linux-kernel - Re: [gcov] 1391efa952: BUG:KASAN:slab-out-of-bounds_in_gcov_info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d4e9d61034eb6dd3afccc3d30e995ff89701e3b4.camel@sipsolutions.net>
Date:   Thu, 25 Nov 2021 21:42:47 +0100
From:   Johannes Berg <johannes@...solutions.net>
To:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg Hackmann <ghackmann@...roid.com>,
        Tri Vo <trong@...roid.com>,
        Peter Oberparleiter <oberpar@...ux.ibm.com>
Cc:     "Sang, Oliver" <oliver.sang@...el.com>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        "lkp@...ts.01.org" <lkp@...ts.01.org>, lkp <lkp@...el.com>
Subject: Re: [gcov] 1391efa952: BUG:KASAN:slab-out-of-bounds_in_gcov_info_add

On Thu, 2021-11-25 at 09:48 -0800, Linus Torvalds wrote:
> 
> The report isn't wonderful (the KASAN report is garbled, and the "code
> disassembly" is not from the actual KASAN report, it's from the return
> to user space code), but it blames a 8-byte read at
> 
>     gcov_info_add (kernel/gcov/clang.c:328)
> 
> which in that kernel version (1391efa952e8) is that
> 
>         for (i = 0; i < sfn_ptr->num_counters; i++)
> ->              dfn_ptr->counters[i] += sfn_ptr->counters[i];
> 
> and so it looks like that 'sfn_ptr->counters[i]' access is the problem case.
> 

Not sure. Note the +=, so it has to read both sides first. Would KASAN
report the follow-up write as well?

The loop is going to sfn_ptr->num_counters, so that seems less likely to
get confused, unless clang has a bug, which is where the original
counters and num_counters comes from, afaict?

I mean, we seem to always consistently allocate counters from
num_counters for these things, but here we use sfn_ptr and dfn_ptr, and
the loop checks only dfn_ptr. Just being suspicious I guess, but I
really don't know anything about this. All I know that vmalloc made this
really slow on ARCH=um and so I converted all of this ... :)

johannes