linux-kernel - Re: [PATCH -next] drivers/base/test: fix global-out-of-bounds error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200106223500.GG8314@dtor-ws>
Date:   Mon, 6 Jan 2020 14:35:00 -0800
From:   Dmitry Torokhov <dmitry.torokhov@...il.com>
To:     Qian Cai <cai@....pw>
Cc:     rafael.j.wysocki@...el.com, gregkh@...uxfoundation.org,
        linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH -next] drivers/base/test: fix global-out-of-bounds error

On Mon, Jan 06, 2020 at 11:37:35AM -0500, Qian Cai wrote:
> The commit c032ace71c29 ("software node: add basic tests for property
> entries") introduced a global-out-of-bounds error because it forgot to
> add a terminator of "nodes "for software_node_register_nodes() to
> process.
> 
>  	# Subtest: property-entry
>  	1..7
>  	ok 1 - pe_test_uints
>  	ok 2 - pe_test_uint_arrays
>  	ok 3 - pe_test_strings
>  	ok 4 - pe_test_bool
>  	ok 5 - pe_test_move_inline_u8
>  	ok 6 - pe_test_move_inline_str
>  ==================================================================
>  BUG: KASAN: global-out-of-bounds in
>  software_node_register_nodes+0x41/0x80
>  Read of size 8 at addr ffffffff989ef250 by task kunit_try_catch/316
> 
>  CPU: 17 PID: 316 Comm: kunit_try_catch Not tainted
>  5.5.0-rc4-next-20200106+ #1
>  Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40
>  03/09/2018
>  Call Trace:
>   dump_stack+0xa0/0xea
>   print_address_description.constprop.5.cold.7+0x64/0x384
>   __kasan_report.cold.8+0x7a/0xc0
>   kasan_report+0x12/0x20
>   __asan_load8+0x71/0xa0
>   software_node_register_nodes+0x41/0x80
>   pe_test_reference+0x1eb/0x1200
>   kunit_try_run_case+0x6b/0xd1
>   kunit_generic_run_threadfn_adapter+0x29/0x50
>   kthread+0x1e6/0x210
>   ret_from_fork+0x27/0x50
> 
>  The buggy address belongs to the variable:
>   nodes.21544+0x30/0x920
> 
>  Memory state around the buggy address:
>   ffffffff989ef100: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 00 00
>   ffffffff989ef180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>  >ffffffff989ef200: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa
>                                                   ^
>   ffffffff989ef280: 00 06 fa fa fa fa fa fa 00 00 04 fa fa fa fa fa
>   ffffffff989ef300: 00 00 fa fa fa fa fa fa 00 05 fa fa fa fa fa fa
>  ==================================================================
>  Disabling lock debugging due to kernel taint
>  	ok 7 - pe_test_reference
>  ok 8 - property-entry
> 
> Fixes: c032ace71c29 ("software node: add basic tests for property entries")
> Signed-off-by: Qian Cai <cai@....pw>

Thanks Qian.

Reviewed-by: Dmitry Torokhov <dmitry.torokhov@...il.com>

> ---
>  drivers/base/test/property-entry-test.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/base/test/property-entry-test.c b/drivers/base/test/property-entry-test.c
> index da812834b631..abe03315180f 100644
> --- a/drivers/base/test/property-entry-test.c
> +++ b/drivers/base/test/property-entry-test.c
> @@ -366,6 +366,7 @@ static void pe_test_reference(struct kunit *test)
>  	static const struct software_node nodes[] = {
>  		{ .name = "1", },
>  		{ .name = "2", },
> +		{ }
>  	};
>  
>  	static const struct software_node_ref_args refs[] = {
> -- 
> 2.21.0 (Apple Git-122.2)
> 

-- 
Dmitry