55 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-11-25 16:55:02 +01:00
efs
erofs	erofs: ensure that the post-EOF tails are all zeroed	2023-09-19 12:20:02 +02:00
exfat	exfat: check if filename entries exceeds max filename length	2023-08-11 11:57:55 +02:00
exportfs
ext2	ext2: Drop fragment support	2023-08-11 11:57:54 +02:00
ext4	ext4: correct grp validation in ext4_mb_good_group	2023-09-19 12:20:14 +02:00
f2fs	f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()	2023-07-27 08:44:25 +02:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-09 10:20:58 +02:00
freevxfs
fscache	fscache: Fix cookie key hashing	2021-09-18 13:40:15 +02:00
fuse	fuse: revalidate: don't invalidate if interrupted	2023-07-27 08:44:34 +02:00
gfs2	gfs2: Fix possible data races in gfs2_show_options()	2023-08-26 15:26:45 +02:00
hfs	hfs: fix missing hfs_bnode_get() in __hfs_bnode_create	2023-03-11 16:39:55 +01:00
hfsplus	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()	2023-05-30 12:57:47 +01:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:42:06 +02:00
hpfs
hugetlbfs	hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()	2023-01-14 10:16:20 +01:00
iomap	xfs: use current->journal_info for detecting transaction recursion	2022-07-07 17:52:19 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 14:58:33 +01:00
jbd2	jdb2: Don't refuse invalidation of already invalidated buffers	2023-05-17 11:47:52 +02:00
jffs2	jffs2: reduce stack usage in jffs2_build_xattr_subsystem()	2023-07-27 08:44:13 +02:00
jfs	jfs: validate max amount of blocks before allocation.	2023-09-19 12:20:15 +02:00
kernfs	kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR	2023-07-27 08:44:05 +02:00
lockd	fs: lockd: avoid possible wrong NULL parameter	2023-09-19 12:20:15 +02:00
minix	minix: fix bug when opening a file with O_DIRECT	2022-04-13 21:01:01 +02:00
nfs	NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ	2023-09-19 12:20:16 +02:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:53:45 +01:00
nfsd	NFSD: da_addr_body field missing in some GETDEVICEINFO replies	2023-09-19 12:20:15 +02:00
nilfs2	nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse	2023-09-19 12:20:03 +02:00
nls	fs/nls: make load_nls() take a const parameter	2023-09-19 12:20:04 +02:00
notify	fanotify: disallow mount/sb marks on kernel internal pseudo fs	2023-07-27 08:44:15 +02:00
ntfs	ntfs: check overflow when iterating ATTR_RECORDs	2022-11-25 17:45:57 +01:00
ocfs2	fs: ocfs2: namei: check return value of ocfs2_add_entry()	2023-09-19 12:20:09 +02:00
omfs
openpromfs
orangefs	orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()	2023-01-14 10:16:20 +01:00
overlayfs	ovl: Always reevaluate the file signature for IMA	2023-09-19 12:20:05 +02:00
proc	procfs: block chmod on /proc/thread-self/comm	2023-09-19 12:20:22 +02:00
pstore	pstore/ram: Check start of empty przs during init	2023-09-19 12:20:22 +02:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-30 10:11:08 +02:00
qnx6
quota	quota: fix dqput() to follow the guarantees dquot_srcu should provide	2023-09-19 12:20:10 +02:00
ramfs	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs	2023-07-27 08:44:13 +02:00
reiserfs	reiserfs: Check the return value from __getblk()	2023-09-19 12:20:06 +02:00
romfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-22 12:55:56 +01:00
sysfs
sysv	fs/sysv: Null check to prevent null-ptr-deref bug	2023-08-11 11:57:53 +02:00
tracefs	tracefs: Only clobber mode/uid/gid on remount if asked	2022-09-20 12:38:31 +02:00
ubifs	ubifs: Free memory for tmpfile name	2023-05-17 11:47:35 +02:00
udf	udf: Handle error when adding extent to a file	2023-09-19 12:20:06 +02:00
ufs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
unicode
vboxsf	vboxfs: fix broken legacy mount signature checking	2021-10-17 10:43:33 +02:00
verity	fsverity: skip PKCS#7 parser when keyring is empty	2023-09-19 12:20:22 +02:00
xfs	xfs: verify buffer contents when we skip log replay	2023-06-14 11:09:59 +02:00
zonefs	zonefs: Fix error message in zonefs_file_dio_append()	2023-04-05 11:23:51 +02:00
aio.c	aio: fix mremap after fork null-deref	2023-02-22 12:55:54 +01:00
anon_inodes.c
attr.c	attr: use consistent sgid stripping checks	2023-03-22 13:30:08 +01:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c	binfmt: Fix error return code in load_elf_fdpic_binary()	2023-01-14 10:16:26 +01:00
binfmt_elf.c	fs/binfmt_elf: Fix memory leak in load_elf_binary()	2022-11-03 23:57:49 +09:00
binfmt_em86.c
binfmt_flat.c	binfmt_flat: do not stop relocating GOT entries prematurely on riscv	2022-06-09 10:20:47 +02:00
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2023-01-14 10:16:13 +01:00
binfmt_script.c
block_dev.c	block: fix a race between del_gendisk and BLKRRPART	2021-06-03 09:00:45 +02:00
buffer.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:45:56 +01:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2023-01-14 10:15:59 +01:00
compat_binfmt_elf.c
coredump.c	coredump: Limit what can interrupt coredumps	2023-01-04 11:39:22 +01:00
d_path.c
dax.c	dax: fix cache flush on PMD-mapped pages	2022-06-09 10:21:16 +02:00
dcache.c
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:41:58 +02:00
drop_caches.c
eventfd.c	eventfd: prevent underflow for eventfd semaphores	2023-09-19 12:20:06 +02:00
eventpoll.c	epoll: ep_autoremove_wake_function should use list_del_init_careful	2023-06-21 15:45:37 +02:00
exec.c	exec: Copy oldsighand->action under spin-lock	2022-11-03 23:57:49 +09:00
fcntl.c	fcntl: fix potential deadlocks for &fown_struct.lock	2022-10-30 09:41:18 +01:00
fhandle.c
file_table.c	SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()	2022-05-18 10:23:48 +02:00
file.c	file: reinstate f_pos locking optimization for regular files	2023-08-11 11:57:53 +02:00
filesystems.c
fs_context.c	fs: avoid empty option when generating legacy mount string	2023-07-27 08:44:13 +02:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	writeback: fix call of incorrect macro	2023-05-17 11:48:10 +02:00
fsopen.c
init.c
inode.c	fs: Establish locking order for unrelated directories	2023-07-27 08:44:13 +02:00
internal.h	fs: Establish locking order for unrelated directories	2023-07-27 08:44:13 +02:00
ioctl.c	fs: fix an infinite loop in iomap_fiemap	2022-05-25 09:17:54 +02:00
Kconfig	tmpfs: disallow CONFIG_TMPFS_INODE64 on alpha	2021-02-17 11:02:21 +01:00
Kconfig.binfmt
kernel_read_file.c	vfs: check fd has read access in kernel_read_file_from_fd()	2021-10-27 09:56:51 +02:00
libfs.c	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value	2023-01-14 10:15:19 +01:00
locks.c	filelock: new helper: vfs_inode_has_locks	2023-01-14 10:16:47 +01:00
Makefile	io_uring: import 5.15-stable io_uring	2023-01-04 11:39:23 +01:00
mbcache.c	mbcache: Avoid nesting of cache->c_list_lock under bit locks	2023-01-14 10:16:50 +01:00
mount.h
mpage.c
namei.c	fs: Fix error checking for d_hash_and_lookup()	2023-09-19 12:20:06 +02:00
namespace.c	fs: warn about impending deprecation of mandatory locks	2021-08-26 08:35:57 -04:00
no-block.c
nsfs.c
open.c	open: make RESOLVE_CACHED correctly test for O_TMPFILE	2023-08-11 11:57:53 +02:00
pipe.c	pipe: Fix missing lock in pipe_resize_ring()	2022-06-06 08:42:41 +02:00
pnode.c	pnode: terminate at peers of source	2023-01-14 10:16:27 +01:00
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:06:13 +01:00
posix_acl.c
proc_namespace.c	proc mountinfo: make splice available again	2020-12-30 11:54:02 +01:00
read_write.c	vfs: fix copy_file_range() averts filesystem freeze protection	2022-12-19 12:27:30 +01:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 13:00:54 +02:00
remap_range.c	fs/remap: constrain dedupe of EOF blocks	2022-07-21 21:20:01 +02:00
select.c	select: Fix indefinitely sleeping task in poll_schedule_timeout()	2022-01-29 10:26:11 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:05:59 +02:00
signalfd.c	io_uring: disable polling pollfree files	2022-09-05 10:28:58 +02:00
splice.c	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"	2022-10-17 17:26:07 +02:00
stack.c
stat.c	stat: fix inconsistency between struct stat and struct compat_stat	2022-04-27 13:53:54 +02:00
statfs.c	statfs: enforce statfs[64] structure initialization	2023-05-30 12:57:55 +01:00
super.c	fs: Protect reconfiguration of sb read-write from racing writes	2023-08-11 11:57:54 +02:00
sync.c	vfs: make sync_filesystem return errors from ->sync_fs	2022-08-31 17:15:14 +02:00
timerfd.c
userfaultfd.c	userfaultfd: open userfaultfds with O_RDONLY	2022-10-26 13:25:17 +02:00
utimes.c
xattr.c	fs: don't audit the capability check in simple_xattr_list()	2023-01-14 10:15:16 +01:00