linux-kernel - Re: [PATCH] mpt3sas: Don't overreach ioc->reply

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56F1775E.3020500@fb.com>
Date:	Tue, 22 Mar 2016 10:48:30 -0600
From:	Jens Axboe <axboe@...com>
To:	Calvin Owens <calvinowens@...com>,
	Sathya Prakash <sathya.prakash@...adcom.com>,
	Chaitra P B <chaitra.basappa@...adcom.com>,
	Suganath Prabu Subramani 
	<suganath-prabu.subramani@...adcom.com>,
	"James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
	"Martin K. Petersen" <martin.petersen@...cle.com>
CC:	<MPT-FusionLinux.pdl@...adcom.com>, <linux-scsi@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <kernel-team@...com>
Subject: Re: [PATCH] mpt3sas: Don't overreach ioc->reply_post[] during
 initialization

On 03/18/2016 01:45 PM, Calvin Owens wrote:
> In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull
> a pointer out of successive elements of ioc->reply_post[] for each entry
> in that list if RDPQ is enabled.
>
> Since the code pulls the pointer for the next iteration at the bottom of
> the loop, it triggers the a KASAN dump on the final iteration:
>
>      BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0
>      Read of size 8 by task modprobe/305
>      <snip>
>      Call Trace:
>       [<ffffffff81dfc591>] dump_stack+0x4d/0x6c
>       [<ffffffff814c9689>] print_trailer+0xf9/0x150
>       [<ffffffff814ceda4>] object_err+0x34/0x40
>       [<ffffffff814d1231>] kasan_report_error+0x221/0x530
>       [<ffffffff814d1673>] __asan_report_load8_noabort+0x43/0x50
>       [<ffffffffa0043637>] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas]
>       [<ffffffffa0049a51>] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas]
>       [<ffffffffa0053c93>] _scsih_probe+0xeb3/0x16b0 [mpt3sas]
>       [<ffffffff81ebd047>] local_pci_probe+0xc7/0x170
>       [<ffffffff81ebf2cf>] pci_device_probe+0x20f/0x290
>       [<ffffffff820d50cd>] really_probe+0x17d/0x600
>       [<ffffffff820d56a3>] __driver_attach+0x153/0x190
>       [<ffffffff820cffac>] bus_for_each_dev+0x11c/0x1a0
>       [<ffffffff820d421d>] driver_attach+0x3d/0x50
>       [<ffffffff820d378a>] bus_add_driver+0x44a/0x5f0
>       [<ffffffff820d666c>] driver_register+0x18c/0x3b0
>       [<ffffffff81ebcb76>] __pci_register_driver+0x156/0x200
>       [<ffffffffa00c8135>] _mpt3sas_init+0x135/0x1000 [mpt3sas]
>       [<ffffffff81000423>] do_one_initcall+0x113/0x2b0
>       [<ffffffff813caa5a>] do_init_module+0x1d0/0x4d8
>       [<ffffffff81273909>] load_module+0x6729/0x8dc0
>       [<ffffffff81276123>] SYSC_init_module+0x183/0x1a0
>       [<ffffffff8127625e>] SyS_init_module+0xe/0x10
>       [<ffffffff828fe7d7>] entry_SYSCALL_64_fastpath+0x12/0x6a
>
> Fix this by pulling the value at the beginning of the loop.
>
> Signed-off-by: Calvin Owens <calvinowens@...com>

Looks good to me.

Reviewed-by: Jens Axboe <axboe@...com>

-- 
Jens Axboe