From 7f612952163aaa379bf7007e933fb2b37b8b0dfe Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 26 Apr 2021 07:49:11 +0200 Subject: [PATCH] 5.11-stable patches added patches: x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch --- queue-5.11/series | 1 + ..._memmap_entries-out-of-bounds-access.patch | 61 +++++++++++++++++++ 2 files changed, 62 insertions(+) create mode 100644 queue-5.11/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch diff --git a/queue-5.11/series b/queue-5.11/series index c6657f663d0..fc0400332aa 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -38,3 +38,4 @@ cavium-liquidio-fix-duplicate-argument.patch csky-change-a-kconfig-symbol-name-to-fix-e1000-build.patch ia64-fix-discontig.c-section-mismatches.patch ia64-tools-remove-duplicate-definition-of-ia64_mf-on.patch +x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch diff --git a/queue-5.11/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch b/queue-5.11/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch new file mode 100644 index 00000000000..78a458ee845 --- /dev/null +++ b/queue-5.11/x86-crash-fix-crash_setup_memmap_entries-out-of-bounds-access.patch @@ -0,0 +1,61 @@ +From 5849cdf8c120e3979c57d34be55b92d90a77a47e Mon Sep 17 00:00:00 2001 +From: Mike Galbraith +Date: Fri, 16 Apr 2021 14:02:07 +0200 +Subject: x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access + +From: Mike Galbraith + +commit 5849cdf8c120e3979c57d34be55b92d90a77a47e upstream. + +Commit in Fixes: added support for kexec-ing a kernel on panic using a +new system call. As part of it, it does prepare a memory map for the new +kernel. + +However, while doing so, it wrongly accesses memory it has not +allocated: it accesses the first element of the cmem->ranges[] array in +memmap_exclude_ranges() but it has not allocated the memory for it in +crash_setup_memmap_entries(). As KASAN reports: + + BUG: KASAN: vmalloc-out-of-bounds in crash_setup_memmap_entries+0x17e/0x3a0 + Write of size 8 at addr ffffc90000426008 by task kexec/1187 + + (gdb) list *crash_setup_memmap_entries+0x17e + 0xffffffff8107cafe is in crash_setup_memmap_entries (arch/x86/kernel/crash.c:322). + 317 unsigned long long mend) + 318 { + 319 unsigned long start, end; + 320 + 321 cmem->ranges[0].start = mstart; + 322 cmem->ranges[0].end = mend; + 323 cmem->nr_ranges = 1; + 324 + 325 /* Exclude elf header region */ + 326 start = image->arch.elf_load_addr; + (gdb) + +Make sure the ranges array becomes a single element allocated. + + [ bp: Write a proper commit message. ] + +Fixes: dd5f726076cc ("kexec: support for kexec on panic using new system call") +Signed-off-by: Mike Galbraith +Signed-off-by: Borislav Petkov +Reviewed-by: Dave Young +Cc: +Link: https://lkml.kernel.org/r/725fa3dc1da2737f0f6188a1a9701bead257ea9d.camel@gmx.de +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/crash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/crash.c ++++ b/arch/x86/kernel/crash.c +@@ -337,7 +337,7 @@ int crash_setup_memmap_entries(struct ki + struct crash_memmap_data cmd; + struct crash_mem *cmem; + +- cmem = vzalloc(sizeof(struct crash_mem)); ++ cmem = vzalloc(struct_size(cmem, ranges, 1)); + if (!cmem) + return -ENOMEM; + -- 2.47.3