linux-hardening - Re: 6.1rc1: NFS memcpy warning on mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y0zS/5WLi2q4Ua2U@debian.me>
Date:   Mon, 17 Oct 2022 10:58:55 +0700
From:   Bagas Sanjaya <bagasdotme@...il.com>
To:     Dave Jones <davej@...emonkey.org.uk>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-nfs@...r.kernel.org, linux-hardening@...r.kernel.org,
        Trond Myklebust <trond.myklebust@...merspace.com>,
        Scott Mayhew <smayhew@...hat.com>,
        Anna Schumaker <anna@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: 6.1rc1: NFS memcpy warning on mount

On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
> Started getting this during mount on a 6.1rc1 kernel..
> not sure which mount it's complaining about, but they're all v3 tcp
> mounts on that machine.
> 
> [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)
> [   19.617504] WARNING: CPU: 3 PID: 1300 at fs/nfs/super.c:857 nfs_request_mount.constprop.0.isra.0+0x1c0/0x1f0
> [   19.617528] CPU: 3 PID: 1300 Comm: mount.nfs Not tainted 6.1.0-rc1-backup+ #1
> [   19.617553] RIP: 0010:nfs_request_mount.constprop.0.isra.0+0x1c0/0x1f0
> [   19.617566] Code: 16 81 01 00 75 9b 48 c7 c1 ff ff ff ff 48 c7 c2 a8 a8 82 ab 4c 89 e6 c6 05 36 16 81 01 01 48 c7 c7 a8 3a 81 ab e8 61 1d 9a 00 <0f> 0b 48 8b 3c 24 e9 6c ff ff ff c7 83 20 01 00 00 01 00 00 00 b8
> [   19.617593] RSP: 0018:ffffc900027fbd48 EFLAGS: 00010286
> [   19.617604] RAX: 0000000000000000 RBX: ffff8881208d5000 RCX: ffff88842fadb7a8
> [   19.617617] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff88842fadb7a0
> [   19.617629] RBP: ffff8881208d5130 R08: 0000000000000000 R09: ffffffffaba5c540
> [   19.617641] R10: 0000000000000001 R11: 0000000000000001 R12: 000000000000001c
> [   19.617653] R13: 0000000000000001 R14: ffffc900027fbef0 R15: ffff888100b3bea0
> [   19.617665] FS:  00007ff793dd6840(0000) GS:ffff88842fac0000(0000) knlGS:0000000000000000
> [   19.617679] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   19.617690] CR2: 0000564a1a747468 CR3: 00000001106fb003 CR4: 00000000001706e0
> [   19.617703] Call Trace:
> [   19.617709]  <TASK>
> [   19.617716]  nfs_try_get_tree+0xa1/0x220
> [   19.617725]  ? get_nfs_version+0x63/0x130
> [   19.617736]  vfs_get_tree+0x1d/0x90
> [   19.617746]  ? capable+0x2f/0x50
> [   19.617755]  path_mount+0x75c/0xb00
> [   19.617766]  __x64_sys_mount+0x19a/0x200
> [   19.617775]  do_syscall_64+0x35/0x80
> [   19.617785]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
> [   19.617796] RIP: 0033:0x7ff7941ac6ea
> [   19.617805] Code: 48 8b 0d a9 17 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 17 0d 00 f7 d8 64 89 01 48
> [   19.617832] RSP: 002b:00007ffd02ae4ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> [   19.617846] RAX: ffffffffffffffda RBX: 00007ffd02ae4e70 RCX: 00007ff7941ac6ea
> [   19.617858] RDX: 0000564a1a73fb60 RSI: 0000564a1a73fb80 RDI: 0000564a1a741890
> [   19.617870] RBP: 00007ff793dd67b8 R08: 0000564a1a73f480 R09: 0000564a1a73f480
> [   19.617882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> [   19.617894] R13: 00007ffd02ae4dd0 R14: 0000564a1a7474e0 R15: 0000564a1a7436b0
> [   19.617907]  </TASK>
> [   19.617913] irq event stamp: 8757
> [   19.617920] hardirqs last  enabled at (8769): [<ffffffffaa1397c2>] __up_console_sem+0x52/0x60
> [   19.617937] hardirqs last disabled at (8780): [<ffffffffaa1397a7>] __up_console_sem+0x37/0x60
> [   19.617952] softirqs last  enabled at (8180): [<ffffffffaabf547a>] sk_common_release+0x5a/0xe0
> [   19.617969] softirqs last disabled at (8178): [<ffffffffaabf5456>] sk_common_release+0x36/0xe0
> [   19.617984] ---[ end trace 0000000000000000 ]---
> 

Hmm, the blamed line in the warning is introduced by 38465f5d1af932 ("NFS:
rename nfs_fs_context pointer arg in a few functions"). Cc: the commit
author. Also Cc: Kees for authoring the patch [1] that have fixed
similar warning.

Also, does v6.0 have this warning? If so, you need to bisect in the range
of v6.0..v6.1-rc1.

Thanks.

[1]: https://lore.kernel.org/lkml/20221011065243.583650-1-keescook@chromium.org/

-- 
An old man doll... just what I always wanted! - Clara

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)