From: Dipanjan Das <mail.dipanjan.das@gmail.com> To: Takashi Iwai <tiwai@suse.de> Cc: Greg KH <gregkh@linuxfoundation.org>, perex@perex.cz, tiwai@suse.com, consult.awy@gmail.com, alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, syzkaller@googlegroups.com, fleischermarius@googlemail.com, its.priyanka.bose@gmail.com Subject: Re: KASAN: vmalloc-out-of-bounds Write in snd_pcm_hw_params Date: Tue, 26 Jul 2022 14:40:48 -0700 [thread overview] Message-ID: <CANX2M5Ywm+GpYY3+GsOWCLH24Nhy0M0LjBE-pHC8wFcd7SO=wQ@mail.gmail.com> (raw) In-Reply-To: <874jz82kx0.wl-tiwai@suse.de> On Sat, Jul 23, 2022 at 3:17 AM Takashi Iwai <tiwai@suse.de> wrote: > > On Sat, 23 Jul 2022 09:00:08 +0200, > Greg KH wrote: > > > > Wondeful, do you have a fix for this that solves the reported problem > > that you have tested with the reproducer? > > ... or at least more detailed information. Here is our analysis of the bug in the kernel v5.10.131. During allocation, the `size` of the DMA buffer is not page-aligned: https://elixir.bootlin.com/linux/v5.10.131/source/sound/core/memalloc.c#L149. However, in sound/core/pcm_native.c:798 (https://elixir.bootlin.com/linux/v5.10.131/source/sound/core/pcm_native.c#L798), the `size` variable is page-aligned before memset-ing the `dma_area`. From the other BUG_ON assertions in other parts of the code, it looks like the DMA area is not supposed to be equal to or greater than 0x200000 bytes. However, due to page-alignment, the `size` can indeed get rounded up to 0x200000 which causes the out of bound access. > Last but not least, you should check whether it's specific to your > 5.10.x kernel or it's also seen with the latest upstream, too. The bug is not reproducible on the latest mainline, because in sound/core/memalloc.c:66 (https://github.com/torvalds/linux/blob/5de64d44968e4ae66ebdb0a2d08b443f189d3651/sound/core/memalloc.c#L66) the allocation function `snd_dma_alloc_dir_pages()` now page-aligns the `size` right before allocating the DMA buffer. Therefore, any subsequent page-alignment, like the one in `snd_pcm_hw_params()` does not cause an out of bound access. -- Thanks and Regards, Dipanjan
WARNING: multiple messages have this Message-ID (diff)
From: Dipanjan Das <mail.dipanjan.das@gmail.com> To: Takashi Iwai <tiwai@suse.de> Cc: alsa-devel@alsa-project.org, fleischermarius@googlemail.com, Greg KH <gregkh@linuxfoundation.org>, linux-kernel@vger.kernel.org, tiwai@suse.com, consult.awy@gmail.com, syzkaller@googlegroups.com, its.priyanka.bose@gmail.com Subject: Re: KASAN: vmalloc-out-of-bounds Write in snd_pcm_hw_params Date: Tue, 26 Jul 2022 14:40:48 -0700 [thread overview] Message-ID: <CANX2M5Ywm+GpYY3+GsOWCLH24Nhy0M0LjBE-pHC8wFcd7SO=wQ@mail.gmail.com> (raw) In-Reply-To: <874jz82kx0.wl-tiwai@suse.de> On Sat, Jul 23, 2022 at 3:17 AM Takashi Iwai <tiwai@suse.de> wrote: > > On Sat, 23 Jul 2022 09:00:08 +0200, > Greg KH wrote: > > > > Wondeful, do you have a fix for this that solves the reported problem > > that you have tested with the reproducer? > > ... or at least more detailed information. Here is our analysis of the bug in the kernel v5.10.131. During allocation, the `size` of the DMA buffer is not page-aligned: https://elixir.bootlin.com/linux/v5.10.131/source/sound/core/memalloc.c#L149. However, in sound/core/pcm_native.c:798 (https://elixir.bootlin.com/linux/v5.10.131/source/sound/core/pcm_native.c#L798), the `size` variable is page-aligned before memset-ing the `dma_area`. From the other BUG_ON assertions in other parts of the code, it looks like the DMA area is not supposed to be equal to or greater than 0x200000 bytes. However, due to page-alignment, the `size` can indeed get rounded up to 0x200000 which causes the out of bound access. > Last but not least, you should check whether it's specific to your > 5.10.x kernel or it's also seen with the latest upstream, too. The bug is not reproducible on the latest mainline, because in sound/core/memalloc.c:66 (https://github.com/torvalds/linux/blob/5de64d44968e4ae66ebdb0a2d08b443f189d3651/sound/core/memalloc.c#L66) the allocation function `snd_dma_alloc_dir_pages()` now page-aligns the `size` right before allocating the DMA buffer. Therefore, any subsequent page-alignment, like the one in `snd_pcm_hw_params()` does not cause an out of bound access. -- Thanks and Regards, Dipanjan
next prev parent reply other threads:[~2022-07-26 21:41 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-07-22 16:37 KASAN: vmalloc-out-of-bounds Write in snd_pcm_hw_params Dipanjan Das 2022-07-22 16:37 ` Dipanjan Das 2022-07-23 7:00 ` Greg KH 2022-07-23 7:00 ` Greg KH 2022-07-23 10:16 ` Takashi Iwai 2022-07-23 10:16 ` Takashi Iwai 2022-07-26 21:40 ` Dipanjan Das [this message] 2022-07-26 21:40 ` Dipanjan Das 2022-07-27 4:06 ` Lukas Bulwahn 2022-07-27 4:06 ` Lukas Bulwahn 2022-07-27 5:25 ` Takashi Iwai 2022-07-27 5:25 ` Takashi Iwai 2022-07-28 23:24 ` Dipanjan Das 2022-07-28 23:24 ` Dipanjan Das 2022-07-29 6:07 ` Takashi Iwai 2022-07-29 6:07 ` Takashi Iwai 2022-07-29 8:13 ` Greg KH 2022-07-29 8:13 ` Greg KH
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CANX2M5Ywm+GpYY3+GsOWCLH24Nhy0M0LjBE-pHC8wFcd7SO=wQ@mail.gmail.com' \ --to=mail.dipanjan.das@gmail.com \ --cc=alsa-devel@alsa-project.org \ --cc=consult.awy@gmail.com \ --cc=fleischermarius@googlemail.com \ --cc=gregkh@linuxfoundation.org \ --cc=its.priyanka.bose@gmail.com \ --cc=linux-kernel@vger.kernel.org \ --cc=perex@perex.cz \ --cc=syzkaller@googlegroups.com \ --cc=tiwai@suse.com \ --cc=tiwai@suse.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.