From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=v4Jy=3B=vger.kernel.org=netdev-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,
	HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,
	SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 6B21AC32771
	for <netdev@archiver.kernel.org>; Sun, 12 Jan 2020 13:47:37 +0000 (UTC)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by mail.kernel.org (Postfix) with ESMTP id 071742084D
	for <netdev@archiver.kernel.org>; Sun, 12 Jan 2020 13:47:37 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=wp.pl header.i=@wp.pl header.b="V1tEhCI6"
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1732939AbgALNrg (ORCPT <rfc822;netdev@archiver.kernel.org>);
        Sun, 12 Jan 2020 08:47:36 -0500
Received: from mx3.wp.pl ([212.77.101.9]:18663 "EHLO mx3.wp.pl"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1732921AbgALNrf (ORCPT <rfc822;netdev@vger.kernel.org>);
        Sun, 12 Jan 2020 08:47:35 -0500
Received: (wp-smtpd smtp.wp.pl 26130 invoked from network); 12 Jan 2020 14:47:31 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wp.pl; s=1024a;
          t=1578836851; bh=WYqpIdicSPVhDWKCKda5FFj7FxnC192DoYoKxwaLnXI=;
          h=From:To:Cc:Subject;
          b=V1tEhCI6472X6nhKIXMFbRaBiG9Lk4u8wex0Rtj/OBgMsdOcPz+v0J8GqP71iM+cX
           lHElg3NjTyWDFdyARlmdUXmNEdepUkq86oFuVdw3XmcHriYlLPpDQbJnGEVIIdIZCe
           jTB2GqCWCtb8Rsu8GcqxoCWaR42Z7+A/ZSTECfLc=
Received: from c-73-93-4-247.hsd1.ca.comcast.net (HELO cakuba) (kubakici@wp.pl@[73.93.4.247])
          (envelope-sender <kubakici@wp.pl>)
          by smtp.wp.pl (WP-SMTPD) with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP
          for <ap420073@gmail.com>; 12 Jan 2020 14:47:31 +0100
Date:   Sun, 12 Jan 2020 05:47:25 -0800
From:   Jakub Kicinski <kubakici@wp.pl>
To:     Taehee Yoo <ap420073@gmail.com>
Cc:     davem@davemloft.net, netdev@vger.kernel.org
Subject: Re: [PATCH net 2/5] netdevsim: fix stack-out-of-bounds in
 nsim_dev_debugfs_init()
Message-ID: <20200112054725.7a8e6074@cakuba>
In-Reply-To: <20200111163709.4181-1-ap420073@gmail.com>
References: <20200111163709.4181-1-ap420073@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-WP-MailID: 0e8b98beda5aa2f877c35e9cce8f99de
X-WP-AV: skaner antywirusowy Poczty Wirtualnej Polski
X-WP-SPAM: NO 0000000 [ATMk]                               
Sender: netdev-owner@vger.kernel.org
Precedence: bulk
List-ID: <netdev.vger.kernel.org>
X-Mailing-List: netdev@vger.kernel.org

On Sat, 11 Jan 2020 16:37:09 +0000, Taehee Yoo wrote:
> When netdevsim dev is being created, a debugfs directory is created.
> The variable "dev_ddir_name" is 16bytes device name pointer and device
> name is "netdevsim<dev id>".
> The maximum dev id length is 10.
> So, 16bytes for device name isn't enough.
> 
> Test commands:
>     modprobe netdevsim
>     echo "1000000000 0" > /sys/bus/netdevsim/new_device
> 
> Splat looks like:
> [   90.624922][ T1000] BUG: KASAN: stack-out-of-bounds in number+0x824/0x880
> [   90.626999][ T1000] Write of size 1 at addr ffff8880b7f47988 by task bash/1000
> [   90.627798][ T1000]
> [   90.628076][ T1000] CPU: 0 PID: 1000 Comm: bash Not tainted 5.5.0-rc5+ #270
> [   90.628806][ T1000] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
> [   90.629752][ T1000] Call Trace:
> [   90.630080][ T1000]  dump_stack+0x96/0xdb
> [   90.630512][ T1000]  ? number+0x824/0x880
> [   90.630939][ T1000]  print_address_description.constprop.5+0x1be/0x360
> [   90.631610][ T1000]  ? number+0x824/0x880
> [   90.632038][ T1000]  ? number+0x824/0x880
> [   90.632469][ T1000]  __kasan_report+0x12a/0x16f
> [   90.632939][ T1000]  ? number+0x824/0x880
> [   90.633397][ T1000]  kasan_report+0xe/0x20
> [   90.633954][ T1000]  number+0x824/0x880
> [   90.634513][ T1000]  ? put_dec+0xa0/0xa0
> [   90.635047][ T1000]  ? rcu_read_lock_sched_held+0x90/0xc0
> [   90.636469][ T1000]  vsnprintf+0x63c/0x10b0
> [   90.637187][ T1000]  ? pointer+0x5b0/0x5b0
> [   90.637871][ T1000]  ? mark_lock+0x11d/0xc40
> [   90.638591][ T1000]  sprintf+0x9b/0xd0
> [   90.639164][ T1000]  ? scnprintf+0xe0/0xe0
> [   90.639802][ T1000]  nsim_dev_probe+0x63c/0xbf0 [netdevsim]
> [ ... ]
> 
> Fixes: 83c9e13aa39a ("netdevsim: add software driver for testing offloads")

The correct Fixes tag is:

Fixes: ab1d0cc004d7 ("netdevsim: change debugfs tree topology")

> Signed-off-by: Taehee Yoo <ap420073@gmail.com>
> ---
>  drivers/net/netdevsim/dev.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
> index 634eb5cdcbbe..a0c80a70bb23 100644
> --- a/drivers/net/netdevsim/dev.c
> +++ b/drivers/net/netdevsim/dev.c
> @@ -88,7 +88,7 @@ static const struct file_operations nsim_dev_take_snapshot_fops = {
>  
>  static int nsim_dev_debugfs_init(struct nsim_dev *nsim_dev)
>  {
> -	char dev_ddir_name[16];
> +	char dev_ddir_name[32];

nit: it'd be tempting to size this to the correct value 
     (20? or sizeof(DRV_NAME) + 10) rather than the arbitrary 32,
     perhaps?

>  	sprintf(dev_ddir_name, DRV_NAME "%u", nsim_dev->nsim_bus_dev->dev.id);
>  	nsim_dev->ddir = debugfs_create_dir(dev_ddir_name, nsim_dev_ddir);