linux-kernel - Re: orc unwinder: stack-out-of-bounds accesses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20171018170300.hfetfgjwy2vca2zv@treble>
Date:   Wed, 18 Oct 2017 12:03:00 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: orc unwinder: stack-out-of-bounds accesses

On Wed, Oct 18, 2017 at 06:40:46PM +0200, Dmitry Vyukov wrote:
> Hello,
> 
> I am seeing lots of KASAN-detected stack-out-of-bounds accesses in the
> new ORC unwinder. Examples of reports below. linux-next on
> a7dd40274d75326ca868479c62090b1198a357ad.
> You can reproduce this by enabling CONFIG_KASAN with gcc7+ (which
> supports stack instrumentation).

Thanks for reporting it.

>  apic_timer_interrupt+0x96/0xa0 arch/x86/entry/entry_64.S:770
>  </IRQ>
> RIP: 0010:arch_local_save_flags arch/x86/include/asm/paravirt.h:772 [inline]
> RIP: 0010:arch_local_irq_save arch/x86/include/asm/paravirt.h:794 [inline]
> RIP: 0010:lock_is_held_type+0x84/0x200 kernel/locking/lockdep.c:4025

This looks like a known issue:

  https://lkml.kernel.org/r/20170728164844.tee7ujqluv2fgarf@sasha-lappy

The bug is mostly harmless because, even though the unwinder is reading
at the wrong stack address, it still has safeguards that will prevent it
from reading outside of the stack area.

I posted a "fix" here:

  https://lkml.kernel.org/r/cover.1507128293.git.jpoimboe@redhat.com

But it had some issues.  There will be a v2, probably after next week's
OSS Europe / Kernel Summit.

-- 
Josh