* tty: BUG: KASAN: out-of-bounds in tty_ioctl
@ 2016-01-26 18:47 Sasha Levin
2016-01-26 18:55 ` Peter Hurley
0 siblings, 1 reply; 5+ messages in thread
From: Sasha Levin @ 2016-01-26 18:47 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby; +Cc: One Thousand Gnomes, LKML, syzkaller
Hi all,
I've hit the following while fuzzing with syzkaller inside a KVM tools guest
running the latest -next kernel:
[ 814.161028] ==================================================================
[ 814.162169] BUG: KASAN: out-of-bounds in tty_ioctl+0x2544/0x2810 at addr ffff8801c5034bd0
[ 814.163163] Read of size 8 by task syz-executor/22516
[ 814.163700] =============================================================================
[ 814.164592] BUG kmalloc-16 (Not tainted): kasan: bad access detected
[ 814.165171] -----------------------------------------------------------------------------
[ 814.165171]
[ 814.166374] Disabling lock debugging due to kernel taint
[ 814.167042] INFO: Allocated in tty_ldisc_get.part.0+0x66/0x140 age=7 cpu=6 pid=22524
[ 814.167983] ___slab_alloc+0x6fa/0x9a0
[ 814.168571] __slab_alloc.isra.43+0xae/0x160
[ 814.169085] kmem_cache_alloc+0x19e/0x2e0
[ 814.171274] tty_ldisc_get.part.0+0x66/0x140
[ 814.172337] tty_set_ldisc+0x746/0xa20
[ 814.172772] tty_ioctl+0xaf6/0x2810
[ 814.173212] do_vfs_ioctl+0x1cd/0x12a0
[ 814.178436] SyS_ioctl+0x8f/0xc0
[ 814.178931] entry_SYSCALL_64_fastpath+0x16/0x75
[ 814.179496] INFO: Freed in tty_ldisc_put+0x3e/0xa0 age=19 cpu=6 pid=22524
[ 814.180317] __slab_free+0x24b/0x530
[ 814.180767] kfree+0x192/0x2e0
[ 814.181125] tty_ldisc_put+0x3e/0xa0
[ 814.181522] tty_set_ldisc+0x484/0xa20
[ 814.181978] tty_ioctl+0xaf6/0x2810
[ 814.182392] do_vfs_ioctl+0x1cd/0x12a0
[ 814.185156] SyS_ioctl+0x8f/0xc0
[ 814.185584] entry_SYSCALL_64_fastpath+0x16/0x75
[ 814.186160] INFO: Slab 0xffffea0007140d00 objects=24 used=24 fp=0x (null) flags=0x2fffff80004080
[ 814.187297] INFO: Object 0xffff8801c5034bd0 @offset=3024 fp=0xffffffffb2bb8620
[ 814.187297]
[ 814.192003] Bytes b4 ffff8801c5034bc0: e1 cf 07 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
[ 814.193024] Object ffff8801c5034bd0: 20 86 bb b2 ff ff ff ff 40 9a dc c5 01 88 ff ff .......@.......
[ 814.193885] Redzone ffff8801c5034be0: cc cc cc cc cc cc cc cc ........
[ 814.194857] Padding ffff8801c5034d18: 00 00 00 00 00 00 00 00 ........
[ 814.195752] CPU: 3 PID: 22516 Comm: syz-executor Tainted: G B 4.4.0-next-20160125-sasha-12175-gc123483-dirty #2838
[ 814.197028] 1ffff10038c0df34 00000000a361be01 ffff8801c606fa20 ffffffffa24447d1
[ 814.197865] 0000000041b58ab3 ffffffffae6f38a8 ffffffffa2444706 ffff8800c39a2000
[ 814.198698] ffffffffae710866 ffff8801d1407a80 0000000000000008 ffff8801c5034bd0
[ 814.199532] Call Trace:
[ 814.199841] dump_stack (lib/dump_stack.c:52)
[ 814.201790] print_trailer (mm/slub.c:655)
[ 814.202368] object_err (mm/slub.c:662)
[ 814.202923] kasan_report_error (include/linux/kasan.h:28 mm/kasan/report.c:170 mm/kasan/report.c:237)
[ 814.204772] __asan_report_load8_noabort (mm/kasan/report.c:259 mm/kasan/report.c:280)
[ 814.206045] tty_ioctl (drivers/tty/tty_io.c:2877)
[ 814.212597] do_vfs_ioctl (fs/ioctl.c:44 fs/ioctl.c:674)
[ 814.217113] SyS_ioctl (fs/ioctl.c:689 fs/ioctl.c:680)
[ 814.217660] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
[ 814.218355] Memory state around the buggy address:
[ 814.218866] ffff8801c5034a80: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 814.219606] ffff8801c5034b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 814.220357] >ffff8801c5034b80: fc fc fc fc fc fc fc fc fc fc 00 00 fc fc fc fc
[ 814.221095] ^
[ 814.221725] ffff8801c5034c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 814.222496] ffff8801c5034c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
In tty_ioctl(), this is the following line:
case TIOCGETD:
return put_user(tty->ldisc->ops->num, (int __user *)p); <=== HERE
Thanks,
Sasha
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tty: BUG: KASAN: out-of-bounds in tty_ioctl
2016-01-26 18:47 tty: BUG: KASAN: out-of-bounds in tty_ioctl Sasha Levin
@ 2016-01-26 18:55 ` Peter Hurley
2016-01-26 18:58 ` Sasha Levin
0 siblings, 1 reply; 5+ messages in thread
From: Peter Hurley @ 2016-01-26 18:55 UTC (permalink / raw)
To: Sasha Levin, Greg Kroah-Hartman
Cc: Jiri Slaby, One Thousand Gnomes, LKML, syzkaller
On 01/26/2016 10:47 AM, Sasha Levin wrote:
> Hi all,
>
> I've hit the following while fuzzing with syzkaller inside a KVM tools guest
> running the latest -next kernel:
>
> [ 814.161028] ==================================================================
>
> [ 814.162169] BUG: KASAN: out-of-bounds in tty_ioctl+0x2544/0x2810 at addr ffff8801c5034bd0
>
> [ 814.163163] Read of size 8 by task syz-executor/22516
>
> [ 814.163700] =============================================================================
>
> [ 814.164592] BUG kmalloc-16 (Not tainted): kasan: bad access detected
>
> [ 814.165171] -----------------------------------------------------------------------------
>
> [ 814.165171]
>
> [ 814.166374] Disabling lock debugging due to kernel taint
>
> [ 814.167042] INFO: Allocated in tty_ldisc_get.part.0+0x66/0x140 age=7 cpu=6 pid=22524
>
> [ 814.167983] ___slab_alloc+0x6fa/0x9a0
>
> [ 814.168571] __slab_alloc.isra.43+0xae/0x160
>
> [ 814.169085] kmem_cache_alloc+0x19e/0x2e0
>
> [ 814.171274] tty_ldisc_get.part.0+0x66/0x140
>
> [ 814.172337] tty_set_ldisc+0x746/0xa20
>
> [ 814.172772] tty_ioctl+0xaf6/0x2810
>
> [ 814.173212] do_vfs_ioctl+0x1cd/0x12a0
>
> [ 814.178436] SyS_ioctl+0x8f/0xc0
>
> [ 814.178931] entry_SYSCALL_64_fastpath+0x16/0x75
>
> [ 814.179496] INFO: Freed in tty_ldisc_put+0x3e/0xa0 age=19 cpu=6 pid=22524
>
> [ 814.180317] __slab_free+0x24b/0x530
>
> [ 814.180767] kfree+0x192/0x2e0
>
> [ 814.181125] tty_ldisc_put+0x3e/0xa0
>
> [ 814.181522] tty_set_ldisc+0x484/0xa20
>
> [ 814.181978] tty_ioctl+0xaf6/0x2810
>
> [ 814.182392] do_vfs_ioctl+0x1cd/0x12a0
>
> [ 814.185156] SyS_ioctl+0x8f/0xc0
>
> [ 814.185584] entry_SYSCALL_64_fastpath+0x16/0x75
>
> [ 814.186160] INFO: Slab 0xffffea0007140d00 objects=24 used=24 fp=0x (null) flags=0x2fffff80004080
>
> [ 814.187297] INFO: Object 0xffff8801c5034bd0 @offset=3024 fp=0xffffffffb2bb8620
>
> [ 814.187297]
>
> [ 814.192003] Bytes b4 ffff8801c5034bc0: e1 cf 07 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
>
> [ 814.193024] Object ffff8801c5034bd0: 20 86 bb b2 ff ff ff ff 40 9a dc c5 01 88 ff ff .......@.......
>
> [ 814.193885] Redzone ffff8801c5034be0: cc cc cc cc cc cc cc cc ........
>
> [ 814.194857] Padding ffff8801c5034d18: 00 00 00 00 00 00 00 00 ........
>
> [ 814.195752] CPU: 3 PID: 22516 Comm: syz-executor Tainted: G B 4.4.0-next-20160125-sasha-12175-gc123483-dirty #2838
>
> [ 814.197028] 1ffff10038c0df34 00000000a361be01 ffff8801c606fa20 ffffffffa24447d1
>
> [ 814.197865] 0000000041b58ab3 ffffffffae6f38a8 ffffffffa2444706 ffff8800c39a2000
>
> [ 814.198698] ffffffffae710866 ffff8801d1407a80 0000000000000008 ffff8801c5034bd0
>
> [ 814.199532] Call Trace:
>
> [ 814.199841] dump_stack (lib/dump_stack.c:52)
> [ 814.201790] print_trailer (mm/slub.c:655)
> [ 814.202368] object_err (mm/slub.c:662)
> [ 814.202923] kasan_report_error (include/linux/kasan.h:28 mm/kasan/report.c:170 mm/kasan/report.c:237)
> [ 814.204772] __asan_report_load8_noabort (mm/kasan/report.c:259 mm/kasan/report.c:280)
> [ 814.206045] tty_ioctl (drivers/tty/tty_io.c:2877)
> [ 814.212597] do_vfs_ioctl (fs/ioctl.c:44 fs/ioctl.c:674)
> [ 814.217113] SyS_ioctl (fs/ioctl.c:689 fs/ioctl.c:680)
> [ 814.217660] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
> [ 814.218355] Memory state around the buggy address:
>
> [ 814.218866] ffff8801c5034a80: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>
> [ 814.219606] ffff8801c5034b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>
> [ 814.220357] >ffff8801c5034b80: fc fc fc fc fc fc fc fc fc fc 00 00 fc fc fc fc
>
> [ 814.221095] ^
>
> [ 814.221725] ffff8801c5034c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>
> [ 814.222496] ffff8801c5034c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>
>
> In tty_ioctl(), this is the following line:
>
> case TIOCGETD:
> return put_user(tty->ldisc->ops->num, (int __user *)p); <=== HERE
Hi Sasha,
Fix for this is in Greg's inbox.
Regards,
Peter Hurley
>
>
> Thanks,
> Sasha
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tty: BUG: KASAN: out-of-bounds in tty_ioctl
2016-01-26 18:55 ` Peter Hurley
@ 2016-01-26 18:58 ` Sasha Levin
2016-01-26 19:02 ` Peter Hurley
0 siblings, 1 reply; 5+ messages in thread
From: Sasha Levin @ 2016-01-26 18:58 UTC (permalink / raw)
To: Peter Hurley, Greg Kroah-Hartman
Cc: Jiri Slaby, One Thousand Gnomes, LKML, syzkaller
On 01/26/2016 01:55 PM, Peter Hurley wrote:
> Hi Sasha,
>
> Fix for this is in Greg's inbox.
Thanks Peter! Could you give me the patch name please? I tried seeing
if it was already reported but didn't see anything related.
Thanks,
Sasha
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tty: BUG: KASAN: out-of-bounds in tty_ioctl
2016-01-26 18:58 ` Sasha Levin
@ 2016-01-26 19:02 ` Peter Hurley
2016-01-26 20:23 ` Greg Kroah-Hartman
0 siblings, 1 reply; 5+ messages in thread
From: Peter Hurley @ 2016-01-26 19:02 UTC (permalink / raw)
To: Sasha Levin, Greg Kroah-Hartman
Cc: Jiri Slaby, One Thousand Gnomes, LKML, syzkaller
On 01/26/2016 10:58 AM, Sasha Levin wrote:
> On 01/26/2016 01:55 PM, Peter Hurley wrote:
>> Hi Sasha,
>>
>> Fix for this is in Greg's inbox.
>
> Thanks Peter! Could you give me the patch name please? I tried seeing
> if it was already reported but didn't see anything related.
No worries.
[PATCH v3 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tty: BUG: KASAN: out-of-bounds in tty_ioctl
2016-01-26 19:02 ` Peter Hurley
@ 2016-01-26 20:23 ` Greg Kroah-Hartman
0 siblings, 0 replies; 5+ messages in thread
From: Greg Kroah-Hartman @ 2016-01-26 20:23 UTC (permalink / raw)
To: Peter Hurley
Cc: Sasha Levin, Jiri Slaby, One Thousand Gnomes, LKML, syzkaller
On Tue, Jan 26, 2016 at 11:02:54AM -0800, Peter Hurley wrote:
> On 01/26/2016 10:58 AM, Sasha Levin wrote:
> > On 01/26/2016 01:55 PM, Peter Hurley wrote:
> >> Hi Sasha,
> >>
> >> Fix for this is in Greg's inbox.
> >
> > Thanks Peter! Could you give me the patch name please? I tried seeing
> > if it was already reported but didn't see anything related.
>
> No worries.
>
> [PATCH v3 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
Yeah, I should get to those later today if all goes well, sorry for the
delay...
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-01-26 20:23 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-26 18:47 tty: BUG: KASAN: out-of-bounds in tty_ioctl Sasha Levin
2016-01-26 18:55 ` Peter Hurley
2016-01-26 18:58 ` Sasha Levin
2016-01-26 19:02 ` Peter Hurley
2016-01-26 20:23 ` Greg Kroah-Hartman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.