linux-kernel - Re: drivers/of: crash on boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <80967a3a-3b97-e131-97e5-f449f567b01c@nvidia.com>
Date:	Wed, 18 May 2016 15:58:43 -0400
From:	Rhyland Klein <rklein@...dia.com>
To:	Rob Herring <robh@...nel.org>,
	Sasha Levin <sasha.levin@...cle.com>,
	Gavin Shan <gwshan@...ux.vnet.ibm.com>
CC:	LKML <linux-kernel@...r.kernel.org>,
	Grant Likely <grant.likely@...aro.org>,
	"devicetree@...r.kernel.org" <devicetree@...r.kernel.org>
Subject: Re: drivers/of: crash on boot

On 5/18/2016 3:36 PM, Rob Herring wrote:
> On Wed, May 18, 2016 at 10:34 AM, Sasha Levin <sasha.levin@...cle.com> wrote:
>> Hi Rhyland,
>>
>> I'm seeing a crash on boot that seems to have been caused by
>> "drivers/of: Fix depth when unflattening devicetree":
>>
>> [   61.145229] ==================================================================
>>
>> [   61.147588] BUG: KASAN: stack-out-of-bounds in unflatten_dt_nodes+0x11d2/0x1290 at addr ffff88005b30777c
> 
> The following appears to fix it for me. Rhyland, please confirm.
> 
> diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
> index 7f38241..888ec2a 100644
> --- a/drivers/of/fdt.c
> +++ b/drivers/of/fdt.c
> @@ -409,7 +409,7 @@ static int unflatten_dt_nodes(const void *blob,
>         fpsizes[depth] = dad ? strlen(of_node_full_name(dad)) : 0;
>         nps[depth+1] = dad;
>         for (offset = 0;
> -            offset >= 0;
> +            offset >= 0, depth >= 0;
>              offset = fdt_next_node(blob, offset, &depth)) {
>                 if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH))
>                         continue;
> 

If I try that patch, i see this when compiling:

In function ‘unflatten_dt_nodes’:
warning: left-hand operand of comma expression has no effect
[-Wunused-value]
	offset >= 0, depth >= 0;

And if I boot it, then I hit a NULL pointer dereference:

[    0.000000] Unable to handle kernel NULL pointer dereference at
virtual address 00000058
[    0.000000] pgd = ffff000008cb4000
[    0.000000] [00000058] *pgd=000000013fffe003, *pud=000000013fffd003,
*pmd=0000000000000000
[    0.000000] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted
4.6.0-next-20160518+ #26
[    0.000000] Hardware name: Google Pixel C (DT)
[    0.000000] task: ffff000008bdd880 ti: ffff000008bd0000 task.ti:
ffff000008bd0000
[    0.000000] PC is at unflatten_dt_nodes+0x430/0x598
[    0.000000] LR is at unflatten_dt_nodes+0x41c/0x598
[    0.000000] pc : [<ffff0000086633dc>] lr : [<ffff0000086633c8>]
pstate: 800002c5

If I run this on my board, I see unflatten_dt_nodes return from inside
the loop after "populate_node" when called with depth = -1 (returning
mem-base) rather than breaking out of the loop and continuing.

-rhyland

-- 
nvpublic