linux-kernel - Re: perf: fuzzer KASAN: global-out-of-bounds in match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Nov 2016 21:51:24 -0500 (EST)
From:   Vince Weaver <vincent.weaver@...ne.edu>
To:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
cc:     Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        "dvyukov@...gle.com" <dvyukov@...gle.com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Subject: Re: perf: fuzzer KASAN: global-out-of-bounds in match_token

On Thu, 17 Nov 2016, Vince Weaver wrote:

> On Thu, 17 Nov 2016, Vince Weaver wrote:
> > > 
> > > [  911.507365] ==================================================================
> > > [  911.514824] BUG: KASAN: global-out-of-bounds in match_token+0x268/0x310 at addr ffffffffb14ad058
> > > [  911.523912] Read of size 8 by task perf_fuzzer/20662
> > > [  911.528945] Address belongs to variable if_tokens+0x78/0xa0

I managed to create a short reproducer that reliably causes the issue on 
my skylake test machine.



/* simplified perf_fuzzer test case */
/* that triggers BUG: KASAN: global-out-of-bounds in match_token+0x288 */
/* on a skylake machine running Linux 4.9-rc5 */
/* by Vince Weaver <vincent.weaver _at_ maine.edu> */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <linux/perf_event.h>


int perf_event_open(struct perf_event_attr *hw_event_uptr,
	pid_t pid, int cpu, int group_fd, unsigned long flags) {

	return syscall(__NR_perf_event_open,hw_event_uptr, pid, cpu,
		group_fd, flags);
}

int main(int argc, char **argv) {

	int fd7;
	struct perf_event_attr pe7;

	char filter[]="(((to&733)&&common_type&605)||common_flags<386922879890793102)";

	memset(&pe7,0,sizeof(struct perf_event_attr));
	pe7.type=7;		/* intel_pt */
	pe7.size=72;
	pe7.config=0x200ULL;	/* bit 10 = tsc */
	pe7.read_format=PERF_FORMAT_TOTAL_TIME_ENABLED; /* 1 */
	pe7.disabled=1;
	pe7.pinned=1;
	pe7.comm_exec=1;

	fd7=perf_event_open(&pe7,
				0, /* current thread */
				0, /* Only cpu 0 */
				-1, /* group leader */
				PERF_FLAG_FD_NO_GROUP /*1*/ );

	ioctl(fd7, PERF_EVENT_IOC_SET_FILTER , &filter);

	return 0;
}