All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sasha.levin@oracle.com>
To: gregkh@linuxfoundation.org, jslaby@suse.com, pavel@ucw.cz,
	dmitry.torokhov@gmail.com
Cc: LKML <linux-kernel@vger.kernel.org>
Subject: tty/vt/keyboard: out of bounds access in do_compute_shiftstate
Date: Sun, 29 May 2016 13:52:44 -0400	[thread overview]
Message-ID: <574B2C6C.7060402@oracle.com> (raw)

Hi all,

I've hit the following while fuzzing with syzkaller inside a KVM tools guest
running the latest -next kernel:

[ 2662.777566] BUG: KASAN: global-out-of-bounds in do_compute_shiftstate+0x161/0x370 at addr ffffffffb2e686a0

[ 2662.777592] Read of size 2 by task syz-executor/30576

[ 2662.777676] Address belongs to variable plain_map+0x200/0x3540

[ 2662.777727] CPU: 2 PID: 30576 Comm: syz-executor Tainted: G    B           4.6.0-next-20160527-sasha-00024-g6ab0dc9-dirty #3098

[ 2662.777792]  1ffff1001635bde7 00000000dc4d92d7 ffff8800b1adefc0 ffffffffa3fd0b37

[ 2662.777826]  ffffffff00000002 fffffbfff5deeda4 0000000041b58ab3 ffffffffae8dd830

[ 2662.777862]  ffffffffa3fd09c8 ffffffffa23fa2e8 ffff8800b1adef98 ffff8801d42a20f8

[ 2662.777868] Call Trace:

[ 2662.777935] dump_stack (lib/dump_stack.c:53)
[ 2662.778136] kasan_report_error (include/linux/kasan.h:28 mm/kasan/report.c:211 mm/kasan/report.c:277)
[ 2662.778265] __asan_report_load2_noabort (mm/kasan/report.c:317)
[ 2662.778318] do_compute_shiftstate (drivers/tty/vt/keyboard.c:386)
[ 2662.778332] fn_null (drivers/tty/vt/keyboard.c:625)
[ 2662.778345] k_spec (drivers/tty/vt/keyboard.c:645)
[ 2662.778361] kbd_event (drivers/tty/vt/keyboard.c:1459 drivers/tty/vt/keyboard.c:1475)
[ 2662.778907] input_to_handler (drivers/input/input.c:120 (discriminator 3))
[ 2662.778926] input_pass_values (drivers/input/input.c:148)
[ 2662.778944] input_handle_event (drivers/input/input.c:406)
[ 2662.779015] input_inject_event (include/linux/rcupdate.h:910 drivers/input/input.c:467)
[ 2662.779034] evdev_do_ioctl (drivers/input/evdev.c:1102)
[ 2662.779271] evdev_ioctl_handler (drivers/input/evdev.c:1302)
[ 2662.779305] evdev_ioctl (drivers/input/evdev.c:1312)
[ 2662.779320] do_vfs_ioctl (fs/ioctl.c:44 fs/ioctl.c:674)
[ 2662.779463] SyS_ioctl (fs/ioctl.c:689 fs/ioctl.c:680)
[ 2662.779511] do_syscall_64 (arch/x86/entry/common.c:350)
[ 2662.779530] entry_SYSCALL64_slow_path (arch/x86/entry/entry_64.S:251)
[ 2662.779535] Memory state around the buggy address:

[ 2662.779566]  ffffffffb2e68580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[ 2662.779579]  ffffffffb2e68600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[ 2662.779589] >ffffffffb2e68680: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00

[ 2662.779594]                                ^

[ 2662.779604]  ffffffffb2e68700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[ 2662.779615]  ffffffffb2e68780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


Thanks,
Sasha

             reply	other threads:[~2016-05-29 17:52 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-05-29 17:52 Sasha Levin [this message]
2016-05-29 19:04 ` tty/vt/keyboard: out of bounds access in do_compute_shiftstate Pavel Machek
2016-06-26 18:31 ` Greg KH
2016-06-27 21:27 ` Dmitry Torokhov
2016-07-12  3:06   ` Dmitry Torokhov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=574B2C6C.7060402@oracle.com \
    --to=sasha.levin@oracle.com \
    --cc=dmitry.torokhov@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jslaby@suse.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pavel@ucw.cz \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.