linux-kernel - [PATCH 0/3] KASAN fix for arch_dup_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241217202745.1402932-1-benjamin@sipsolutions.net>
Date: Tue, 17 Dec 2024 21:27:42 +0100
From: Benjamin Berg <benjamin@...solutions.net>
To: linux-arch@...r.kernel.org,
	linux-um@...ts.infradead.org,
	x86@...nel.org,
	briannorris@...omium.org
Cc: linux-kernel@...r.kernel.org,
	kasan-dev@...glegroups.com,
	Benjamin Berg <benjamin.berg@...el.com>
Subject: [PATCH 0/3] KASAN fix for arch_dup_task_struct (x86, um)

From: Benjamin Berg <benjamin.berg@...el.com>

On the x86 and um architectures struct task_struct is dynamically
sized depending on the size required to store the floating point
registers. After adding this feature to UML it sometimes triggered
KASAN errors as the memcpy in arch_dup_task_struct read past
init_task.

In my own testing, the reported KASAN error was for a read into the
redzone of the next global variable (init_sighand). Due to padding,
the reported area was already far past the size of init_task.

Note that on x86 the dynamically allocated area of struct task_struct
is quite a bit smaller and may not even exist. This might explain why
this error has not been noticed before.

This problem was reported by Brian Norris <briannorris@...omium.org>.

Benjamin

Benjamin Berg (3):
  vmlinux.lds.h: remove entry to place init_task onto init_stack
  um: avoid copying FP state from init_task
  x86: avoid copying dynamic FP state from init_task

 arch/um/kernel/process.c          | 10 +++++++++-
 arch/x86/kernel/process.c         | 10 +++++++++-
 include/asm-generic/vmlinux.lds.h |  1 -
 3 files changed, 18 insertions(+), 3 deletions(-)

-- 
2.47.1