{"push_id":1397646584,"size":2,"distinct_size":2,"ref":"refs/heads/aosp/LA.UM.5.5.r1_Google","head":"eddef53a61c8ad4fa8c72de6fd3442336ed2d695","before":"21b785c0faa2e7d02d88bf6cb2914e03eb2be45b","commits":[{"sha":"b18dd776d8546420fcb3d5ec3debd4c94577287a","author":{"name":"Jerome Marchand","email":"dc2f8179cebe372cf7ded5d10edf58cc1936d348@redhat.com"},"message":"UPSTREAM: assoc_array: don't call compare_object() on a node\n\n(cherry picked from commit 8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2)\n\nChanges since V1: fixed the description and added KASan warning.\n\nIn assoc_array_insert_into_terminal_node(), we call the\ncompare_object() method on all non-empty slots, even when they're\nnot leaves, passing a pointer to an unexpected structure to\ncompare_object(). Currently it causes an out-of-bound read access\nin keyring_compare_object detected by KASan (see below). The issue\nis easily reproduced with keyutils testsuite.\nOnly call compare_object() when the slot is a leave.\n\nKASan warning:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838\nRead of size 8 by task keyctl/1655\n=============================================================================\nBUG kmalloc-192 (Not tainted): kasan: bad access detected\n-----------------------------------------------------------------------------\n\nDisabling lock debugging due to kernel taint\nINFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647\n\t___slab_alloc+0x563/0x5c0\n\t__slab_alloc+0x51/0x90\n\tkmem_cache_alloc_trace+0x263/0x300\n\tassoc_array_insert+0xfd0/0x3a60\n\t__key_link_begin+0xfc/0x270\n\tkey_create_or_update+0x459/0xaf0\n\tSyS_add_key+0x1ba/0x350\n\tentry_SYSCALL_64_fastpath+0x12/0x76\nINFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080\nINFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1\n\nBytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00  ...`............\nObject ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff  ...`.......`....\nObject ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nCPU: 0 PID: 1655 Comm: keyctl Tainted: G    B           4.5.0-rc4-kasan+ #291\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n 0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491\n ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969\n ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650\nCall Trace:\n [<ffffffff81b60491>] dump_stack+0x85/0xc4\n [<ffffffff815e2969>] print_trailer+0xf9/0x150\n [<ffffffff815e9454>] object_err+0x34/0x40\n [<ffffffff815ebe50>] kasan_report_error+0x230/0x550\n [<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210\n [<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70\n [<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240\n [<ffffffff81994cc3>] keyring_compare_object+0x213/0x240\n [<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60\n [<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70\n [<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270\n [<ffffffff8199786c>] __key_link_begin+0xfc/0x270\n [<ffffffff81993389>] key_create_or_update+0x459/0xaf0\n [<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10\n [<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0\n [<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0\n [<ffffffff81534763>] ? memdup_user+0x53/0x80\n [<ffffffff819983ea>] SyS_add_key+0x1ba/0x350\n [<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0\n [<ffffffff828bcf4e>] ? retint_user+0x18/0x23\n [<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580\n [<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19\n [<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76\nMemory state around the buggy address:\n ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00\n ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc\n>ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                                        ^\n ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00\n==================================================================\n\nSigned-off-by: Jerome Marchand <jmarchan@redhat.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\ncc: stable@vger.kernel.org\nChange-Id: I903935a221a5b9fb14cec14ef64bd2b6fa8eb222\nBug: 30513364","distinct":true,"url":"https://api.github.com/repos/pablomh/kernel/commits/b18dd776d8546420fcb3d5ec3debd4c94577287a"},{"sha":"eddef53a61c8ad4fa8c72de6fd3442336ed2d695","author":{"name":"Benjamin Tissoires","email":"ace37d3dd488d1f8efb492bba0263a7c3c3d861c@redhat.com"},"message":"UPSTREAM: HID: core: prevent out-of-bound readings\n\n(cherry picked from commit 50220dead1650609206efe91f0cc116132d59b3f)\n\nPlugging a Logitech DJ receiver with KASAN activated raises a bunch of\nout-of-bound readings.\n\nThe fields are allocated up to MAX_USAGE, meaning that potentially, we do\nnot have enough fields to fit the incoming values.\nAdd checks and silence KASAN.\n\nSigned-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\nChange-Id: Iaf25e882a6696884439d7091b5fbb0b350d893d3\nBug: 30951261","distinct":true,"url":"https://api.github.com/repos/pablomh/kernel/commits/eddef53a61c8ad4fa8c72de6fd3442336ed2d695"}]}
{"actor":{"display_login":"pablomh"}}