From: Greg Kroah-Hartman Date: Thu, 15 Jul 2021 18:54:43 +0000 (+0200) Subject: drop queue-4.14/coresight-tmc-etf-fix-global-out-of-bounds-in-tmc_update_etf_buffer... X-Git-Tag: v5.4.133~7 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=7f4f388636ada3cedb7d8d9ecbc0508719ee4578;p=thirdparty%2Fkernel%2Fstable-queue.git drop queue-4.14/coresight-tmc-etf-fix-global-out-of-bounds-in-tmc_update_etf_buffer.patch --- diff --git a/queue-4.14/coresight-tmc-etf-fix-global-out-of-bounds-in-tmc_update_etf_buffer.patch b/queue-4.14/coresight-tmc-etf-fix-global-out-of-bounds-in-tmc_update_etf_buffer.patch deleted file mode 100644 index a977cfd514a..00000000000 --- a/queue-4.14/coresight-tmc-etf-fix-global-out-of-bounds-in-tmc_update_etf_buffer.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 5fae8a946ac2df879caf3f79a193d4766d00239b Mon Sep 17 00:00:00 2001 -From: Sai Prakash Ranjan -Date: Mon, 14 Jun 2021 11:59:00 -0600 -Subject: coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() - -From: Sai Prakash Ranjan - -commit 5fae8a946ac2df879caf3f79a193d4766d00239b upstream. - -commit 6f755e85c332 ("coresight: Add helper for inserting synchronization -packets") removed trailing '\0' from barrier_pkt array and updated the -call sites like etb_update_buffer() to have proper checks for barrier_pkt -size before read but missed updating tmc_update_etf_buffer() which still -reads barrier_pkt past the array size resulting in KASAN out-of-bounds -bug. Fix this by adding a check for barrier_pkt size before accessing -like it is done in etb_update_buffer(). - - BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698 - Read of size 4 at addr ffffffd05b7d1030 by task perf/2629 - - Call trace: - dump_backtrace+0x0/0x27c - show_stack+0x20/0x2c - dump_stack+0x11c/0x188 - print_address_description+0x3c/0x4a4 - __kasan_report+0x140/0x164 - kasan_report+0x10/0x18 - __asan_report_load4_noabort+0x1c/0x24 - tmc_update_etf_buffer+0x4b8/0x698 - etm_event_stop+0x248/0x2d8 - etm_event_del+0x20/0x2c - event_sched_out+0x214/0x6f0 - group_sched_out+0xd0/0x270 - ctx_sched_out+0x2ec/0x518 - __perf_event_task_sched_out+0x4fc/0xe6c - __schedule+0x1094/0x16a0 - preempt_schedule_irq+0x88/0x170 - arm64_preempt_schedule_irq+0xf0/0x18c - el1_irq+0xe8/0x180 - perf_event_exec+0x4d8/0x56c - setup_new_exec+0x204/0x400 - load_elf_binary+0x72c/0x18c0 - search_binary_handler+0x13c/0x420 - load_script+0x500/0x6c4 - search_binary_handler+0x13c/0x420 - exec_binprm+0x118/0x654 - __do_execve_file+0x77c/0xba4 - __arm64_compat_sys_execve+0x98/0xac - el0_svc_common+0x1f8/0x5e0 - el0_svc_compat_handler+0x84/0xb0 - el0_svc_compat+0x10/0x50 - - The buggy address belongs to the variable: - barrier_pkt+0x10/0x40 - - Memory state around the buggy address: - ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 - ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03 - ^ - ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa - ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa - ================================================================== - -Link: https://lore.kernel.org/r/20210505093430.18445-1-saiprakash.ranjan@codeaurora.org -Fixes: 0c3fc4d5fa26 ("coresight: Add barrier packet for synchronisation") -Cc: stable@vger.kernel.org -Signed-off-by: Sai Prakash Ranjan -Signed-off-by: Suzuki K Poulose -Signed-off-by: Mathieu Poirier -Link: https://lore.kernel.org/r/20210614175901.532683-6-mathieu.poirier@linaro.org -Signed-off-by: Greg Kroah-Hartman ---- - drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/hwtracing/coresight/coresight-tmc-etf.c -+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c -@@ -474,7 +474,7 @@ static void tmc_update_etf_buffer(struct - buf_ptr = buf->data_pages[cur] + offset; - *buf_ptr = readl_relaxed(drvdata->base + TMC_RRD); - -- if (lost && *barrier) { -+ if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) { - *buf_ptr = *barrier; - barrier++; - } diff --git a/queue-4.14/series b/queue-4.14/series index 561ff6ba4ec..b220592f1ca 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -220,7 +220,6 @@ power-supply-ab8500-fix-an-old-bug.patch seq_buf-fix-overflow-in-seq_buf_putmem_hex.patch tracing-simplify-fix-saved_tgids-logic.patch ipack-carriers-tpci200-fix-a-double-free-in-tpci200_pci_probe.patch -coresight-tmc-etf-fix-global-out-of-bounds-in-tmc_update_etf_buffer.patch dm-btree-remove-assign-new_root-only-when-removal-succeeds.patch media-dtv5100-fix-control-request-directions.patch media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch