linux-kernel - Re: KASAN: slab-out-of-bounds Read in handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a85cee75-99f9-7de3-6e5c-86f9bb41bca5@redhat.com>
Date:   Fri, 13 Sep 2019 23:39:03 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Robin Murphy <robin.murphy@....com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     mark.rutland@....com, x86@...nel.org, wanpengli@...cent.com,
        kvm@...r.kernel.org, narmstrong@...libre.com,
        catalin.marinas@....com, will.deacon@....com, hpa@...or.com,
        khilman@...libre.com, joro@...tes.org, rkrcmar@...hat.com,
        mingo@...hat.com, Dmitry Vyukov <dvyukov@...gle.com>,
        syzbot <syzbot+46f1dd7dbbe2bfb98b10@...kaller.appspotmail.com>,
        devicetree@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        robh+dt@...nel.org, bp@...en8.de,
        linux-amlogic@...ts.infradead.org, tglx@...utronix.de,
        linux-arm-kernel@...ts.infradead.org, jmattson@...gle.com,
        USB list <linux-usb@...r.kernel.org>,
        linux-kernel@...r.kernel.org, sean.j.christopherson@...el.com,
        carlo@...one.org, Vitaly Kuznetsov <vkuznets@...hat.com>
Subject: Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

On 13/09/19 17:32, Robin Murphy wrote:
> Oh, that bit of usbdev_mmap() is already known to be pretty much totally
> bogus for various reasons - there have been a few threads about it, of
> which I think [1] is both the most recent and the most informative.
> There was another patch[2], but that might have stalled (and might need
> reworking with additional hcd_uses_dma() checks anyway).

Neither is enough, see my reply to Alan.  Memory from kmalloc just
*cannot* be passed down to remap_pfn_range, dma_mmap_coherent or
anything like that.  It's a simple alignment issue.

Paolo