All of lore.kernel.org
 help / color / mirror / Atom feed
* incoming
@ 2020-05-23  5:22 Andrew Morton
  2020-05-23  5:22 ` [patch 01/11] device-dax: don't leak kernel memory to user space after unloading kmem Andrew Morton
                   ` (77 more replies)
  0 siblings, 78 replies; 94+ messages in thread
From: Andrew Morton @ 2020-05-23  5:22 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: mm-commits, linux-mm

11 fixes, based on 444565650a5fe9c63ddf153e6198e31705dedeb2:


    David Hildenbrand <david@redhat.com>:
      device-dax: don't leak kernel memory to user space after unloading kmem

    Nick Desaulniers <ndesaulniers@google.com>:
      x86: bitops: fix build regression

    John Hubbard <jhubbard@nvidia.com>:
      rapidio: fix an error in get_user_pages_fast() error handling
      selftests/vm/.gitignore: add mremap_dontunmap
      selftests/vm/write_to_hugetlbfs.c: fix unused variable warning

    Marco Elver <elver@google.com>:
      kasan: disable branch tracing for core runtime

    Arnd Bergmann <arnd@arndb.de>:
      sh: include linux/time_types.h for sockios

    Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>:
      MAINTAINERS: update email address for Naoya Horiguchi

    Mike Rapoport <rppt@linux.ibm.com>:
      sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init()

    Uladzislau Rezki <uladzislau.rezki@sony.com>:
      z3fold: fix use-after-free when freeing handles

    Baoquan He <bhe@redhat.com>:
      MAINTAINERS: add files related to kdump

 MAINTAINERS                                     |    7 ++++++-
 arch/sh/include/uapi/asm/sockios.h              |    2 ++
 arch/sparc/mm/srmmu.c                           |    2 +-
 arch/x86/include/asm/bitops.h                   |   12 ++++++------
 drivers/dax/kmem.c                              |   14 +++++++++++---
 drivers/rapidio/devices/rio_mport_cdev.c        |    5 +++++
 mm/kasan/Makefile                               |   16 ++++++++--------
 mm/kasan/generic.c                              |    1 -
 mm/kasan/tags.c                                 |    1 -
 mm/z3fold.c                                     |   11 ++++++-----
 tools/testing/selftests/vm/.gitignore           |    1 +
 tools/testing/selftests/vm/write_to_hugetlbfs.c |    2 --
 12 files changed, 46 insertions(+), 28 deletions(-)





^ permalink raw reply	[flat|nested] 94+ messages in thread
* + bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better.patch added to -mm tree
@ 2020-06-02 18:31 akpm
  0 siblings, 0 replies; 94+ messages in thread
From: akpm @ 2020-06-02 18:31 UTC (permalink / raw)
  To: akpm, ast, daniel, hch, hpa, mhiramat, mingo, mm-commits, tglx


The patch titled
     Subject: bpf:bpf_seq_printf(): handle potentially unsafe format string better
has been added to the -mm tree.  Its filename is
     bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better.patch

This patch should soon appear at
    http://ozlabs.org/~akpm/mmots/broken-out/bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better.patch
and later at
    http://ozlabs.org/~akpm/mmotm/broken-out/bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated
there every 3-4 working days

------------------------------------------------------
From: Andrew Morton <akpm@linux-foundation.org>
Subject: bpf:bpf_seq_printf(): handle potentially unsafe format string better

User the proper helper for kernel or userspace addresses based on
TASK_SIZE instead of the dangerous strncpy_from_unsafe function.

Cc: Christoph Hellwig <hch@lst.de>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 kernel/trace/bpf_trace.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/kernel/trace/bpf_trace.c~bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better
+++ a/kernel/trace/bpf_trace.c
@@ -588,15 +588,17 @@ BPF_CALL_5(bpf_seq_printf, struct seq_fi
 		}
 
 		if (fmt[i] == 's') {
+			void *unsafe_ptr;
+
 			/* try our best to copy */
 			if (memcpy_cnt >= MAX_SEQ_PRINTF_MAX_MEMCPY) {
 				err = -E2BIG;
 				goto out;
 			}
 
-			err = strncpy_from_unsafe_strict(bufs->buf[memcpy_cnt],
-							 (void *) (long) args[fmt_cnt],
-							 MAX_SEQ_PRINTF_STR_LEN);
+			unsafe_ptr = (void *)(long)args[fmt_cnt];
+			err = strncpy_from_kernel_nofault(bufs->buf[memcpy_cnt],
+					unsafe_ptr, MAX_SEQ_PRINTF_STR_LEN);
 			if (err < 0)
 				bufs->buf[memcpy_cnt][0] = '\0';
 			params[fmt_cnt] = (u64)(long)bufs->buf[memcpy_cnt];
_

Patches currently in -mm which might be from akpm@linux-foundation.org are

arch-parisc-include-asm-pgtableh-remove-unused-old_pte.patch
mm-slub-add-panic_on_error-to-the-debug-facilities-fix.patch
drivers-tty-serial-sh-scic-suppress-uninitialized-var-warning.patch
mm.patch
mm-free_area_init-allow-defining-max_zone_pfn-in-descending-order-fix-2-fix.patch
mm-page_alloc-skip-waternark_boost-for-atomic-order-0-allocations-fix.patch
arch-kunmap-remove-duplicate-kunmap-implementations-fix.patch
arch-kmap_atomic-consolidate-duplicate-code-checkpatch-fixes.patch
arch-kunmap_atomic-consolidate-duplicate-code-checkpatch-fixes.patch
kmap-consolidate-kmap_prot-definitions-checkpatch-fixes.patch
mm-add-debug_wx-support-fix.patch
riscv-support-debug_wx-fix.patch
mm-replace-zero-length-array-with-flexible-array-member-fix.patch
mm-hugetlb-fix-a-typo-in-comment-manitained-maintained-v2-checkpatch-fixes.patch
lib-make-a-test-module-with-get_count_order-long-fix.patch
seq_file-introduce-define_seq_attribute-helper-macro-checkpatch-fixes.patch
ipc-convert-ipcs_idr-to-xarray-update-fix.patch
linux-next-pre.patch
linux-next-rejects.patch
linux-next-git-rejects.patch
linux-next-post.patch
kernel-add-panic_on_taint-fix.patch
mm-consolidate-pgd_index-and-pgd_offset_k-definitions-fix.patch
mmap-locking-api-convert-mmap_sem-call-sites-missed-by-coccinelle-fix.patch
mmap-locking-api-convert-mmap_sem-call-sites-missed-by-coccinelle-fix-fix.patch
mmap-locking-api-convert-mmap_sem-call-sites-missed-by-coccinelle-fix-fix-fix.patch
mmap-locking-api-rename-mmap_sem-to-mmap_lock-fix.patch
mmap-locking-api-convert-mmap_sem-comments-fix.patch
mmap-locking-api-convert-mmap_sem-comments-fix-fix.patch
mmap-locking-api-convert-mmap_sem-comments-fix-fix-fix.patch
mm-pass-task-and-mm-to-do_madvise.patch
mm-introduce-external-memory-hinting-api-fix-2-fix.patch
mm-support-vector-address-ranges-for-process_madvise-fix-fix-fix-fix-fix.patch
maccess-unify-the-probe-kernel-arch-hooks-fix.patch
bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better.patch
maccess-always-use-strict-semantics-for-probe_kernel_read-fix.patch
x86-use-non-set_fs-based-maccess-routines-checkpatch-fixes.patch
doc-cgroup-update-note-about-conditions-when-oom-killer-is-invoked-fix.patch
sh-convert-ins-outs-macros-to-inline-functions-checkpatch-fixes.patch
kernel-forkc-export-kernel_thread-to-modules.patch

^ permalink raw reply	[flat|nested] 94+ messages in thread

end of thread, other threads:[~2020-06-02 18:31 UTC | newest]

Thread overview: 94+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-23  5:22 incoming Andrew Morton
2020-05-23  5:22 ` [patch 01/11] device-dax: don't leak kernel memory to user space after unloading kmem Andrew Morton
2020-05-23  5:22 ` [patch 02/11] x86: bitops: fix build regression Andrew Morton
2020-05-23  5:22 ` [patch 03/11] rapidio: fix an error in get_user_pages_fast() error handling Andrew Morton
2020-05-23  5:22 ` [patch 04/11] selftests/vm/.gitignore: add mremap_dontunmap Andrew Morton
2020-05-23  5:22 ` [patch 05/11] selftests/vm/write_to_hugetlbfs.c: fix unused variable warning Andrew Morton
2020-05-23  5:22 ` [patch 06/11] kasan: disable branch tracing for core runtime Andrew Morton
2020-05-23  5:23 ` [patch 07/11] sh: include linux/time_types.h for sockios Andrew Morton
2020-05-23  5:23 ` [patch 08/11] MAINTAINERS: update email address for Naoya Horiguchi Andrew Morton
2020-05-23  5:23 ` [patch 09/11] sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init() Andrew Morton
2020-05-23 19:01   ` Mike Rapoport
2020-05-23 19:10     ` Linus Torvalds
2020-05-23 19:10       ` Linus Torvalds
2020-05-23 19:57       ` Mike Rapoport
2020-05-23  5:23 ` [patch 10/11] z3fold: fix use-after-free when freeing handles Andrew Morton
2020-05-23  5:23 ` [patch 11/11] MAINTAINERS: add files related to kdump Andrew Morton
2020-05-25  0:06 ` + bitops-simplify-get_count_order_long.patch added to -mm tree Andrew Morton
2020-05-25  0:08 ` + mmthp-stop-leaking-unreleased-file-pages.patch " Andrew Morton
2020-05-25  0:45 ` + mmap-locking-api-convert-mmap_sem-comments-fix-fix-fix.patch " Andrew Morton
2020-05-25  0:49 ` + mm-remove-vm_bug_onpageslab-from-page_mapcount.patch " Andrew Morton
2020-05-25  0:49   ` Andrew Morton
2020-05-25  0:57 ` + swap-reduce-lock-contention-on-swap-cache-from-swap-slots-allocation-v3.patch " Andrew Morton
2020-05-25  5:10 ` mmotm 2020-05-24-22-09 uploaded Andrew Morton
2020-05-25  5:10 ` Andrew Morton
2020-05-25 20:01 ` + khugepaged-allow-to-collapse-a-page-shared-across-fork-fix-fix.patch added to -mm tree Andrew Morton
2020-05-25 20:19 ` + x86-mm-simplify-init_trampoline-and-surrounding-logic-fix.patch " Andrew Morton
2020-05-25 20:41 ` + lib-make-a-test-module-with-set-clear-bit.patch " Andrew Morton
2020-05-25 20:57 ` + mm-gupc-convert-to-use-get_user_pagepages_fast_only.patch " Andrew Morton
2020-05-25 21:11 ` + mm-remove-vm_bug_onpageslab-from-page_mapcount-fix.patch " Andrew Morton
2020-05-25 21:55 ` + mm_typesh-change-set_page_private-to-inline-function.patch " Andrew Morton
2020-05-25 23:57 ` mmotm 2020-05-25-16-56 uploaded Andrew Morton
2020-05-26  3:49   ` mmotm 2020-05-25-16-56 uploaded (drm/nouveau) Randy Dunlap
2020-05-26  3:49     ` Randy Dunlap
2020-05-26  4:23     ` Dave Airlie
2020-05-26  4:23       ` Dave Airlie
2020-05-26  4:23       ` Dave Airlie
2020-05-26  4:31       ` Randy Dunlap
2020-05-26  4:31         ` Randy Dunlap
2020-05-26  6:56   ` mmotm 2020-05-25-16-56 uploaded (mtd/nand/raw/arasan-nand-controller) Randy Dunlap
2020-05-26 19:37     ` Miquel Raynal
2020-05-26 21:18 ` [failures] proc-meminfo-avoid-open-coded-reading-of-vm_committed_as.patch removed from -mm tree Andrew Morton
2020-05-26 21:18 ` [failures] mm-utilc-make-vm_memory_committed-more-accurate.patch " Andrew Morton
2020-05-26 21:18 ` [failures] mm-adjust-vm_committed_as_batch-according-to-vm-overcommit-policy.patch " Andrew Morton
2020-05-27 19:12 ` + mm-swap-fix-vmstats-for-huge-pages.patch added to " Andrew Morton
2020-05-27 19:12 ` + mm-swap-memcg-fix-memcg-stats-for-huge-pages.patch " Andrew Morton
2020-05-27 21:33 ` + mm-prepare-for-swap-over-high-accounting-and-penalty-calculation.patch " Andrew Morton
2020-05-27 21:33 ` + mm-move-penalty-delay-clamping-out-of-calculate_high_delay.patch " Andrew Morton
2020-05-27 21:33 ` + mm-move-cgroup-high-memory-limit-setting-into-struct-page_counter.patch " Andrew Morton
2020-05-27 21:33 ` + mm-automatically-penalize-tasks-with-high-swap-use.patch " Andrew Morton
2020-05-27 21:36 ` + mm-gup-update-pin_user_pagesrst-for-case-3-mmu-notifiers.patch " Andrew Morton
2020-05-27 21:48 ` + padata-remove-exit-routine.patch " Andrew Morton
2020-05-27 21:48 ` + padata-initialize-earlier.patch " Andrew Morton
2020-05-27 21:48 ` + padata-allocate-work-structures-for-parallel-jobs-from-a-pool.patch " Andrew Morton
2020-05-27 21:49 ` + padata-add-basic-support-for-multithreaded-jobs.patch " Andrew Morton
2020-05-27 21:49 ` + mm-dont-track-number-of-pages-during-deferred-initialization.patch " Andrew Morton
2020-05-27 21:49 ` + mm-parallelize-deferred_init_memmap.patch " Andrew Morton
2020-05-27 21:49 ` + mm-make-deferred-inits-max-threads-arch-specific.patch " Andrew Morton
2020-05-27 21:49 ` + padata-document-multithreaded-jobs.patch " Andrew Morton
2020-05-27 21:55 ` + cpumask-guard-cpumask_of_node-macro-argument.patch " Andrew Morton
2020-05-27 22:15 ` + sparc32-register-memory-occupied-by-kernel-as-memblockmemory.patch " Andrew Morton
2020-05-27 22:32 ` + x86-mm-ptdump-calculate-effective-permissions-correctly-fix.patch " Andrew Morton
2020-05-27 22:55 ` + ocfs2-clear-links-count-in-ocfs2_mknod-if-an-error-occurs.patch " Andrew Morton
2020-05-27 22:55 ` + ocfs2-fix-ocfs2-corrupt-when-iputting-an-inode.patch " Andrew Morton
2020-05-27 23:17 ` + mm-gup-introduce-pin_user_pages_locked.patch " Andrew Morton
2020-05-27 23:17 ` + mm-gup-frame_vector-convert-get_user_pages-pin_user_pages.patch " Andrew Morton
2020-05-27 23:52 ` + mm-memory_failure-only-send-bus_mceerr_ao-to-early-kill-process.patch " Andrew Morton
2020-05-28  0:10 ` + relay-handle-alloc_percpu-returning-null-in-relay_open.patch " Andrew Morton
2020-05-28  0:16 ` + xtensa-implement-flush_icache_user_range-fix.patch " Andrew Morton
2020-05-28  0:36 ` + maccess-unexport-probe_kernel_write-and-probe_user_write.patch " Andrew Morton
2020-05-28  0:36 ` + maccess-remove-various-unused-weak-aliases.patch " Andrew Morton
2020-05-28  0:36 ` + maccess-remove-duplicate-kerneldoc-comments.patch " Andrew Morton
2020-05-28  0:36 ` + maccess-clarify-kerneldoc-comments.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-update-the-top-of-file-comment.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-rename-strncpy_from_unsafe_user-to-strncpy_from_user_nofault.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-rename-strncpy_from_unsafe_strict-to-strncpy_from_kernel_nofault.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-rename-strnlen_unsafe_user-to-strnlen_user_nofault.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-remove-probe_read_common-and-probe_write_common.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-unify-the-probe-kernel-arch-hooks.patch " Andrew Morton
2020-05-28  0:37 ` + bpf-factor-out-a-bpf_trace_copy_string-helper.patch " Andrew Morton
2020-05-28  0:37 ` + bpf-handle-the-compat-string-in-bpf_trace_copy_string-better.patch " Andrew Morton
2020-05-28  0:37 ` + bpf-rework-the-compat-kernel-probe-handling.patch " Andrew Morton
2020-05-28  0:37 ` + tracing-kprobes-handle-mixed-kernel-userspace-probes-better.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-remove-strncpy_from_unsafe.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-always-use-strict-semantics-for-probe_kernel_read.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-move-user-access-routines-together.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-allow-architectures-to-provide-kernel-probing-directly.patch " Andrew Morton
2020-05-28  0:37 ` + x86-use-non-set_fs-based-maccess-routines.patch " Andrew Morton
2020-05-28  0:37 ` + maccess-return-erange-when-copy_from_kernel_nofault_allowed-fails.patch " Andrew Morton
2020-05-28  0:45 ` + x86-use-non-set_fs-based-maccess-routines-checkpatch-fixes.patch " Andrew Morton
2020-05-28  0:55 ` + maccess-unify-the-probe-kernel-arch-hooks-fix.patch " Andrew Morton
2020-05-28  1:02 ` + maccess-always-use-strict-semantics-for-probe_kernel_read-fix.patch " Andrew Morton
2020-05-28  2:04 ` + bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better.patch " Andrew Morton
2020-05-28  3:09 ` [to-be-updated] mm-memory_failure-only-send-bus_mceerr_ao-to-early-kill-process.patch removed from " Andrew Morton
2020-06-02 18:31 + bpf-bpf_seq_printf-handle-potentially-unsafe-format-string-better.patch added to " akpm

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.