| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1417461137.25958.4.camel@bling.home> Date: Mon, 01 Dec 2014 12:12:17 -0700 From: Alex Williamson <alex.williamson@...hat.com> To: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Cc: Dmitry Vyukov <dvyukov@...gle.com>, kasan-dev@...glegroups.com, LKML <linux-kernel@...r.kernel.org>, Kostya Serebryany <kcc@...gle.com>, Dmitry Chernenkov <dmitryc@...gle.com>, Andrey Konovalov <andreyknvl@...gle.com>, Greg Thelen <gthelen@...gle.com>, Kees Cook <keescook@...gle.com>, Robert Swiecki <swiecki@...gle.com>, Andrey Ryabinin <a.ryabinin@...sung.com>, Konstantin Khlebnikov <koct9i@...il.com>, Yury Gribov <y.gribov@...sung.com> Subject: Re: Out-of-bounds write in driver_override_show On Sat, 2014-11-29 at 10:05 -0800, Greg Kroah-Hartman wrote: > On Sat, Nov 29, 2014 at 01:38:10PM +0400, Dmitry Vyukov wrote: > > Hello, > > > > I am working on Kernel AddressSanitizer, a fast memory error detector > > for kernel: > > https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel > > > > Here is an error report that I got while running trinity: > > Alex, this looks like the code you added, you need to properly check for > the size of the string before writing it back... Thanks for the report, I'm not sure I entirely understand the issue though. The string at pci_dev.driver_override is bounds checked when set in driver_override_store() and I think that the buffer for a sysfs show is always a page, right? So by checking strlen are we just guarding against some in-kernel setting of driver_override other than the _store() path? Thanks, Alex > > > > BUG: AddressSanitizer: out of bounds access in vsnprintf+0xd0/0x890 at > > addr ffff880057483261 > > Write of size 1 by task trinity-c54/4461 > > ============================================================================= > > BUG kmalloc-4096 (Tainted: G W ): kasan error > > ----------------------------------------------------------------------------- > > INFO: Allocated in seq_open+0x5a/0xe0 age=1571449 cpu=0 pid=28869 > > __slab_alloc+0x4c4/0x4e0 > > __kmalloc+0x18b/0x1b0 > > seq_buf_alloc+0x16/0x40 > > traverse+0x243/0x350 > > seq_read+0x434/0x6b0 > > kernfs_fop_read+0x176/0x1f0 > > vfs_read+0xd7/0x240 > > SyS_read+0x57/0xc0 > > system_call_fastpath+0x12/0x17 > > INFO: Slab 0xffffea00015d2000 objects=7 used=7 fp=0x (null) > > flags=0x100000000004080 > > INFO: Object 0xffff880057482260 @offset=8800 fp=0xffffffffffffffff > > > > CPU: 0 PID: 4461 Comm: trinity-c54 Tainted: G B W 3.18.0-rc1+ #8 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > ffffffff81fbdaac ffff88008e3ab8c8 ffffffff81c85c3f 0000000000001130 > > ffff88011b003200 ffff88008e3ab8f8 ffffffff811ee018 ffff88011b003200 > > ffffea00015d2000 ffff880057482260 ffff8800d748225f ffff88008e3ab928 > > Call Trace: > > [<ffffffff811f76a5>] __asan_store1+0x75/0xb0 mm/kasan/kasan.c:417 > > [<ffffffff8147b660>] vsnprintf+0xd0/0x890 lib/vsprintf.c:1860 > > [<ffffffff8147bf70>] sprintf+0x40/0x50 lib/vsprintf.c:1989 > > [<ffffffff816e1e51>] driver_override_show+0x31/0x40 drivers/base/platform.c:755 > > [<ffffffff816d92d9>] dev_attr_show+0x39/0x80 drivers/base/core.c:120 > > [<ffffffff812a3892>] sysfs_kf_seq_show+0x152/0x230 fs/sysfs/file.c:63 > > [<ffffffff812a13a6>] kernfs_seq_show+0x76/0x90 fs/kernfs/file.c:168 > > [<ffffffff8122f755>] traverse+0x185/0x350 fs/seq_file.c:120 > > [<ffffffff8122fee4>] seq_read+0x434/0x6b0 fs/seq_file.c:191 > > [<ffffffff812a22f6>] kernfs_fop_read+0x176/0x1f0 fs/kernfs/file.c:244 > > [<ffffffff811fc131>] do_loop_readv_writev+0x71/0xa0 fs/read_write.c:708 > > [<ffffffff811fe850>] do_readv_writev+0x350/0x360 fs/read_write.c:842 > > [<ffffffff811fe8ab>] vfs_readv+0x4b/0x70 fs/read_write.c:867 > > [< inlined >] SyS_preadv+0xca/0xf0 SYSC_preadv fs/read_write.c:945 > > [<ffffffff811fec0a>] SyS_preadv+0xca/0xf0 fs/read_write.c:931 > > [<ffffffff81c91f69>] system_call_fastpath+0x12/0x17 > > arch/x86/kernel/entry_64.S:422 > > Memory state around the buggy address: > > ffff880057482f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff880057483000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff880057483080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff880057483100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff880057483180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > >ffff880057483200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc > > ^ > > ffff880057483280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffff880057483300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > > ffff880057483380: fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff880057483400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ffff880057483480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > > ================================================================== > > dev_attr_show: driver_override_show+0x0/0x40 returned bad count > > fill_read_buffer: dev_attr_show+0x0/0x80 returned bad count > > > > > > My source is on revision f114040e3ea6e07372334ade75d1ee0775c355e1. > > > > I've looked at source code and it seems that driver_override_store > > does not do length sanitization, so driver_override_show smashes > > subsequent memory blocks in sprinf (with user-provided data?). -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists