# git rev-parse -q --verify d41a3effbb53b1bcea41e328d16a4d046a508381^{commit} d41a3effbb53b1bcea41e328d16a4d046a508381 already have revision, skipping fetch # git checkout -q -f -B kisskb d41a3effbb53b1bcea41e328d16a4d046a508381 # git clean -qxdf # < git log -1 # commit d41a3effbb53b1bcea41e328d16a4d046a508381 # Author: Hillf Danton # Date: Mon Sep 2 13:37:29 2019 +0100 # # keys: Fix missing null pointer check in request_key_auth_describe() # # If a request_key authentication token key gets revoked, there's a window in # which request_key_auth_describe() can see it with a NULL payload - but it # makes no check for this and something like the following oops may occur: # # BUG: Kernel NULL pointer dereference at 0x00000038 # Faulting instruction address: 0xc0000000004ddf30 # Oops: Kernel access of bad area, sig: 11 [#1] # ... # NIP [...] request_key_auth_describe+0x90/0xd0 # LR [...] request_key_auth_describe+0x54/0xd0 # Call Trace: # [...] request_key_auth_describe+0x54/0xd0 (unreliable) # [...] proc_keys_show+0x308/0x4c0 # [...] seq_read+0x3d0/0x540 # [...] proc_reg_read+0x90/0x110 # [...] __vfs_read+0x3c/0x70 # [...] vfs_read+0xb4/0x1b0 # [...] ksys_read+0x7c/0x130 # [...] system_call+0x5c/0x70 # # Fix this by checking for a NULL pointer when describing such a key. # # Also make the read routine check for a NULL pointer to be on the safe side. # # [DH: Modified to not take already-held rcu lock and modified to also check # in the read routine] # # Fixes: 04c567d9313e ("[PATCH] Keys: Fix race between two instantiators of a key") # Reported-by: Sachin Sant # Signed-off-by: Hillf Danton # Signed-off-by: David Howells # Tested-by: Sachin Sant # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux-ld --version # < git log --format=%s --max-count=1 d41a3effbb53b1bcea41e328d16a4d046a508381 # < make -s -j 8 ARCH=s390 O=/kisskb/build/linus_s390-allmodconfig_s390x-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux- allmodconfig # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # Added to kconfig CONFIG_SAMPLES=n # yes \n | make -s -j 8 ARCH=s390 O=/kisskb/build/linus_s390-allmodconfig_s390x-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux- oldconfig yes: standard output: Broken pipe # make -s -j 8 ARCH=s390 O=/kisskb/build/linus_s390-allmodconfig_s390x-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/s390-linux/bin/s390-linux- In file included from /kisskb/src/include/linux/kernel.h:15, from /kisskb/src/include/linux/list.h:9, from /kisskb/src/include/linux/wait.h:7, from /kisskb/src/include/linux/wait_bit.h:8, from /kisskb/src/include/linux/fs.h:6, from /kisskb/src/fs/ubifs/ubifs.h:16, from /kisskb/src/fs/ubifs/orphan.c:10: /kisskb/src/fs/ubifs/orphan.c: In function 'orphan_delete': /kisskb/src/fs/ubifs/debug.h:158:11: warning: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'ino_t' {aka 'unsigned int'} [-Wformat=] pr_debug("UBIFS DBG " type " (pid %d): " fmt "\n", current->pid, \ ^~~~~~~~~~~~ /kisskb/src/include/linux/printk.h:288:21: note: in definition of macro 'pr_fmt' #define pr_fmt(fmt) fmt ^~~ /kisskb/src/include/linux/dynamic_debug.h:143:2: note: in expansion of macro '__dynamic_func_call' __dynamic_func_call(__UNIQUE_ID(ddebug), fmt, func, ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/dynamic_debug.h:153:2: note: in expansion of macro '_dynamic_func_call' _dynamic_func_call(fmt, __dynamic_pr_debug, \ ^~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/printk.h:336:2: note: in expansion of macro 'dynamic_pr_debug' dynamic_pr_debug(fmt, ##__VA_ARGS__) ^~~~~~~~~~~~~~~~ /kisskb/src/fs/ubifs/debug.h:158:2: note: in expansion of macro 'pr_debug' pr_debug("UBIFS DBG " type " (pid %d): " fmt "\n", current->pid, \ ^~~~~~~~ /kisskb/src/fs/ubifs/debug.h:170:29: note: in expansion of macro 'ubifs_dbg_msg' #define dbg_gen(fmt, ...) ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__) ^~~~~~~~~~~~~ /kisskb/src/fs/ubifs/orphan.c:132:3: note: in expansion of macro 'dbg_gen' dbg_gen("deleted twice ino %lu", orph->inum); ^~~~~~~ /kisskb/src/fs/ubifs/orphan.c:132:32: note: format string is defined here dbg_gen("deleted twice ino %lu", orph->inum); ~~^ %u In file included from /kisskb/src/include/linux/kernel.h:15, from /kisskb/src/include/linux/list.h:9, from /kisskb/src/include/linux/wait.h:7, from /kisskb/src/include/linux/wait_bit.h:8, from /kisskb/src/include/linux/fs.h:6, from /kisskb/src/fs/ubifs/ubifs.h:16, from /kisskb/src/fs/ubifs/orphan.c:10: /kisskb/src/fs/ubifs/debug.h:158:11: warning: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'ino_t' {aka 'unsigned int'} [-Wformat=] pr_debug("UBIFS DBG " type " (pid %d): " fmt "\n", current->pid, \ ^~~~~~~~~~~~ /kisskb/src/include/linux/printk.h:288:21: note: in definition of macro 'pr_fmt' #define pr_fmt(fmt) fmt ^~~ /kisskb/src/include/linux/dynamic_debug.h:143:2: note: in expansion of macro '__dynamic_func_call' __dynamic_func_call(__UNIQUE_ID(ddebug), fmt, func, ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/dynamic_debug.h:153:2: note: in expansion of macro '_dynamic_func_call' _dynamic_func_call(fmt, __dynamic_pr_debug, \ ^~~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/printk.h:336:2: note: in expansion of macro 'dynamic_pr_debug' dynamic_pr_debug(fmt, ##__VA_ARGS__) ^~~~~~~~~~~~~~~~ /kisskb/src/fs/ubifs/debug.h:158:2: note: in expansion of macro 'pr_debug' pr_debug("UBIFS DBG " type " (pid %d): " fmt "\n", current->pid, \ ^~~~~~~~ /kisskb/src/fs/ubifs/debug.h:170:29: note: in expansion of macro 'ubifs_dbg_msg' #define dbg_gen(fmt, ...) ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__) ^~~~~~~~~~~~~ /kisskb/src/fs/ubifs/orphan.c:140:3: note: in expansion of macro 'dbg_gen' dbg_gen("delete later ino %lu", orph->inum); ^~~~~~~ /kisskb/src/fs/ubifs/orphan.c:140:31: note: format string is defined here dbg_gen("delete later ino %lu", orph->inum); ~~^ %u /kisskb/src/drivers/input/joystick/analog.c:160:2: warning: #warning Precise timer not defined for this architecture. [-Wcpp] #warning Precise timer not defined for this architecture. ^~~~~~~ /kisskb/src/lib/test_kasan.c: In function 'kasan_alloca_oob_left': /kisskb/src/lib/test_kasan.c:488:1: warning: 'kasan_alloca_oob_left' uses dynamic stack allocation } ^ /kisskb/src/lib/test_kasan.c: In function 'kasan_alloca_oob_right': /kisskb/src/lib/test_kasan.c:498:1: warning: 'kasan_alloca_oob_right' uses dynamic stack allocation } ^ In file included from /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c:40: /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c: In function 'mvpp2_setup_bm_pool': /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2.h:634:2: warning: overflow in conversion from 'long unsigned int' to 'int' changes value from '18446744073709551584' to '-32' [-Woverflow] ((total_size) - NET_SKB_PAD - MVPP2_SKB_SHINFO_SIZE) ^ /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2.h:698:33: note: in expansion of macro 'MVPP2_RX_MAX_PKT_SIZE' #define MVPP2_BM_SHORT_PKT_SIZE MVPP2_RX_MAX_PKT_SIZE(MVPP2_BM_SHORT_FRAME_SIZE) ^~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c:551:41: note: in expansion of macro 'MVPP2_BM_SHORT_PKT_SIZE' mvpp2_pools[MVPP2_BM_SHORT].pkt_size = MVPP2_BM_SHORT_PKT_SIZE; ^~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/soundwire/slave.c:16:12: warning: 'sdw_slave_add' defined but not used [-Wunused-function] static int sdw_slave_add(struct sdw_bus *bus, ^~~~~~~~~~~~~ Completed OK # rm -rf /kisskb/build/linus_s390-allmodconfig_s390x-gcc8 # Build took: 0:39:49.509732