linux-kernel - [PATCH -next] drivers/base/test: fix global-out-of-bounds error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200106163735.1826-1-cai@lca.pw>
Date:   Mon,  6 Jan 2020 11:37:35 -0500
From:   Qian Cai <cai@....pw>
To:     rafael.j.wysocki@...el.com
Cc:     dmitry.torokhov@...il.com, gregkh@...uxfoundation.org,
        linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org,
        Qian Cai <cai@....pw>
Subject: [PATCH -next] drivers/base/test: fix global-out-of-bounds error

The commit c032ace71c29 ("software node: add basic tests for property
entries") introduced a global-out-of-bounds error because it forgot to
add a terminator of "nodes "for software_node_register_nodes() to
process.

 	# Subtest: property-entry
 	1..7
 	ok 1 - pe_test_uints
 	ok 2 - pe_test_uint_arrays
 	ok 3 - pe_test_strings
 	ok 4 - pe_test_bool
 	ok 5 - pe_test_move_inline_u8
 	ok 6 - pe_test_move_inline_str
 ==================================================================
 BUG: KASAN: global-out-of-bounds in
 software_node_register_nodes+0x41/0x80
 Read of size 8 at addr ffffffff989ef250 by task kunit_try_catch/316

 CPU: 17 PID: 316 Comm: kunit_try_catch Not tainted
 5.5.0-rc4-next-20200106+ #1
 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40
 03/09/2018
 Call Trace:
  dump_stack+0xa0/0xea
  print_address_description.constprop.5.cold.7+0x64/0x384
  __kasan_report.cold.8+0x7a/0xc0
  kasan_report+0x12/0x20
  __asan_load8+0x71/0xa0
  software_node_register_nodes+0x41/0x80
  pe_test_reference+0x1eb/0x1200
  kunit_try_run_case+0x6b/0xd1
  kunit_generic_run_threadfn_adapter+0x29/0x50
  kthread+0x1e6/0x210
  ret_from_fork+0x27/0x50

 The buggy address belongs to the variable:
  nodes.21544+0x30/0x920

 Memory state around the buggy address:
  ffffffff989ef100: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 00 00
  ffffffff989ef180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 >ffffffff989ef200: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa
                                                  ^
  ffffffff989ef280: 00 06 fa fa fa fa fa fa 00 00 04 fa fa fa fa fa
  ffffffff989ef300: 00 00 fa fa fa fa fa fa 00 05 fa fa fa fa fa fa
 ==================================================================
 Disabling lock debugging due to kernel taint
 	ok 7 - pe_test_reference
 ok 8 - property-entry

Fixes: c032ace71c29 ("software node: add basic tests for property entries")
Signed-off-by: Qian Cai <cai@....pw>
---
 drivers/base/test/property-entry-test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/base/test/property-entry-test.c b/drivers/base/test/property-entry-test.c
index da812834b631..abe03315180f 100644
--- a/drivers/base/test/property-entry-test.c
+++ b/drivers/base/test/property-entry-test.c
@@ -366,6 +366,7 @@ static void pe_test_reference(struct kunit *test)
 	static const struct software_node nodes[] = {
 		{ .name = "1", },
 		{ .name = "2", },
+		{ }
 	};
 
 	static const struct software_node_ref_args refs[] = {
-- 
2.21.0 (Apple Git-122.2)