linux-kernel - [GIT PULL] s390 fixes for 6.16-rc4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5038bf76-cdda-4ecf-a9d5-b5ded666356f@agordeev.local>
Date: Fri, 27 Jun 2025 10:21:45 +0200
From: Alexander Gordeev <agordeev@...ux.ibm.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Vasily Gorbik <gor@...ux.ibm.com>, Heiko Carstens <hca@...ux.ibm.com>,
        linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [GIT PULL] s390 fixes for 6.16-rc4

Hi Linus,

please pull s390 fixes for 6.16-rc4.

Thanks,
Alexander

The following changes since commit e04c78d86a9699d136910cfc0bdcf01087e3267e:

  Linux 6.16-rc2 (2025-06-15 13:49:41 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git tags/s390-6.16-3

for you to fetch changes up to 7f8073cfb04a97842fe891ca50dad60afd1e3121:

  s390/ptrace: Fix pointer dereferencing in regs_get_kernel_stack_nth() (2025-06-17 18:15:25 +0200)

----------------------------------------------------------------
s390 fixes for 6.16-rc4

- Fix incorrectly dropped dereferencing of the stack nth entry
  introduced with a previous KASAN false positive fix

- Use a proper memdup_array_user() helper to prevent overflow
  in a protected key size calculation

----------------------------------------------------------------
Fedor Pchelkin (1):
      s390/pkey: Prevent overflow in size calculation for memdup_user()

Heiko Carstens (1):
      s390/ptrace: Fix pointer dereferencing in regs_get_kernel_stack_nth()

 arch/s390/include/asm/ptrace.h | 2 +-
 drivers/s390/crypto/pkey_api.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index 62c0ab4a4b9d..0905fa99a31e 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -265,7 +265,7 @@ static __always_inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *r
 	addr = kernel_stack_pointer(regs) + n * sizeof(long);
 	if (!regs_within_kernel_stack(regs, addr))
 		return 0;
-	return READ_ONCE_NOCHECK(addr);
+	return READ_ONCE_NOCHECK(*(unsigned long *)addr);
 }
 
 /**
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index cef60770f68b..b3fcdcae379e 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -86,7 +86,7 @@ static void *_copy_apqns_from_user(void __user *uapqns, size_t nr_apqns)
 	if (!uapqns || nr_apqns == 0)
 		return NULL;
 
-	return memdup_user(uapqns, nr_apqns * sizeof(struct pkey_apqn));
+	return memdup_array_user(uapqns, nr_apqns, sizeof(struct pkey_apqn));
 }
 
 static int pkey_ioctl_genseck(struct pkey_genseck __user *ugs)