linux-kernel - KASAN: global-out-of-bounds in console

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+a8yAm2HFJkz+pgYDm4QV+5S8K5FH3wVn4e8kgbMzcXdg@mail.gmail.com>
Date:   Sun, 27 Sep 2020 11:12:23 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Petr Mladek <pmladek@...e.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: KASAN: global-out-of-bounds in console_unlock

Hi printk maintainers,

I've got the following out-of-bounds in printk code.
This is on next-20200925. Config is attached.
This is just on pr_cont("\n"). Something overreads the string.

==================================================================
BUG: KASAN: global-out-of-bounds in memchr+0x65/0x80 lib/string.c:1058
Read of size 1 at addr ffffffff8c68c860 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.9.0-rc6-next-20200925+ #43
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x14b/0x18f lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x4c5 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
 memchr+0x65/0x80 lib/string.c:1058
 memchr include/linux/string.h:450 [inline]
 record_print_text+0x22d/0x310 kernel/printk/printk.c:1369
 console_unlock+0x350/0xbc0 kernel/printk/printk.c:2477
 vprintk_emit+0x348/0x4b0 kernel/printk/printk.c:2021
 vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393
 printk+0xba/0xed kernel/printk/printk.c:2069
 show_pwq+0x74d/0x7ee kernel/workqueue.c:4745
 show_workqueue_state.cold+0xd0/0x3c9 kernel/workqueue.c:4784
 wq_watchdog_timer_fn+0x2e5/0x370 kernel/workqueue.c:5798
 call_timer_fn+0x38/0x2d0 kernel/time/timer.c:1413
 expire_timers kernel/time/timer.c:1458 [inline]
 __run_timers kernel/time/timer.c:1755 [inline]
 __run_timers kernel/time/timer.c:1731 [inline]
 run_timer_softirq+0xad2/0x1440 kernel/time/timer.c:1770
 __do_softirq+0x1f0/0x6c4 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x58/0x70 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x137/0x170 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x34/0xb0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Code: ff cc cc cc cc cc cc cc cc cc cc cc e9 07 00 00 00 0f 00 2d b4
9f 5e 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d a4 9f 5e 00 fb f4 <c3> cc
41 54 55 53 e8 57 b5 fd ff 0f 1f 44 00 00 e8 ed 88 72 f9 48
RSP: 0018:ffffffff89a07e20 EFLAGS: 00000282
RAX: 1ffffffff136c688 RBX: ffffffff89a3bc40 RCX: ffffffff87e7dae8
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffed100dd469e9
R10: ffff88806ea34f43 R11: ffffed100dd469e8 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff8b15e748 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:150 [inline]
 default_idle+0x2a/0x40 arch/x86/kernel/process.c:688
 default_idle_call+0x9c/0x280 kernel/sched/idle.c:98
 cpuidle_idle_call kernel/sched/idle.c:168 [inline]
 do_idle+0x3b5/0x690 kernel/sched/idle.c:273
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:369
 start_kernel+0x435/0x456 init/main.c:1049
 secondary_startup_64_no_verify+0xa6/0xab

The buggy address belongs to the variable:
 text.49461+0x400/0x420

Memory state around the buggy address:
 ffffffff8c68c700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff8c68c780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff8c68c800: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
                                                       ^
 ffffffff8c68c880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff8c68c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Download attachment ".config" of type "application/octet-stream" (180467 bytes)