No description
Find a file
Kees Cook 12d69b0aed ext4: Fix function prototype mismatch for ext4_feat_ktype
commit 118901ad1f upstream.

With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed.

ext4_feat_ktype was setting the "release" handler to "kfree", which
doesn't have a matching function prototype. Add a simple wrapper
with the correct prototype.

This was found as a result of Clang's new -Wcast-function-type-strict
flag, which is more sensitive than the simpler -Wcast-function-type,
which only checks for type width mismatches.

Note that this code is only reached when ext4 is a loadable module and
it is being unloaded:

 CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698)
 ...
 RIP: 0010:kobject_put+0xbb/0x1b0
 ...
 Call Trace:
  <TASK>
  ext4_exit_sysfs+0x14/0x60 [ext4]
  cleanup_module+0x67/0xedb [ext4]

Fixes: b99fee58a2 ("ext4: create ext4_feat kobject dynamically")
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: stable@vger.kernel.org
Build-tested-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20230103234616.never.915-kees@kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20230104210908.gonna.388-kees@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-19 17:59:33 +08:00
arch powerpc/64s/radix: Fix RWX mapping with relocated kernel 2023-04-19 17:59:32 +08:00
block block, bfq: fix uaf for bfqq in bic_set_bfqq() 2023-04-19 17:59:10 +08:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2023-04-19 17:50:34 +08:00
crypto crypto: tcrypt - Fix multibuffer skcipher speed test mem leak 2023-04-19 17:57:39 +08:00
Documentation Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions 2023-04-19 17:59:23 +08:00
drivers wifi: mwifiex: Add missing compatible string for SD8787 2023-04-19 17:59:33 +08:00
fs ext4: Fix function prototype mismatch for ext4_feat_ktype 2023-04-19 17:59:33 +08:00
include uaccess: Add speculation barrier to copy_from_user() 2023-04-19 17:59:32 +08:00
init init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash 2023-04-19 17:56:40 +08:00
io_uring io_uring/rw: remove leftover debug statement 2023-04-19 17:58:49 +08:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2023-04-19 17:56:54 +08:00
kernel uaccess: Add speculation barrier to copy_from_user() 2023-04-19 17:59:32 +08:00
lib uaccess: Add speculation barrier to copy_from_user() 2023-04-19 17:59:32 +08:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/filemap: fix page end in filemap_get_read_batch 2023-04-19 17:59:29 +08:00
net net: sched: sch: Fix off by one in htb_activate_prios() 2023-04-19 17:59:30 +08:00
samples samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() 2023-04-19 17:57:46 +08:00
scripts kbuild: Allow kernel installation packaging to override pkg-config 2023-04-19 17:59:05 +08:00
security tomoyo: fix broken dependency on *.conf.default 2023-04-19 17:58:50 +08:00
sound ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak 2023-04-19 17:59:30 +08:00
tools selftest/lkdtm: Skip stack-entropy test if lkdtm is not available 2023-04-19 17:59:28 +08:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2023-04-19 17:44:58 +08:00
virt kvm: Add support for arch compat vm ioctls 2023-04-19 17:55:40 +08:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS audit: update the mailing list in MAINTAINERS 2023-04-19 17:59:33 +08:00
Makefile Linux 5.15.95 2023-04-19 17:59:30 +08:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.