michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
linux-6.16.y
linux/kernel
History
Ankit Khushwaha f125c1cfa1 ring buffer: Propagate __rb_map_vma return value to caller 
commit de4cbd7047 upstream.

The return value from `__rb_map_vma()`, which rejects writable or
executable mappings (VM_WRITE, VM_EXEC, or !VM_MAYSHARE), was being
ignored. As a result the caller of `__rb_map_vma` always returned 0
even when the mapping had actually failed, allowing it to proceed
with an invalid VMA.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251008172516.20697-1-ankitkhushwaha.linux@gmail.com
Fixes: 117c39200d ("ring-buffer: Introducing ring-buffer mapping functions")
Reported-by: syzbot+ddc001b92c083dbf2b97@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=194151be8eaebd826005329b2e123aecae714bdb
Signed-off-by: Ankit Khushwaha <ankitkhushwaha.linux@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-12 13:01:04 +02:00
..
bpf
bpf: Reject bpf_timer for PREEMPT_RT
2025-10-02 13:48:29 +02:00
cgroup
cgroup: split cgroup_destroy_wq into 3 workqueues
2025-09-25 11:16:41 +02:00
configs
…
debug
…
dma
dma-debug: don't enforce dma mapping check on noncoherent allocations
2025-09-19 16:37:26 +02:00
entry
…
events
perf: Fix the POLL_HUP delivery breakage
2025-09-19 16:37:26 +02:00
futex
futex: Prevent use-after-free during requeue-PI
2025-10-02 13:48:33 +02:00
gcov
…
irq
…
kcsan
kcsan: test: Initialize dummy variable
2025-08-15 16:38:50 +02:00
livepatch
…
locking
…
module
module: Prevent silent truncation of module name in delete_module(2)
2025-08-20 18:41:28 +02:00
power
PM: hibernate: Restrict GFP mask in hibernation_snapshot()
2025-09-19 16:37:30 +02:00
printk
printk: nbcon: Allow reacquire during panic
2025-08-20 18:41:30 +02:00
rcu
rcu: Fix racy re-initialization of irq_work causing hangs
2025-08-20 18:41:43 +02:00
sched
sched_ext: idle: Handle migration-disabled tasks in BPF code
2025-10-02 13:48:39 +02:00
time
hrtimers: Unconditionally update target CPU base after offline timer migration
2025-09-19 16:37:34 +02:00
trace
ring buffer: Propagate __rb_map_vma return value to caller
2025-10-12 13:01:04 +02:00
.gitignore
kheaders: rebuild kheaders_data.tar.xz when a file is modified within a minute
2025-08-20 18:41:31 +02:00
acct.c
…
async.c
…
audit_fsnotify.c
…
audit_tree.c
…
audit_watch.c
…
audit.c
…
audit.h
audit,module: restore audit logging in load failure case
2025-08-15 16:38:20 +02:00
auditfilter.c
audit: fix out-of-bounds read in audit_compare_dname_path()
2025-09-09 19:02:34 +02:00
auditsc.c
audit,module: restore audit logging in load failure case
2025-08-15 16:38:20 +02:00
backtracetest.c
…
bounds.c
…
capability.c
…
cfi.c
…
compat.c
…
configs.c
…
context_tracking.c
…
cpu_pm.c
…
cpu.c
…
crash_core.c
…
crash_dump_dm_crypt.c
…
crash_reserve.c
…
cred.c
…
delayacct.c
…
dma.c
…
elfcorehdr.c
…
exec_domain.c
…
exit.c
…
exit.h
…
extable.c
…
fail_function.c
…
fork.c
futex: Use correct exit on failure from futex_hash_allocate_default()
2025-10-02 13:48:33 +02:00
freezer.c
sched,freezer: Remove unnecessary warning in __thaw_task
2025-07-17 07:56:50 -10:00
gen_kheaders.sh
kheaders: rebuild kheaders_data.tar.xz when a file is modified within a minute
2025-08-20 18:41:31 +02:00
groups.c
…
hung_task.c
…
iomem.c
…
irq_work.c
…
jump_label.c
…
kallsyms_internal.h
…
kallsyms_selftest.c
…
kallsyms_selftest.h
…
kallsyms.c
…
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.kexec
kho: mm: don't allow deferred struct page with KHO
2025-08-28 16:34:34 +02:00
Kconfig.locks
…
Kconfig.preempt
…
kcov.c
…
kexec_core.c
kexec_core: Fix error code path in the KEXEC_JUMP flow
2025-08-15 16:38:34 +02:00
kexec_elf.c
…
kexec_file.c
…
kexec_handover.c
kho: warn if KHO is disabled due to an error
2025-08-28 16:34:35 +02:00
kexec_internal.h
…
kexec.c
…
kheaders.c
…
kprobes.c
…
ksyms_common.c
…
ksysfs.c
…
kthread.c
ipvs: Fix estimator kthreads preferred affinity
2025-08-20 18:40:52 +02:00
latencytop.c
…
Makefile
kheaders: rebuild kheaders_data.tar.xz when a file is modified within a minute
2025-08-20 18:41:31 +02:00
module_signature.c
…
notifier.c
…
nsproxy.c
…
padata.c
padata: Fix pd UAF once and for all
2025-08-15 16:38:58 +02:00
panic.c
…
params.c
…
pid_namespace.c
…
pid_sysctl.h
…
pid.c
…
profile.c
…
ptrace.c
…
range.c
…
reboot.c
…
regset.c
…
relay.c
…
resource_kunit.c
…
resource.c
resource: fix false warning in __request_region()
2025-07-24 17:57:59 -07:00
rseq.c
…
scftorture.c
…
scs.c
…
seccomp.c
…
signal.c
signal: Fix memory leak for PIDFD_SELF* sentinels
2025-08-28 16:34:38 +02:00
smp.c
…
smpboot.c
…
smpboot.h
…
softirq.c
…
stackleak.c
…
stacktrace.c
…
static_call_inline.c
…
static_call.c
…
stop_machine.c
…
sys_ni.c
…
sys.c
…
sysctl-test.c
…
sysctl.c
…
task_work.c
…
taskstats.c
…
torture.c
…
tracepoint.c
…
tsacct.c
…
ucount.c
ucount: fix atomic_long_inc_below() argument type
2025-08-15 16:39:17 +02:00
uid16.c
…
uid16.h
…
umh.c
…
up.c
…
user_namespace.c
…
user-return-notifier.c
…
user.c
…
usermode_driver.c
…
utsname_sysctl.c
…
utsname.c
…
vhost_task.c
vhost: Take a reference on the task in struct vhost_task.
2025-10-02 13:48:31 +02:00
vmcore_info.c
…
watch_queue.c
…
watchdog_buddy.c
…
watchdog_perf.c
…
watchdog.c
…
workqueue_internal.h
…
workqueue.c
…