linux-kernel - Re: KASAN: slab-out-of-bounds Read in handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <462660f4-1537-cece-b55f-0ceba0269eb8@arm.com>
Date:   Fri, 13 Sep 2019 16:32:48 +0100
From:   Robin Murphy <robin.murphy@....com>
To:     Paolo Bonzini <pbonzini@...hat.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     mark.rutland@....com, x86@...nel.org, wanpengli@...cent.com,
        kvm@...r.kernel.org, narmstrong@...libre.com,
        catalin.marinas@....com, will.deacon@....com, hpa@...or.com,
        khilman@...libre.com, joro@...tes.org, rkrcmar@...hat.com,
        mingo@...hat.com, Dmitry Vyukov <dvyukov@...gle.com>,
        syzbot <syzbot+46f1dd7dbbe2bfb98b10@...kaller.appspotmail.com>,
        devicetree@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        robh+dt@...nel.org, bp@...en8.de,
        linux-amlogic@...ts.infradead.org, tglx@...utronix.de,
        linux-arm-kernel@...ts.infradead.org, jmattson@...gle.com,
        USB list <linux-usb@...r.kernel.org>,
        linux-kernel@...r.kernel.org, sean.j.christopherson@...el.com,
        carlo@...one.org, Vitaly Kuznetsov <vkuznets@...hat.com>
Subject: Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

On 13/09/2019 16:01, Paolo Bonzini wrote:
> On 13/09/19 15:02, Greg Kroah-Hartman wrote:
>> Look at linux-next, we "should" have fixed up hcd_buffer_alloc() now to
>> not need this type of thing.  If we got it wrong, please let us know and
>> then yes, a fix like this would be most appreciated :)
> 
> I still see
> 
> 	/* some USB hosts just use PIO */
> 	if (!hcd_uses_dma(hcd)) {
> 		*dma = ~(dma_addr_t) 0;
> 		return kmalloc(size, mem_flags);
> 	}
> 
> in linux-next's hcd_buffer_alloc and also in usb.git's usb-next branch.
>   I also see the same
> 
> 	if (remap_pfn_range(vma, vma->vm_start,
> 			virt_to_phys(usbm->mem) >> PAGE_SHIFT,
> 			size, vma->vm_page_prot) < 0) {
> 		...
> 	}
> 
> in usbdev_mmap.  Of course it's possible that I'm looking at the wrong
> branch, or just being dense.

Oh, that bit of usbdev_mmap() is already known to be pretty much totally 
bogus for various reasons - there have been a few threads about it, of 
which I think [1] is both the most recent and the most informative. 
There was another patch[2], but that might have stalled (and might need 
reworking with additional hcd_uses_dma() checks anyway).

Robin.

[1] 
https://lore.kernel.org/linux-arm-kernel/20190808084636.GB15080@priv-mua.localdomain/
[2] 
https://lore.kernel.org/linux-usb/20190801220134.3295-1-gavinli@thegavinli.com/