Files
android_kernel_xiaomi_sm8450/include/linux
David Howells 648895da69 watch_queue: Fix filter limit check
commit c993ee0f9f81caf5767a50d1faeba39a0dc82af2 upstream.

In watch_queue_set_filter(), there are a couple of places where we check
that the filter type value does not exceed what the type_filter bitmap
can hold.  One place calculates the number of bits by:

   if (tf[i].type >= sizeof(wfilter->type_filter) * 8)

which is fine, but the second does:

   if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)

which is not.  This can lead to a couple of out-of-bounds writes due to
a too-large type:

 (1) __set_bit() on wfilter->type_filter
 (2) Writing more elements in wfilter->filters[] than we allocated.

Fix this by just using the proper WATCH_TYPE__NR instead, which is the
number of types we actually know about.

The bug may cause an oops looking something like:

  BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740
  Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611
  ...
  Call Trace:
   <TASK>
   dump_stack_lvl+0x45/0x59
   print_address_description.constprop.0+0x1f/0x150
   ...
   kasan_report.cold+0x7f/0x11b
   ...
   watch_queue_set_filter+0x659/0x740
   ...
   __x64_sys_ioctl+0x127/0x190
   do_syscall_64+0x43/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xae

  Allocated by task 611:
   kasan_save_stack+0x1e/0x40
   __kasan_kmalloc+0x81/0xa0
   watch_queue_set_filter+0x23a/0x740
   __x64_sys_ioctl+0x127/0x190
   do_syscall_64+0x43/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xae

  The buggy address belongs to the object at ffff88800d2c66a0
   which belongs to the cache kmalloc-32 of size 32
  The buggy address is located 28 bytes inside of
   32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)

Fixes: c73be61ced ("pipe: Add general notification queue support")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-16 14:16:03 +01:00
..
2019-11-12 11:43:29 -05:00
2020-06-16 14:19:57 +02:00
2010-11-23 20:14:46 +00:00
2018-05-26 09:16:44 +02:00
2005-04-16 15:20:36 -07:00
2020-05-24 20:48:11 +02:00
2020-07-21 08:24:52 -05:00
2018-11-07 13:44:59 -07:00
2018-11-07 13:44:59 -07:00
2020-09-21 15:00:40 -07:00
2020-10-02 15:00:49 -07:00
2018-06-15 18:10:01 -03:00
2020-10-16 17:21:51 +02:00
2018-03-26 15:09:38 +02:00
2018-08-22 10:52:48 -07:00
2019-10-09 19:33:43 -07:00
2020-03-09 11:12:19 +01:00
2009-12-10 23:52:01 +00:00
2016-10-28 08:48:16 -06:00
2019-12-03 11:20:37 +01:00
2020-06-16 19:25:20 +02:00
2019-02-28 03:28:53 -05:00
2018-01-01 12:40:27 -07:00
2020-05-04 11:19:58 -07:00
2020-08-12 20:42:08 +02:00
2020-06-17 00:07:38 +02:00
2014-10-08 16:01:41 -04:00
2021-11-26 10:39:22 +01:00
2020-03-06 11:06:15 +01:00
2019-02-15 16:54:38 +01:00
2010-02-09 11:13:56 +01:00
2020-07-24 17:12:41 -07:00
2019-06-26 13:19:46 -07:00
2020-08-04 21:02:38 -04:00
2019-10-04 12:31:46 -07:00
2019-10-15 13:34:25 +02:00
2018-11-19 19:03:46 -07:00
2018-06-22 13:43:27 +09:00
2020-09-16 08:54:53 -05:00
2020-05-18 10:30:21 +01:00
2020-08-26 12:41:56 +02:00
2020-11-19 22:38:29 -05:00
2020-10-13 18:38:32 -07:00
2019-12-04 19:44:14 -08:00
2020-06-02 15:15:46 +01:00
2019-12-11 09:12:38 +01:00
2021-03-04 11:37:59 +01:00
2020-09-04 09:25:20 -07:00
2021-02-07 15:37:17 +01:00
2021-11-18 14:03:37 +01:00
2020-05-08 18:18:11 +01:00
2020-05-08 00:12:42 +02:00
2020-05-28 10:31:09 +02:00
2021-09-15 09:50:41 +02:00
2018-04-12 09:41:19 -07:00
2019-03-07 18:32:03 -08:00
2018-06-07 17:34:35 -07:00
2020-03-06 11:56:59 +01:00
2020-09-04 12:46:07 +01:00
2021-06-30 08:47:26 -04:00
2020-08-27 16:06:47 -04:00
2019-08-14 15:30:35 +02:00
2019-11-14 19:06:47 -08:00
2018-10-17 13:56:58 -07:00
2020-10-07 14:28:39 -04:00
2020-05-09 13:57:12 +02:00
2019-02-20 07:22:10 -07:00
2019-02-08 15:02:49 -08:00
2018-01-08 08:22:45 -06:00
2020-07-01 10:49:02 +02:00
2021-09-03 10:09:21 +02:00
2020-07-23 17:34:18 +10:00
2018-10-21 10:46:39 -04:00
2020-05-15 13:51:28 -07:00
2017-11-09 10:23:28 +01:00
2020-08-31 12:52:33 -07:00
2019-07-16 19:23:25 -07:00
2021-03-30 14:32:05 +02:00
2020-10-18 09:27:10 -07:00
2018-10-08 22:53:10 +11:00
2020-05-09 13:57:12 +02:00
2019-06-15 12:25:49 +02:00
2018-07-20 01:11:45 +02:00
2020-08-18 17:06:15 +02:00
2018-09-25 20:17:35 -07:00
2020-08-07 11:33:24 -07:00
2021-08-04 12:46:44 +02:00
2018-07-07 17:25:23 +02:00
2020-09-26 22:55:05 -04:00
2018-01-15 12:07:46 -08:00
2021-05-07 11:04:32 +02:00
2018-10-11 09:16:44 -07:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:31 +02:00
2020-07-04 09:35:36 -05:00
2020-09-10 14:03:31 -07:00
2005-04-16 15:20:36 -07:00
2020-08-01 11:28:17 +02:00
2020-04-01 12:06:26 -04:00
2020-10-05 13:21:49 +02:00
2019-05-15 17:35:54 +01:00
2021-12-14 11:32:39 +01:00
2017-08-15 09:02:08 -07:00