linux-kernel - Re: [PATCH -next] drivers/base/test: fix global-out-of-bounds error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0j5EtDfP4ydVP0jbYytwQ3De5zo+cUUONwYub2Wq2oyqw@mail.gmail.com>
Date:   Tue, 7 Jan 2020 11:42:15 +0100
From:   "Rafael J. Wysocki" <rafael@...nel.org>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>, Qian Cai <cai@....pw>
Cc:     Rafael Wysocki <rafael.j.wysocki@...el.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        ACPI Devel Maling List <linux-acpi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH -next] drivers/base/test: fix global-out-of-bounds error

On Mon, Jan 6, 2020 at 11:35 PM Dmitry Torokhov
<dmitry.torokhov@...il.com> wrote:
>
> On Mon, Jan 06, 2020 at 11:37:35AM -0500, Qian Cai wrote:
> > The commit c032ace71c29 ("software node: add basic tests for property
> > entries") introduced a global-out-of-bounds error because it forgot to
> > add a terminator of "nodes "for software_node_register_nodes() to
> > process.
> >
> >       # Subtest: property-entry
> >       1..7
> >       ok 1 - pe_test_uints
> >       ok 2 - pe_test_uint_arrays
> >       ok 3 - pe_test_strings
> >       ok 4 - pe_test_bool
> >       ok 5 - pe_test_move_inline_u8
> >       ok 6 - pe_test_move_inline_str
> >  ==================================================================
> >  BUG: KASAN: global-out-of-bounds in
> >  software_node_register_nodes+0x41/0x80
> >  Read of size 8 at addr ffffffff989ef250 by task kunit_try_catch/316
> >
> >  CPU: 17 PID: 316 Comm: kunit_try_catch Not tainted
> >  5.5.0-rc4-next-20200106+ #1
> >  Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40
> >  03/09/2018
> >  Call Trace:
> >   dump_stack+0xa0/0xea
> >   print_address_description.constprop.5.cold.7+0x64/0x384
> >   __kasan_report.cold.8+0x7a/0xc0
> >   kasan_report+0x12/0x20
> >   __asan_load8+0x71/0xa0
> >   software_node_register_nodes+0x41/0x80
> >   pe_test_reference+0x1eb/0x1200
> >   kunit_try_run_case+0x6b/0xd1
> >   kunit_generic_run_threadfn_adapter+0x29/0x50
> >   kthread+0x1e6/0x210
> >   ret_from_fork+0x27/0x50
> >
> >  The buggy address belongs to the variable:
> >   nodes.21544+0x30/0x920
> >
> >  Memory state around the buggy address:
> >   ffffffff989ef100: fa fa fa fa 00 04 fa fa fa fa fa fa 00 00 00 00
> >   ffffffff989ef180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> >  >ffffffff989ef200: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa
> >                                                   ^
> >   ffffffff989ef280: 00 06 fa fa fa fa fa fa 00 00 04 fa fa fa fa fa
> >   ffffffff989ef300: 00 00 fa fa fa fa fa fa 00 05 fa fa fa fa fa fa
> >  ==================================================================
> >  Disabling lock debugging due to kernel taint
> >       ok 7 - pe_test_reference
> >  ok 8 - property-entry
> >
> > Fixes: c032ace71c29 ("software node: add basic tests for property entries")
> > Signed-off-by: Qian Cai <cai@....pw>
>
> Thanks Qian.
>
> Reviewed-by: Dmitry Torokhov <dmitry.torokhov@...il.com>

Applied, thanks!

> > ---
> >  drivers/base/test/property-entry-test.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/base/test/property-entry-test.c b/drivers/base/test/property-entry-test.c
> > index da812834b631..abe03315180f 100644
> > --- a/drivers/base/test/property-entry-test.c
> > +++ b/drivers/base/test/property-entry-test.c
> > @@ -366,6 +366,7 @@ static void pe_test_reference(struct kunit *test)
> >       static const struct software_node nodes[] = {
> >               { .name = "1", },
> >               { .name = "2", },
> > +             { }
> >       };
> >
> >       static const struct software_node_ref_args refs[] = {
> > --