lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Wed, 5 Aug 2020 08:20:15 +0800
From:   kernel test robot <lkp@...el.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, LKP <lkp@...ts.01.org>
Subject: ed66f991bb ("module: Refactor section attr into bin attribute"): [
   70.645135] BUG: KASAN: slab-out-of-bounds in vsnprintf

Greetings,

0day kernel testing robot got the below dmesg and the first bad commit is

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

commit ed66f991bb19d94cae5d38f77de81f96aac7813f
Author:     Kees Cook <keescook@...omium.org>
AuthorDate: Thu Jul 2 13:47:20 2020 -0700
Commit:     Kees Cook <keescook@...omium.org>
CommitDate: Wed Jul 8 16:00:17 2020 -0700

    module: Refactor section attr into bin attribute
    
    In order to gain access to the open file's f_cred for kallsym visibility
    permission checks, refactor the module section attributes to use the
    bin_attribute instead of attribute interface. Additionally removes the
    redundant "name" struct member.
    
    Cc: stable@...r.kernel.org
    Reviewed-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
    Tested-by: Jessica Yu <jeyu@...nel.org>
    Acked-by: Jessica Yu <jeyu@...nel.org>
    Signed-off-by: Kees Cook <keescook@...omium.org>

160251842c  kallsyms: Refactor kallsyms_show_value() to take cred
ed66f991bb  module: Refactor section attr into bin attribute
c0842fbc1b  random32: move the pseudo-random 32-bit definitions to prandom.h
+-----------------------------------+------------+------------+------------+
|                                   | 160251842c | ed66f991bb | c0842fbc1b |
+-----------------------------------+------------+------------+------------+
| boot_successes                    | 642        | 200        | 30         |
| boot_failures                     | 9          | 20         | 2          |
| BUG:kernel_hang_in_test_stage     | 2          |            |            |
| BUG:kernel_hang_in_boot_stage     | 7          | 1          |            |
| BUG:KASAN:slab-out-of-bounds_in_n | 0          | 5          | 1          |
| BUG:KASAN:slab-out-of-bounds_in_v | 0          | 14         | 1          |
+-----------------------------------+------------+------------+------------+

If you fix the issue, kindly add following tag
Reported-by: kernel test robot <lkp@...el.com>

[   64.103075] trinity-c0 (1011): attempted to duplicate a private mapping with mremap.  This is not supported.
[   64.300797] Lockdown: trinity-c0: unsafe use of perf is restricted; see man kernel_lockdown.7
[   65.342888] Unable to find swap-space signature
[main] 10730 iterations. [F:7458 S:3194 HI:3556]
[   70.643757] ==================================================================
[   70.645135] BUG: KASAN: slab-out-of-bounds in vsnprintf+0xa75/0x1e70
[   70.646293] Write of size 2 at addr ffff888358c37e80 by task trinity-c2/1318
[   70.647661] 
[   70.647974] CPU: 0 PID: 1318 Comm: trinity-c2 Not tainted 5.8.0-rc2-00002-ged66f991bb19d #1
[   70.649549] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[   70.651118] Call Trace:
[   70.651761]  dump_stack+0x35/0x50
[   70.652419]  print_address_description+0x2f/0x360
[   70.653490]  ? stack_trace_save+0x96/0xd0
[   70.654239]  ? stack_trace_snprint+0x120/0x120
[   70.655066]  ? vsnprintf+0xa75/0x1e70
[   70.687351]  kasan_report.cold+0xba/0x17e
[   70.688142]  ? vsnprintf+0xa75/0x1e70
[   70.688855]  check_memory_region+0x2b2/0x300
[   70.689687]  memcpy+0x5c/0xa0
[   70.690287]  vsnprintf+0xa75/0x1e70
[   70.690959]  ? pointer+0x8b0/0x8b0
[   70.691736]  sprintf+0xb6/0xf0
[   70.692329]  ? va_format+0x1b0/0x1b0
[   70.693117]  ? prep_new_page+0xa1/0x450
[   70.693836]  ? __might_sleep+0xab/0x1e0
[   70.694586]  module_sect_read+0x64/0xc0
[   70.695324]  sysfs_kf_bin_read+0x15a/0x310
[   70.696093]  kernfs_file_direct_read+0x213/0x4e0
[   70.696935]  kernfs_fop_read+0xd9/0x180
[   70.697650]  do_loop_readv_writev+0xda/0x320
[   70.698440]  do_iter_read+0x2af/0x3a0
[   70.699147]  vfs_readv+0xe1/0x160
[   70.699848]  ? compat_rw_copy_check_uvector+0x550/0x550
[   70.700810]  ? push_pipe+0x283/0x7a0
[   70.701457]  ? iov_iter_get_pages_alloc+0xc82/0x16a0
[   70.702364]  ? iov_iter_pipe+0x300/0x300
[   70.703092]  ? find_get_entry+0x18c/0x3a0
[   70.703850]  ? __lock_page_or_retry+0x360/0x360
[   70.704686]  default_file_splice_read+0x532/0x9f0
[   70.705653]  ? iter_file_splice_write+0xca0/0xca0
[   70.706514]  ? __kasan_check_read+0x21/0x30
[   70.707304]  ? __module_text_address+0x1b/0x1a0
[   70.708156]  ? __kasan_check_read+0x21/0x30
[   70.708929]  ? __fsnotify_update_child_dentry_flags+0x2e0/0x2e0
[   70.710004]  ? __kasan_check_write+0x24/0x30
[   70.710806]  ? __fsnotify_inode_delete+0x30/0x30
[   70.711682]  ? security_file_permission+0x1fb/0x530
[   70.712586]  ? rw_verify_area+0xc8/0x350
[   70.713316]  do_splice_to+0x126/0x1a0
[   70.714009]  splice_direct_to_actor+0x2d7/0xa00
[   70.714830]  ? __generic_file_write_iter+0x363/0x610
[   70.715771]  ? do_splice_from+0x140/0x140
[   70.716522]  ? do_splice_to+0x1a0/0x1a0
[   70.717242]  ? rw_verify_area+0xc8/0x350
[   70.717952]  do_splice_direct+0x16e/0x2e0
[   70.718708]  ? new_sync_write+0x3a4/0x6f0
[   70.723643]  ? splice_direct_to_actor+0xa00/0xa00
[   70.724557]  ? __might_sleep+0xab/0x1e0
[   70.725304]  ? rw_verify_area+0xc8/0x350
[   70.726071]  do_sendfile+0x478/0xe30
[   70.726771]  ? __x64_sys_copy_file_range+0x560/0x560
[   70.727824]  ? __might_sleep+0xab/0x1e0
[   70.728667]  ? __kasan_check_write+0x24/0x30
[   70.729631]  __x64_sys_sendfile64+0x145/0x250
[   70.730560]  ? __x32_compat_sys_sendfile+0x250/0x250
[   70.731694]  ? __prepare_exit_to_usermode+0xa8/0x2d0
[   70.732919]  do_syscall_64+0x6d/0x290
[   70.733856]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   70.735137] RIP: 0033:0x457729
[   70.735882] Code: Bad RIP value.
[   70.736662] RSP: 002b:00007ffd0e5de6c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[   70.738494] RAX: ffffffffffffffda RBX: 0000000000000028 RCX: 0000000000457729
[   70.740255] RDX: 0000000000000001 RSI: 000000000000003d RDI: 000000000000011c
[   70.742031] RBP: 00007ffd0e5de770 R08: 00000000000000dd R09: 000000000000ff47
[   70.743729] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002
[   70.745081] R13: 00007fb7e7ab4058 R14: 0000000001057830 R15: 00007fb7e7ab4000
[   70.746414] 
[   70.746746] Allocated by task 1318:
[   70.747461]  save_stack+0x2b/0x70
[   70.748126]  __kasan_kmalloc+0x111/0x120
[   70.749086]  kasan_kmalloc+0x11/0x20
[   70.749796]  __kmalloc+0x196/0x300
[   70.750470]  kernfs_file_direct_read+0x368/0x4e0
[   70.755459]  kernfs_fop_read+0xd9/0x180
[   70.756218]  do_loop_readv_writev+0xda/0x320
[   70.757045]  do_iter_read+0x2af/0x3a0
[   70.757760]  vfs_readv+0xe1/0x160
[   70.758417]  default_file_splice_read+0x532/0x9f0
[   70.759441]  do_splice_to+0x126/0x1a0
[   70.760165]  splice_direct_to_actor+0x2d7/0xa00
[   70.761060]  do_splice_direct+0x16e/0x2e0
[   70.761812]  do_sendfile+0x478/0xe30
[   70.762511]  __x64_sys_sendfile64+0x145/0x250
[   70.763372]  do_syscall_64+0x6d/0x290
[   70.764092]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   70.765050] 
[   70.765375] Freed by task 0:
[   70.765918] (stack is not available)
[   70.766610] 

                                                          # HH:MM RESULT GOOD BAD GOOD_BUT_DIRTY DIRTY_NOT_BAD
git bisect start d9ad7006330c4d6ce3d7369ed85f9404a6629dba v5.7 --
git bisect good 44ebe016df3aad96e3be8f95ec52397728dd7701  # 13:58  G    212     0    1   1  Merge branch 'proc-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
git bisect good 2cfa46dadd203eef88cc70131df7a81ebc34b8ff  # 15:42  G    212     0    1   1  Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
git bisect  bad cb24c61b53c3f47d4ba596fe37076202f7189676  # 16:02  B      0     1   17   0  Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
git bisect good 9bc0b029a8889f2c67c988760aba66a8d7b22af5  # 16:32  G    212     0    0   0  Merge tag 'powerpc-5.8-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
git bisect good a6bc851ffe0b246ab4f8aa0d01620fbc08d0441f  # 17:52  G    213     0    1   1  Merge tag 'tpmdd-next-v5.8-rc5' of git://git.infradead.org/users/jjs/linux-tpmdd
git bisect good 0bddd227f3dc55975e2b8dfa7fc6f959b062a2c7  # 18:28  G    216     0    1   1  Documentation: update for gcc 4.9 requirement
git bisect  bad 355a3587d4ca09f2b1014778a7c8908351a91468  # 18:52  B     13     1    1   1  kbuild: Move -Wtype-limits to W=2
git bisect  bad ce69fb3b392fbfd6c255aeb0ee371652478c716f  # 19:23  B     11     2    1   1  Merge tag 'kallsyms_show_value-v5.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
git bisect  bad b25a7c5af9051850d4f3d93ca500056ab6ec724b  # 19:47  B      3     2    0   0  module: Do not expose section addresses to non-CAP_SYSLOG
git bisect  bad ed66f991bb19d94cae5d38f77de81f96aac7813f  # 20:15  B     15     1    0   0  module: Refactor section attr into bin attribute
git bisect good 160251842cd35a75edfb0a1d76afa3eb674ff40a  # 22:02  G    211     0    2   2  kallsyms: Refactor kallsyms_show_value() to take cred
# first bad commit: [ed66f991bb19d94cae5d38f77de81f96aac7813f] module: Refactor section attr into bin attribute
git bisect good 160251842cd35a75edfb0a1d76afa3eb674ff40a  # 23:22  G    632     0    7   9  kallsyms: Refactor kallsyms_show_value() to take cred
# extra tests with debug options
git bisect  bad ed66f991bb19d94cae5d38f77de81f96aac7813f  # 23:56  B     34     1    0   0  module: Refactor section attr into bin attribute
# extra tests on head commit of linus/master
git bisect  bad c0842fbc1b18c7a044e6ff3e8fa78bfa822c7d1a  # 01:15  B     30     1    1   1  random32: move the pseudo-random 32-bit definitions to prandom.h
# bad: [c0842fbc1b18c7a044e6ff3e8fa78bfa822c7d1a] random32: move the pseudo-random 32-bit definitions to prandom.h
# extra tests on linus/master
# duplicated: [c0842fbc1b18c7a044e6ff3e8fa78bfa822c7d1a] random32: move the pseudo-random 32-bit definitions to prandom.h
# extra tests on linux-next/master
# 119: [1cfc1dba44c2b62b2856bf23624116eea9cd5627] Add linux-next specific files for 20200804

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/lkp@lists.01.org

Download attachment "dmesg-yocto-vm-yocto-41:20200804201519:x86_64-randconfig-a004-20200730:5.8.0-rc2-00002-ged66f991bb19d:1.gz" of type "application/gzip" (24159 bytes)

Download attachment "dmesg-yocto-vm-yocto-22:20200804224700:x86_64-randconfig-a004-20200730:5.8.0-rc2-00001-g160251842cd35:1.gz" of type "application/gzip" (19900 bytes)

View attachment "reproduce-yocto-vm-yocto-41:20200804201519:x86_64-randconfig-a004-20200730:5.8.0-rc2-00002-ged66f991bb19d:1" of type "text/plain" (1191 bytes)

Download attachment "3eeb076bed98a9c2f180dd8c9adc82e2efd41f5a:gcc-9:x86_64-randconfig-a004-20200730:BUG:KASAN:slab-out-of-bounds_in_v.xz" of type "application/x-xz" (13828 bytes)

View attachment "config-5.8.0-rc2-00002-ged66f991bb19d" of type "text/plain" (137381 bytes)

Powered by blists - more mailing lists