linux-kernel - Re: KASAN: global-out-of-bounds in console

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200928151911.GA964@home.goodmis.org>
Date:   Mon, 28 Sep 2020 11:19:11 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Petr Mladek <pmladek@...e.com>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: KASAN: global-out-of-bounds in console_unlock

On Sun, Sep 27, 2020 at 11:12:23AM +0200, Dmitry Vyukov wrote:
> Hi printk maintainers,
> 
> I've got the following out-of-bounds in printk code.
> This is on next-20200925. Config is attached.
> This is just on pr_cont("\n"). Something overreads the string.
> 
> ==================================================================
> BUG: KASAN: global-out-of-bounds in memchr+0x65/0x80 lib/string.c:1058
> Read of size 1 at addr ffffffff8c68c860 by task swapper/0/0

Would be helpful to show the text before this, so we have a better idea of
where it happened.

-- Steve


> 
> CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.9.0-rc6-next-20200925+ #43
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
> Call Trace:
>  <IRQ>
>  __dump_stack lib/dump_stack.c:77 [inline]
>  dump_stack+0x14b/0x18f lib/dump_stack.c:118
>  print_address_description.constprop.0.cold+0x5/0x4c5 mm/kasan/report.c:385
>  __kasan_report mm/kasan/report.c:545 [inline]
>  kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
>  memchr+0x65/0x80 lib/string.c:1058
>  memchr include/linux/string.h:450 [inline]
>  record_print_text+0x22d/0x310 kernel/printk/printk.c:1369
>  console_unlock+0x350/0xbc0 kernel/printk/printk.c:2477
>  vprintk_emit+0x348/0x4b0 kernel/printk/printk.c:2021
>  vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393
>  printk+0xba/0xed kernel/printk/printk.c:2069
>  show_pwq+0x74d/0x7ee kernel/workqueue.c:4745
>  show_workqueue_state.cold+0xd0/0x3c9 kernel/workqueue.c:4784
>  wq_watchdog_timer_fn+0x2e5/0x370 kernel/workqueue.c:5798
>  call_timer_fn+0x38/0x2d0 kernel/time/timer.c:1413
>  expire_timers kernel/time/timer.c:1458 [inline]
>  __run_timers kernel/time/timer.c:1755 [inline]
>  __run_timers kernel/time/timer.c:1731 [inline]
>  run_timer_softirq+0xad2/0x1440 kernel/time/timer.c:1770
>  __do_softirq+0x1f0/0x6c4 kernel/softirq.c:298
>  asm_call_irq_on_stack+0xf/0x20