Waiman Long 002528dfb5 UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class ... commit 61cc4534b6 upstream. It was found that reading /proc/lockdep after a lockdep splat may potentially cause an access to freed memory if lockdep_unregister_key() is called after the splat but before access to /proc/lockdep [1]. This is due to the fact that graph_lock() call in lockdep_unregister_key() fails after the clearing of debug_locks by the splat process. After lockdep_unregister_key() is called, the lock_name may be freed but the corresponding lock_class structure still have a reference to it. That invalid memory pointer will then be accessed when /proc/lockdep is read by a user and a use-after-free (UAF) error will be reported if KASAN is enabled. To fix this problem, lockdep_unregister_key() is now modified to always search for a matching key irrespective of the debug_locks state and zap the corresponding lock class if a matching one is found. [1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-love.sakura.ne.jp/ Bug: 225086211 Fixes: 8b39adbee8 ("locking/lockdep: Make lockdep_unregister_key() honor 'debug_locks' again") Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> Signed-off-by: Waiman Long <longman@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com Signed-off-by: Cheng Jui Wang <cheng-jui.wang@mediatek.com> Change-Id: I1b03e363142d2b9905f8f263b02d3c7cfdbc515a		2022-04-01 17:14:44 +00:00
..
lock_events.c
lock_events.h
lock_events_list.h
lockdep.c	UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class	2022-04-01 17:14:44 +00:00
lockdep_internals.h	lockdep: Fix usage_traceoverflow	2020-10-09 08:53:08 +02:00
lockdep_proc.c
lockdep_states.h
locktorture.c
Makefile
mcs_spinlock.h
mutex-debug.c	locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal	2021-05-26 12:06:50 +02:00
mutex-debug.h	locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal	2021-05-26 12:06:50 +02:00
mutex.c	This is the 5.10.65 stable release	2021-09-15 14:16:47 +02:00
mutex.h	locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal	2021-05-26 12:06:50 +02:00
osq_lock.c
percpu-rwsem.c	ANDROID: fix ABI breakage caused by percpu_rw_semaphore changes	2021-12-15 21:45:19 +00:00
qrwlock.c	locking/qrwlock: Fix ordering in queued_write_lock_slowpath()	2021-04-28 13:40:00 +02:00
qspinlock.c
qspinlock_paravirt.h
qspinlock_stat.h
rtmutex-debug.c
rtmutex-debug.h
rtmutex.c	This is the 5.10.96 stable release	2022-02-07 11:17:58 +01:00
rtmutex.h
rtmutex_common.h	rtmutex: Remove unused argument from rt_mutex_proxy_unlock()	2021-01-30 13:55:17 +01:00
rwsem.c	This is the 5.10.96 stable release	2022-02-07 11:17:58 +01:00
rwsem.h
semaphore.c	kernel: delete repeated words in comments	2022-02-01 17:25:45 +01:00
spinlock.c
spinlock_debug.c
test-ww_mutex.c