linux-hardening - Re: [linus:master] [kasan, fortify] 2e577732e8: BUG:KASAN:global-out-of-bounds_in_usb_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202407231617.FEB5AC3@keescook>
Date: Tue, 23 Jul 2024 16:35:24 -0700
From: Kees Cook <kees@...nel.org>
To: kernel test robot <oliver.sang@...el.com>
Cc: Andrey Konovalov <andreyknvl@...il.com>, oe-lkp@...ts.linux.dev,
	lkp@...el.com, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Erhard Furtner <erhard_f@...lbox.org>,
	Nico Pache <npache@...hat.com>, Marco Elver <elver@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Andrey Ryabinin <ryabinin.a.a@...il.com>,
	Daniel Axtens <dja@...ens.net>, Dmitry Vyukov <dvyukov@...gle.com>,
	linux-hardening@...r.kernel.org
Subject: Re: [linus:master] [kasan, fortify]  2e577732e8:
 BUG:KASAN:global-out-of-bounds_in_usb_copy_descriptors

On Tue, Jul 23, 2024 at 04:51:36PM +0800, kernel test robot wrote:
> [   25.775287][    T1] BUG: KASAN: global-out-of-bounds in usb_copy_descriptors+0x15f/0x370
> [   25.776048][    T1] Read of size 192 at addr ffffffff90c3e4c0 by task swapper/0/1
> ...
> [   25.777833][    T1]  __asan_memcpy+0x1f/0x60
> [   25.777833][    T1]  usb_copy_descriptors+0x15f/0x370
> [   25.777833][    T1]  usb_assign_descriptors+0xad/0x410
> [   25.777833][    T1]  f_audio_bind+0xe25/0x24f0
> [   25.785907][    T1]  usb_add_function+0x192/0x4e0
> [   25.785907][    T1]  audio_do_config+0xf9/0x160
> [   25.785907][    T1]  usb_add_config+0x38/0x460

The memcpy is:

usb_copy_descriptors(struct usb_descriptor_header **src)
	...
                memcpy(mem, *src, (*src)->bLength);

I can't find a bLength for a struct usb_descriptor_header::bLength that is 192...

...
audio_do_config()
  usb_add_function()
    function->bind(config, function);
      gadget/legacy/audio.c:audio_bind()
        usb_add_config()
          audio_do_config()
            usb_add_function()
              function->bind(config, function);
                f_audio_bind()
                  usb_assign_descriptors()
                    usb_copy_descriptors()

Is this thing in a loop?

-- 
Kees Cook