Kees Cook af65d53838 binfmt_flat: Fix corruption when not offsetting data start ... [ Upstream commit 3eb3cd5992 ] Commit 04d82a6d08 ("binfmt_flat: allow not offsetting data start") introduced a RISC-V specific variant of the FLAT format which does not allocate any space for the (obsolete) array of shared library pointers. However, it did not disable the code which initializes the array, resulting in the corruption of sizeof(long) bytes before the DATA segment, generally the end of the TEXT segment. Introduce MAX_SHARED_LIBS_UPDATE which depends on the state of CONFIG_BINFMT_FLAT_NO_DATA_START_OFFSET to guard the initialization of the shared library pointer region so that it will only be initialized if space is reserved for it. Fixes: 04d82a6d08 ("binfmt_flat: allow not offsetting data start") Co-developed-by: Stefan O'Rear <sorear@fastmail.com> Signed-off-by: Stefan O'Rear <sorear@fastmail.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Acked-by: Greg Ungerer <gerg@linux-m68k.org> Link: https://lore.kernel.org/r/20240807195119.it.782-kees@kernel.org Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-08-19 06:00:07 +02:00
..
9p	9p: add missing locking around taking dentry fid list	2024-06-16 13:41:37 +02:00
adfs
affs	affs: initialize fsdata in affs_truncate()	2023-02-01 08:34:08 +01:00
afs	afs: Don't cross .backup mountpoint from backup volume	2024-06-16 13:41:31 +02:00
autofs	autofs: fix memory leak of waitqueues in autofs_catatonic_mode	2023-09-23 11:10:59 +02:00
befs
bfs
btrfs	btrfs: fix double inode unlock for direct IO sync writes	2024-08-14 13:53:03 +02:00
cachefiles	cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()	2024-07-25 09:49:21 +02:00
ceph	ceph: fix incorrect kmalloc size of pagevec mempool	2024-08-03 08:49:52 +02:00
coda	coda: Avoid partial allocation of sig_inputArgs	2023-03-10 09:33:52 +01:00
configfs	configfs: fix possible memory leak in configfs_create_dir()	2022-12-31 13:32:22 +01:00
cramfs	fs/cramfs/inode.c: initialize file_ra_state	2023-03-10 09:34:09 +01:00
crypto	blk-crypto: add a blk_crypto_config_supported_natively helper	2023-05-11 23:03:00 +09:00
debugfs	debugfs: fix automount d_fsdata usage	2024-01-20 11:50:04 +01:00
devpts
dlm	fs: dlm: don't put dlm_local_addrs on heap	2024-02-16 19:06:29 +01:00
ecryptfs	ecryptfs: Fix buffer size for tag 66 packet	2024-06-12 11:03:04 +02:00
efivarfs	efivarfs: Request at most 512 bytes for variable names	2024-03-06 14:45:11 +00:00
efs
erofs	erofs: ensure m_llen is reset to 0 if metadata is invalid	2024-07-25 09:49:18 +02:00
exfat	exfat: support handle zero-size directory	2023-11-28 17:07:00 +00:00
exportfs	exportfs: use pr_debug for unreachable debug statements	2024-03-06 14:45:15 +00:00
ext2	ext2: Verify bitmap and itable block numbers before using them	2024-08-03 08:49:32 +02:00
ext4	ext4: fix wrong unit use in ext4_mb_find_by_goal	2024-08-14 13:52:50 +02:00
f2fs	f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid	2024-08-11 12:35:54 +02:00
fat	fat: fix uninitialized field in nostale filehandles	2024-04-03 15:19:27 +02:00
freevxfs
fscache	netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume()	2024-07-25 09:49:20 +02:00
fuse	fuse: verify {g,u}id mount options correctly	2024-08-03 08:49:31 +02:00
gfs2	gfs2: Fix slab-use-after-free in gfs2_qd_dealloc	2024-07-05 09:32:00 +02:00
hfs	hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()	2024-08-03 08:49:32 +02:00
hfsplus	hfsplus: fix to avoid false alarm of circular locking	2024-08-03 08:48:53 +02:00
hostfs
hpfs
hugetlbfs	mm/hugetlb: add hugetlb_folio_subpool() helpers	2024-05-17 11:55:51 +02:00
iomap	iomap: Fix iomap_adjust_read_range for plen calculation	2024-07-25 09:49:12 +02:00
isofs	isofs: handle CDs with bad root inode but good Joliet root directory	2024-04-13 13:05:06 +02:00
jbd2	jbd2: avoid memleak in jbd2_journal_write_metadata_buffer	2024-08-14 13:52:49 +02:00
jffs2	jffs2: Fix potential illegal address access in jffs2_free_inode	2024-07-11 12:47:09 +02:00
jfs	jfs: Fix array-index-out-of-bounds in diFree	2024-08-03 08:49:47 +02:00
kernfs	kernfs: Convert kernfs_path_from_node_locked() from strlcpy() to strscpy()	2024-08-03 08:48:54 +02:00
lockd	nfsd: stop setting ->pg_stats for unused stats	2024-08-19 06:00:04 +02:00
minix
netfs	netfs: Only call folio_start_fscache() one time for each folio	2023-10-06 14:56:32 +02:00
nfs	nfsd: stop setting ->pg_stats for unused stats	2024-08-19 06:00:04 +02:00
nfs_common
nfsd	nfsd: make svc_stat per-network namespace instead of global	2024-08-19 06:00:05 +02:00
nilfs2	nilfs2: handle inconsistent state in nilfs_btnode_create_block()	2024-08-03 08:49:46 +02:00
nls	fs/nls: make load_nls() take a const parameter	2023-09-13 09:42:22 +02:00
notify	fanotify: disallow mount/sb marks on kernel internal pseudo fs	2023-07-19 16:22:05 +02:00
ntfs
ntfs3	fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed	2024-08-03 08:49:37 +02:00
ocfs2	ocfs2: add bounds checking to ocfs2_check_dir_entry()	2024-07-27 11:32:18 +02:00
omfs
openpromfs	openpromfs: finish conversion to the new mount API	2024-06-12 11:03:03 +02:00
orangefs	orangefs: fix out-of-bounds fsid access	2024-07-11 12:47:08 +02:00
overlayfs	ovl: remove upper umask handling from ovl_create_upper()	2024-06-12 11:03:39 +02:00
proc	sysctl: always initialize i_uid/i_gid	2024-08-11 12:35:51 +02:00
pstore	pstore/zone: Add a null pointer check to the psz_kmsg_read	2024-04-13 13:04:57 +02:00
qnx4
qnx6
quota	quota: Fix rcu annotations of inode dquot pointers	2024-03-26 18:20:47 -04:00
ramfs	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs	2023-07-19 16:22:11 +02:00
reiserfs	reiserfs: Check the return value from __getblk()	2023-09-13 09:42:27 +02:00
romfs
smb	smb3: fix setting SecurityFlags when encryption is required	2024-08-14 13:52:59 +02:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-22 12:59:50 +01:00
sysfs	fs: sysfs: Fix reference leak in sysfs_break_active_protection()	2024-04-27 17:07:16 +02:00
sysv	sysv: don't call sb_bread() with pointers_lock held	2024-04-13 13:05:05 +02:00
tracefs	tracefs: Add missing lockdown check to tracefs_create_dir()	2023-09-23 11:11:12 +02:00
ubifs	ubifs: Set page uptodate in the correct place	2024-04-03 15:19:27 +02:00
udf	udf: prevent integer overflow in udf_bitmap_free_blocks()	2024-08-14 13:52:46 +02:00
ufs
unicode
vboxsf	vboxsf: Avoid an spurious warning if load_nls_xxx() fails	2024-04-10 16:28:25 +02:00
verity	fsverity: skip PKCS#7 parser when keyring is empty	2023-09-13 09:43:03 +02:00
xfs	xfs: fix log recovery buffer allocation for the legacy h_size fixup	2024-08-14 13:53:02 +02:00
zonefs	zonefs: Improve error handling	2024-02-23 09:12:45 +01:00
aio.c	fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion	2024-04-03 15:19:42 +02:00
anon_inodes.c
attr.c	attr: block mode changes of symlinks	2023-09-23 11:11:10 +02:00
bad_inode.c
binfmt_elf_fdpic.c	fs: binfmt_elf_efpic: fix personality for ELF-FDPIC	2023-10-06 14:57:06 +02:00
binfmt_elf_test.c
binfmt_elf.c	mm: always expand the stack with the mmap write lock held	2023-07-01 13:16:25 +02:00
binfmt_flat.c	binfmt_flat: Fix corruption when not offsetting data start	2024-08-19 06:00:07 +02:00
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2022-12-31 13:32:57 +01:00
binfmt_script.c
buffer.c
char_dev.c	chardev: fix error handling in cdev_device_add()	2022-12-31 13:32:41 +01:00
compat_binfmt_elf.c
coredump.c	coredump: Move dump_emit_page() to kill unused warning	2023-02-22 12:59:50 +01:00
d_path.c
dax.c
dcache.c	fs: better handle deep ancestor chains in is_subdir()	2024-07-25 09:49:18 +02:00
direct-io.c
drop_caches.c
eventfd.c	eventfd: prevent underflow for eventfd semaphores	2023-09-13 09:42:27 +02:00
eventpoll.c	epoll: be better about file lifetimes	2024-06-12 11:03:03 +02:00
exec.c	exec: Fix ToCToU between perm check and set-uid/gid usage	2024-08-19 06:00:03 +02:00
fcntl.c	fs: Fix rw_hint validation	2024-03-26 18:20:28 -04:00
fhandle.c	do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak	2024-03-26 18:20:27 -04:00
file_table.c
file.c	protect the fetch of ->fd[fd] in do_dup2() from mispredictions	2024-08-11 12:36:00 +02:00
filesystems.c
fs_context.c	vfs, security: Fix automount superblock LSM init problem, preventing NFS sb sharing	2023-09-13 09:42:28 +02:00
fs_parser.c	ext4: journal_path mount options should follow links	2023-01-07 11:11:59 +01:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs	2023-11-20 11:51:50 +01:00
fsopen.c
init.c
inode.c	filemap: add a per-mapping stable writes flag	2024-01-10 17:10:32 +01:00
internal.h	nfs: use vfs setgid helper	2023-08-30 16:11:10 +02:00
ioctl.c	lsm: new security_file_ioctl_compat() hook	2024-01-31 16:17:00 -08:00
Kconfig	smb: move client and server files to common directory fs/smb	2023-06-28 11:12:40 +02:00
Kconfig.binfmt
kernel_read_file.c
libfs.c	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value	2022-12-31 13:31:58 +01:00
locks.c	filelock: Fix fcntl/close race recovery compat path	2024-07-27 11:32:19 +02:00
Makefile	smb: move client and server files to common directory fs/smb	2023-06-28 11:12:40 +02:00
mbcache.c	ext4: fix deadlock due to mbcache entry corruption	2023-01-07 11:12:02 +01:00
mount.h
mpage.c
namei.c	rename(): fix the locking of subdirectories	2024-01-31 16:17:02 -08:00
namespace.c	fs: relax mount_setattr() permission checks	2024-02-23 09:12:46 +01:00
no-block.c
nsfs.c
open.c	ftruncate: pass a signed offset	2024-07-05 09:31:59 +02:00
pipe.c	fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()	2024-04-10 16:28:30 +02:00
pnode.c	pnode: terminate at peers of source	2023-01-04 11:29:01 +01:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
readdir.c
remap_range.c
select.c	fs/select: rework stack allocation hack for clang	2024-03-26 18:20:28 -04:00
seq_file.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
signalfd.c
splice.c	mm: merge folio_has_private()/filemap_release_folio() call pairs	2024-01-10 17:10:31 +01:00
stack.c
stat.c
statfs.c	statfs: enforce statfs[64] structure initialization	2023-05-24 17:32:51 +01:00
super.c	fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT	2024-08-03 08:49:53 +02:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c	Fix userfaultfd_api to return EINVAL as expected	2024-07-18 13:18:41 +02:00
utimes.c
xattr.c	fs: don't audit the capability check in simple_xattr_list()	2022-12-31 13:31:55 +01:00