linux-kernel - Re: KASAN Arm: global-out-of-bounds in load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+Z7bD62SkYGQH2tXV0Zx2MFojYoZzA2R+4J-CrXa6siMw@mail.gmail.com>
Date:   Mon, 29 Nov 2021 07:37:39 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Miguel Ojeda <miguel.ojeda.sandonis@...il.com>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>
Cc:     kasan-dev <kasan-dev@...glegroups.com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Linus Walleij <linus.walleij@...aro.org>,
        Ard Biesheuvel <ardb@...nel.org>,
        Florian Fainelli <f.fainelli@...il.com>,
        Ahmad Fatoum <a.fatoum@...gutronix.de>
Subject: Re: KASAN Arm: global-out-of-bounds in load_module

On Sun, 28 Nov 2021 at 01:43, Miguel Ojeda
<miguel.ojeda.sandonis@...il.com> wrote:
>
> Hi KASAN / Arm folks,
>
> I noticed in our CI that inserting and removing a module, and then
> inserting it again, e.g.:
>
>     insmod bcm2835_thermal.ko
>     rmmod bcm2835_thermal.ko
>     insmod bcm2835_thermal.ko
>
> deterministically triggers the report below in v5.16-rc2. I also tried
> it on v5.12 to see if it was a recent thing, but same story.
>
> I could find this other report from May, which may be related:
> https://lore.kernel.org/lkml/20210510202653.gjvqsxacw3hcxfvr@pengutronix.de/
>
> Cheers,
> Miguel

HI Miguel,

0xf9 is redzone for global variables:
#define KASAN_GLOBAL_REDZONE    0xF9  /* redzone for global variable */

I would assume this is caused by not clearing shadow of unloaded
modules, so that the next module loaded hits these leftover redzones.

+arm mailing list and Linus W


> BUG: KASAN: global-out-of-bounds in load_module+0x1b98/0x33b0
> Write of size 16384 at addr bf000000 by task busybox/17
>
> CPU: 0 PID: 17 Comm: busybox Not tainted 5.15.0 #7
> Hardware name: Generic DT based system
> [<c010f968>] (unwind_backtrace) from [<c010c6f8>] (show_stack+0x10/0x14)
> [<c010c6f8>] (show_stack) from [<c0210734>]
> (print_address_description+0x58/0x384)
> [<c0210734>] (print_address_description) from [<c0210cc8>]
> (kasan_report+0x168/0x1fc)
> [<c0210cc8>] (kasan_report) from [<c0211230>] (kasan_check_range+0x260/0x2a8)
> [<c0211230>] (kasan_check_range) from [<c0211c68>] (memset+0x20/0x44)
> [<c0211c68>] (memset) from [<c019d21c>] (load_module+0x1b98/0x33b0)
> [<c019d21c>] (load_module) from [<c0199f88>] (sys_init_module+0x198/0x1ac)
> [<c0199f88>] (sys_init_module) from [<c0100060>] (ret_fast_syscall+0x0/0x48)
> Exception stack(0xc113ffa8 to 0xc113fff0)
> ffa0:                   00000000 00002a98 00098038 00002a98 00081483 00093f88
> ffc0: 00000000 00002a98 00000000 00000080 00000001 b66ffef0 00081483 000815c7
> ffe0: b66ffbd8 b66ffbc8 000207f5 00011cc2
>
>
> Memory state around the buggy address:
>  bf001200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>  bf001280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> >bf001300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
>                                                      ^
>  bf001380: 00 00 07 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
>  bf001400: 00 00 f9 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9
>
> --
> You received this message because you are subscribed to the Google Groups "kasan-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to kasan-dev+unsubscribe@...glegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/kasan-dev/CANiq72kGS0JzFkuUS9oN2_HU9f_stm1gA8v79o2pUCb7bNSe0A%40mail.gmail.com.