linux-kernel - Re: [LKP] 4ce5f9c9e7 [ 1.323881] WARNING: CPU: 0 PID: 1 at mm/slab_common.c:1031 kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 10 Oct 2018 17:31:42 -0700
From:   Sean Christopherson <sean.j.christopherson@...el.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     kernel test robot <rong.a.chen@...el.com>,
        linux-kernel@...r.kernel.org, LKP <lkp@...org>
Subject: Re: [LKP] 4ce5f9c9e7 [ 1.323881] WARNING: CPU: 0 PID: 1 at
 mm/slab_common.c:1031 kmalloc_slab

On Wed, Oct 10, 2018 at 04:41:48PM -0700, Sean Christopherson wrote:
> On Wed, Oct 10, 2018 at 05:06:52PM -0500, Eric W. Biederman wrote:
> > ebiederm@...ssion.com (Eric W. Biederman) writes:
> > 
> > > So I am flummoxed.  I am reading through the code and I don't see
> > > anything that could trigger this, and when I ran the supplied reproducer
> > > it did not reproduce for me.
> > 
> > Even more so.  With my tool chain the line that reports the failing
> > address is impossible.
> > 
> > [   73.034423] RIP: 0010:copy_siginfo_from_user+0x4d/0xd0
> > 
> > With the supplied configureation my tool chain only has 0x30 bytes for
> > all of copy_siginfo_from_user.  So I can't even begin to guess where
> > in that function things are failing.
> > 
> > Any additional information that you can provide would be a real help
> > in tracking down this strange failure.
> 
> I don't have the exact toolchain, but I was able to get somewhat close
> and may have found a smoking gun.  0x4d in my build is in the general
> vicinity of "sig_sicodes[sig].limit" in known_siginfo_layout().  This
> lines up with the register state from the log, e.g. RDI=0500104d8,
> which is the mask generated by sig_specific_sicodes.  From what I can
> tell, @sig is never bounds checked.  If the compiler generated an AND
> instruction to compare against sig_specific_sicodes then that could
> resolve true with any arbitrary value that happened to collide with
> sig_specific_sicodes and result in an out-of-bounds access to
> @sig_sicodes.  siginfo_layout() for example explicitly checks @sig
> before indexing @sig_sicode, e.g. "sig < ARRAY_SIZE(sig_sicodes)".

Hmm, siginmask explicitly checks sig < SIGRTMIN, which might squash
my theory.

> 
> Maybe this?
> 
> ---
>  kernel/signal.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/signal.c b/kernel/signal.c
> index 1c2dd117fee0..6ee7491de906 100644
> --- a/kernel/signal.c
> +++ b/kernel/signal.c
> @@ -2865,7 +2865,8 @@ static bool known_siginfo_layout(int sig, int si_code)
>         if (si_code == SI_KERNEL)
>                 return true;
>         else if ((si_code > SI_USER)) {
> -               if (sig_specific_sicodes(sig)) {
> +               if (sig < ARRAY_SIZE(sig_sicodes) &&
> +                   sig_specific_sicodes(sig)) {
>                         if (si_code <= sig_sicodes[sig].limit)
>                                 return true;
>                 }