linux-kernel - Re: show_uevent() and general protection fault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120817022939.GA24650@localhost>
Date:	Fri, 17 Aug 2012 10:29:39 +0800
From:	Fengguang Wu <fengguang.wu@...el.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	Cornelia Huck <cornelia.huck@...ibm.com>,
	devel@...verdev.osuosl.org, Kay Sievers <kay.sievers@...y.org>,
	Alan Stern <stern@...land.harvard.edu>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: show_uevent() and general protection fault

> > --- tip.orig/drivers/base/core.c        2012-08-17 08:48:07.101972082 +0800
> > +++ tip/drivers/base/core.c     2012-08-17 09:49:43.665912992 +0800
> > @@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device
> >                 goto out;
> >  
> >         /* copy keys to file */
> > -       for (i = 0; i < env->envp_idx; i++)
> > +       printk(KERN_ERR "uevent %d env[%d]: %s/.../%s\n", env->buflen, env->envp_idx, top_kobj->name, dev->kobj.name);
> > +       for (i = 0; i < env->envp_idx; i++) {
> > +               printk(KERN_ERR "uevent %d env[%d]: %s\n", (int)count, i, env->envp[i]);
> >                 count += sprintf(&buf[count], "%s\n", env->envp[i]);
> > +       }
> >  out:
> >         kfree(env);
> >         return count;
> 
> It's printing 32 strings of "(null)\n" (7 characters each) to the buffer,
> which eventually overflows it.
> 
> [   65.968387] uevent 12 env[1627389952]: LNXCPU:01/.../LNXCPU:01
> [   65.969586] uevent 0 env[0]: (null)

Something obviously wrong here:

        env->buflen == 12
        env->envp_idx == 1627389952
        env->env[0] == NULL

I'm not sure where it comes from, but if it's possible for random
drivers to create that bad env, we could add some sanity check here to
at least prevent the panic.

Thanks,
Fengguang

> [   65.970463] uevent 7 env[1]: (null)
> [   65.971338] uevent 14 env[2]: (null)
> [   65.972225] uevent 21 env[3]: (null)
> [   65.973111] uevent 28 env[4]: (null)
> [   65.973952] uevent 35 env[5]: (null)
> [   65.974852] uevent 42 env[6]: (null)
> [   65.975735] uevent 49 env[7]: (null)
> [   65.976627] uevent 56 env[8]: (null)
> [   65.977545] uevent 63 env[9]: (null)
> [   65.978469] uevent 70 env[10]: (null)
> [   65.979410] uevent 77 env[11]: (null)
> [   65.980321] uevent 84 env[12]: (null)
> [   65.981243] uevent 91 env[13]: (null)
> [   65.982159] uevent 98 env[14]: (null)
> [   65.983080] uevent 105 env[15]: (null)
> [   65.983972] uevent 112 env[16]: (null)
> [   65.984908] uevent 119 env[17]: (null)
> [   65.985850] uevent 126 env[18]: (null)
> [   65.986797] uevent 133 env[19]: (null)
> [   65.987768] uevent 140 env[20]: (null)
> [   65.988723] uevent 147 env[21]: (null)
> [   65.989661] uevent 154 env[22]: (null)
> [   65.990591] uevent 161 env[23]: (null)
> [   65.991527] uevent 168 env[24]: (null)
> [   65.992452] uevent 175 env[25]: (null)
> [   65.993383] uevent 182 env[26]: (null)
> [   65.994386] uevent 189 env[27]: (null)
> [   65.995342] uevent 196 env[28]: (null)
> [   65.996289] uevent 203 env[29]: (null)
> [   65.997243] uevent 210 env[30]: (null)
> [   65.998197] uevent 217 env[31]: (null)
> [   65.999124] general protection fault: 0000 [#1] PREEMPT 
> [   66.000106] CPU 0 
> [   66.000106] Pid: 128, comm: trinity-child0 Not tainted 3.6.0-rc1-bisect2-00037-gdfdf036-dirty #8 Bochs Bochs
> [   66.000106] RIP: 0010:[<ffffffff811cb0bc>]  [<ffffffff811cb0bc>] strnlen+0x2e/0x37
> ...
> [   66.000106] Call Trace:
> [   66.000106]  [<ffffffff811cc700>] string.isra.3+0x49/0xe6
> [   66.000106]  [<ffffffff811cd511>] vsnprintf+0x267/0x6dd
> [   66.000106]  [<ffffffff810a0001>] ? compat_sys_clock_gettime+0x12/0x91
> [   66.000106]  [<ffffffff8181dd30>] ? retint_restore_args+0x13/0x13
> [   66.000106]  [<ffffffff811cdda0>] vscnprintf+0x16/0x3a
> [   66.000106]  [<ffffffff8104bc95>] vprintk_emit+0x313/0x66f
> [   66.000106]  [<ffffffff811cd34b>] ? vsnprintf+0xa1/0x6dd
> [   66.000106]  [<ffffffff81804bc9>] printk+0x4f/0x58
> [   66.000106]  [<ffffffff812c6b4b>] show_uevent+0x164/0x1db
> [   66.000106]  [<ffffffff812c67c3>] dev_attr_show+0x29/0x77
> [   66.000106]  [<ffffffff81153a1d>] ? sysfs_read_file+0xc5/0x221
> [   66.000106]  [<ffffffff810cfab4>] ? __get_free_pages+0x2f/0x6a
> [   66.000106]  [<ffffffff81153a55>] sysfs_read_file+0xfd/0x221
> [   66.000106]  [<ffffffff8110264d>] vfs_read+0xdb/0x1c1
> [   66.000106]  [<ffffffff81102a47>] sys_read+0x56/0x9e
> 
> Thanks,
> Fengguang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/