Eric Biggers
b97e790e29
BACKPORT: strparser: initialize all callbacks
commit bbb03029a899 ("strparser: Generalize strparser") added more
function pointers to 'struct strp_callbacks'; however, kcm_attach() was
not updated to initialize them. This could cause the ->lock() and/or
->unlock() function pointers to be set to garbage values, causing a
crash in strp_work().
Fix the bug by moving the callback structs into static memory, so
unspecified members are zeroed. Also constify them while we're at it.
This bug was found by syzkaller, which encountered the following splat:
IP: 0x55
PGD 3b1ca067
P4D 3b1ca067
PUD 3b12f067
PMD 0
Oops: 0010 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 1194 Comm: kworker/u8:1 Not tainted 4.13.0-rc4-next-20170811 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: kstrp strp_work
task: ffff88006bb0e480 task.stack: ffff88006bb10000
RIP: 0010:0x55
RSP: 0018:ffff88006bb17540 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88006ce4bd60 RCX: 0000000000000000
RDX: 1ffff1000d9c97bd RSI: 0000000000000000 RDI: ffff88006ce4bc48
RBP: ffff88006bb17558 R08: ffffffff81467ab2 R09: 0000000000000000
R10: ffff88006bb17438 R11: ffff88006bb17940 R12: ffff88006ce4bc48
R13: ffff88003c683018 R14: ffff88006bb17980 R15: ffff88003c683000
FS: 0000000000000000(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000055 CR3: 000000003c145000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2098
worker_thread+0x223/0x1860 kernel/workqueue.c:2233
kthread+0x35e/0x430 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
Code: Bad RIP value.
RIP: 0x55 RSP: ffff88006bb17540
CR2: 0000000000000055
---[ end trace f0e4920047069cee ]---
Here is a C reproducer (requires CONFIG_BPF_SYSCALL=y and
CONFIG_AF_KCM=y):
#include <linux/bpf.h>
#include <linux/kcm.h>
#include <linux/types.h>
#include <stdint.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/syscall.h>
#include <unistd.h>
static const struct bpf_insn bpf_insns[3] = {
{ .code = 0xb7 }, /* BPF_MOV64_IMM(0, 0) */
{ .code = 0x95 }, /* BPF_EXIT_INSN() */
};
static const union bpf_attr bpf_attr = {
.prog_type = 1,
.insn_cnt = 2,
.insns = (uintptr_t)&bpf_insns,
.license = (uintptr_t)"",
};
int main(void)
{
int bpf_fd = syscall(__NR_bpf, BPF_PROG_LOAD,
&bpf_attr, sizeof(bpf_attr));
int inet_fd = socket(AF_INET, SOCK_STREAM, 0);
int kcm_fd = socket(AF_KCM, SOCK_DGRAM, 0);
ioctl(kcm_fd, SIOCKCMATTACH,
&(struct kcm_attach) { .fd = inet_fd, .bpf_fd = bpf_fd });
}
Fixes: bbb03029a899 ("strparser: Generalize strparser")
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Tom Herbert <tom@quantonium.net>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
|
2026-05-15 17:55:20 +07:00 |
| .. |
|
bpf
|
BACKPORT: strparser: initialize all callbacks
|
2026-05-15 17:55:20 +07:00 |
|
cgroup
|
cgroup: psi: added lacked function 'subsys_cgroup_allow_attach'.
|
2026-05-15 17:50:47 +07:00 |
|
configs
|
|
|
|
debug
|
UPSTREAM: kdb: use correct pointer when 'btc' calls 'btt'
|
2022-02-21 16:30:05 +01:00 |
|
events
|
BACKPORT: bpf: add support for sys_enter_* and sys_exit_* tracepoints
|
2026-05-15 17:55:20 +07:00 |
|
gcov
|
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20
|
2023-01-19 15:42:12 +01:00 |
|
irq
|
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
|
2022-07-18 14:05:31 +03:00 |
|
livepatch
|
|
|
|
locking
|
BACKPORT: rcu: Ports some of RCU's taken from k4.14
|
2026-05-15 17:49:30 +07:00 |
|
power
|
treewide: Backport new vmalloc for large performance benefits
|
2026-05-15 17:48:25 +07:00 |
|
printk
|
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
|
2022-06-12 01:39:01 +03:00 |
|
rcu
|
rcu: Fix self-wakeups for grace-period kthread
|
2026-05-15 17:49:36 +07:00 |
|
sched
|
cpuset: Remove cpuset_update_active_cpus()'s parameter.
|
2026-05-15 17:50:33 +07:00 |
|
time
|
BACKPORT: rcu: Ports some of RCU's taken from k4.14
|
2026-05-15 17:49:30 +07:00 |
|
trace
|
BACKPORT: bpf: add support for sys_enter_* and sys_exit_* tracepoints
|
2026-05-15 17:55:20 +07:00 |
|
.gitignore
|
BACKPORT: Provide in-kernel headers to make extending kernel easier
|
2019-07-03 14:30:53 -04:00 |
|
acct.c
|
acct: fix potential integer overflow in encode_comp_t()
|
2023-01-07 12:07:31 +01:00 |
|
async.c
|
|
|
|
audit.c
|
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-sdm845
|
2021-04-26 01:27:02 +03:00 |
|
audit.h
|
audit: fix a net reference leak in audit_list_rules_send()
|
2021-04-07 12:05:41 +02:00 |
|
audit_fsnotify.c
|
|
|
|
audit_tree.c
|
|
|
|
audit_watch.c
|
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
|
2020-10-01 20:40:07 +02:00 |
|
auditfilter.c
|
audit: fix a net reference leak in audit_list_rules_send()
|
2021-04-07 12:05:41 +02:00 |
|
auditsc.c
|
Merge android-4.9.204(72e8598) into msm-4.9
|
2020-01-06 18:13:26 +08:00 |
|
backtracetest.c
|
|
|
|
bounds.c
|
kbuild: fix kernel/bounds.c 'W=1' warning
|
2018-11-13 11:16:57 -08:00 |
|
capability.c
|
|
|
|
cfi.c
|
ANDROID: cfi: Remove unused variable in ptr_to_check_fn
|
2019-03-06 18:27:16 +00:00 |
|
compat.c
|
|
|
|
configs.c
|
|
|
|
context_tracking.c
|
|
|
|
cpu.c
|
rcu: Migrate callbacks earlier in the CPU-offline timeline
|
2026-05-15 17:49:31 +07:00 |
|
cpu_pm.c
|
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into HEAD
|
2020-06-30 02:33:58 +03:00 |
|
crash_dump.c
|
|
|
|
cred.c
|
memcg: account security cred as well to kmemcg
|
2020-01-12 11:24:13 +01:00 |
|
delayacct.c
|
BACKPORT: delayacct: track delays from thrashing cache pages
|
2019-03-22 14:08:39 -07:00 |
|
dma.c
|
|
|
|
exec_domain.c
|
|
|
|
exit.c
|
cgroup: Call cgroup_release() before __exit_signal()
|
2026-05-15 17:50:40 +07:00 |
|
extable.c
|
BACKPORT: bpf: make jited programs visible in traces
|
2026-05-15 17:54:30 +07:00 |
|
fork.c
|
BACKPORT: cgroup: cgroup v2 freezer
|
2026-05-15 17:50:46 +07:00 |
|
freezer.c
|
|
|
|
futex.c
|
mm, futex: fix shared futex pgoff on shmem huge page
|
2021-07-11 12:46:40 +02:00 |
|
gen_kheaders.sh
|
BACKPORT: kheaders: Do not regenerate archive if config is not changed
|
2019-07-03 14:31:16 -04:00 |
|
groups.c
|
treewide: Backport new vmalloc for large performance benefits
|
2026-05-15 17:48:25 +07:00 |
|
hung_task.c
|
Merge android-4.9.170 (1ef64da) into msm-4.9
|
2019-05-30 14:15:13 +08:00 |
|
irq_work.c
|
|
|
|
jump_label.c
|
jump_label: Disable jump labels in __exit code
|
2021-06-06 18:42:18 +03:00 |
|
kallsyms.c
|
BACKPORT: bpf: make jited programs visible in traces
|
2026-05-15 17:54:30 +07:00 |
|
kcmp.c
|
|
|
|
Kconfig.freezer
|
|
|
|
Kconfig.hz
|
|
|
|
Kconfig.locks
|
locking/rwsem: for rwsem prio aware enhancement
|
2019-01-08 16:14:39 +08:00 |
|
Kconfig.preempt
|
|
|
|
kcov.c
|
This is the 4.9.117 stable release
|
2018-08-03 08:50:05 +02:00 |
|
kexec.c
|
|
|
|
kexec_core.c
|
treewide: Backport new vmalloc for large performance benefits
|
2026-05-15 17:48:25 +07:00 |
|
kexec_file.c
|
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
|
2022-07-18 14:05:31 +03:00 |
|
kexec_internal.h
|
|
|
|
kheaders.c
|
BACKPORT: kheaders: Move from proc to sysfs
|
2019-07-03 14:31:02 -04:00 |
|
kmod.c
|
usermodehelper: reset umask to default before executing user process
|
2020-10-14 09:48:14 +02:00 |
|
kprobes.c
|
This is the 4.9.327 stable release
|
2022-09-05 14:02:59 +02:00 |
|
ksysfs.c
|
|
|
|
kthread.c
|
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-sdm845
|
2021-07-22 02:11:11 +03:00 |
|
latencytop.c
|
|
|
|
Makefile
|
cgroup: move cgroup files under kernel/cgroup/
|
2026-05-15 17:50:29 +07:00 |
|
membarrier.c
|
|
|
|
memremap.c
|
mm, devm_memremap_pages: kill mapping "System RAM" support
|
2019-01-13 10:03:51 +01:00 |
|
module-internal.h
|
|
|
|
module.c
|
treewide: Backport new vmalloc for large performance benefits
|
2026-05-15 17:48:25 +07:00 |
|
module_signing.c
|
|
|
|
notifier.c
|
x86/mm: split vmalloc_sync_all()
|
2020-04-02 17:20:26 +02:00 |
|
nsproxy.c
|
|
|
|
padata.c
|
padata: purge get_cpu and reorder_via_wq from padata_do_serial
|
2020-05-27 16:41:53 +02:00 |
|
panic.c
|
BACKPORT: locking/refcount: Create unchecked atomic_t implementation
|
2026-05-15 17:54:59 +07:00 |
|
params.c
|
|
|
|
pid.c
|
UPSTREAM: locking/atomic, kref: Add KREF_INIT()
|
2021-01-05 16:00:48 +00:00 |
|
pid_namespace.c
|
memcg: enable accounting for pids in nested pid namespaces
|
2021-09-22 11:43:08 +02:00 |
|
profile.c
|
profiling: fix shift-out-of-bounds bugs
|
2021-09-26 13:36:18 +02:00 |
|
ptrace.c
|
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
|
2022-06-14 16:52:28 +02:00 |
|
range.c
|
|
|
|
reboot.c
|
reboot: fix overflow parsing reboot cpu number
|
2020-11-18 18:26:32 +01:00 |
|
relay.c
|
kernel/relay.c: fix memleak on destroy relay channel
|
2020-08-26 10:29:03 +02:00 |
|
resource.c
|
|
|
|
seccomp.c
|
BACKPORT: bpf: drop unnecessary context cast from BPF_PROG_RUN
|
2026-05-15 17:54:14 +07:00 |
|
signal.c
|
BACKPORT: cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in ptrace_stop()
|
2026-05-15 17:50:47 +07:00 |
|
smp.c
|
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
|
2022-06-12 01:39:01 +03:00 |
|
smpboot.c
|
sched/walt: Fix the memory leak of idle task load pointers
|
2018-09-20 19:00:55 +05:30 |
|
smpboot.h
|
|
|
|
softirq.c
|
Mark HI and TASKLET softirq synchronous
|
2018-08-15 18:14:42 +02:00 |
|
stacktrace.c
|
|
|
|
stop_machine.c
|
stop_machine: Use raw spinlocks
|
2018-08-03 07:55:24 +02:00 |
|
sys.c
|
Merge remote-tracking branch 'common/android-4.9-q' into lineage-18.1-caf-sdm845
|
2021-10-19 16:05:50 +03:00 |
|
sys_ni.c
|
BACKPORT: signal: support CLONE_PIDFD with pidfd_send_signal
|
2019-09-03 13:44:59 -07:00 |
|
sysctl.c
|
Revert "add toggle for disabling newly added USB devices"
|
2023-03-01 21:14:36 +02:00 |
|
sysctl_binary.c
|
|
|
|
task_work.c
|
|
|
|
taskstats.c
|
taskstats: fix data-race
|
2020-01-12 11:24:12 +01:00 |
|
test_kprobes.c
|
|
|
|
torture.c
|
|
|
|
tracepoint.c
|
tracepoint: Do not fail unregistering a probe due to memory failure
|
2021-03-03 17:44:38 +01:00 |
|
tsacct.c
|
taskstats: Cleanup the use of task->exit_code
|
2022-02-23 11:56:40 +01:00 |
|
ucount.c
|
|
|
|
uid16.c
|
|
|
|
up.c
|
|
|
|
user-return-notifier.c
|
|
|
|
user.c
|
|
|
|
user_namespace.c
|
userns: move user access out of the mutex
|
2018-09-09 20:01:24 +02:00 |
|
utsname.c
|
|
|
|
utsname_sysctl.c
|
sys: don't hold uts_sem while accessing userspace memory
|
2018-09-09 20:01:24 +02:00 |
|
watchdog.c
|
|
|
|
watchdog_hld.c
|
|
|
|
workqueue.c
|
rcu: Create RCU-specific workqueues with rescuers
|
2026-05-15 17:49:31 +07:00 |
|
workqueue_internal.h
|
UPSTREAM: psi: fix aggregation idle shut-off
|
2019-03-22 14:15:01 -07:00 |