linux-kernel - Re: [ACPI] 1d52f10917: BUG:KASAN:use-after-free_in

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YvF3ynw8CmisQAR6@paasikivi.fi.intel.com>
Date:   Mon, 8 Aug 2022 20:53:30 +0000
From:   Sakari Ailus <sakari.ailus@...ux.intel.com>
To:     "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux Memory Management List <linux-mm@...ck.org>,
        linux-acpi@...r.kernel.org, lkp@...ts.01.org, lkp@...el.com,
        kernel test robot <oliver.sang@...el.com>
Subject: Re: [ACPI] 1d52f10917: BUG:KASAN:use-after-free_in_strlen

Hi Rafael,

On Mon, Aug 08, 2022 at 06:54:49PM +0200, Rafael J. Wysocki wrote:
> Hi Sakari,
> 
> On 8/7/2022 2:45 PM, kernel test robot wrote:
> > 
> > Greeting,
> > 
> > FYI, we noticed the following commit (built with gcc-11):
> > 
> > commit: 1d52f10917a751f90e269a0ed9b6cca60dbe0300 ("ACPI: property: Tie data nodes to acpi handles")
> > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
> > 
> > in testcase: xsave-test
> > version: xsave-test-x86_64-c2e44fa-1_20220609
> > with following parameters:
> > 
> > 	ucode: 0xec
> > 
> > 
> > 
> > on test machine: 12 threads 1 sockets Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz with 16G memory
> > 
> > caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
> > 
> > 
> > 
> > If you fix the issue, kindly add following tag
> > Reported-by: kernel test robot <oliver.sang@...el.com>
> 
> The crash below occurs right after a "Can't tag data node" message from
> acpi_tie_nondev_subnodes() and I'm really unsure why acpi_attach_data() has
> failed here, because none of the arguments is NULL.
> 
> Can you have a look at this, please?

Thanks for forwarding this to me.

Faulty error handling code appears to be the direct cause for the crash. It
releases buf.pointer which was still being used by the properties --- even
if tagging data nodes failed (for whatever reason).

It'd be cool if someone could send me DSDT/SSDT from this machine. I wonder
if there's a data node that is referred to from more than one location, and
whether that could lead to two references to the same acpi_handle. I'd hope
this could be disallowed in DSD Guide.

I'll send a patch soon.

-- 
Kind regards,

Sakari Ailus