From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756666AbdJKBoX (ORCPT ); Tue, 10 Oct 2017 21:44:23 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:59855 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751156AbdJKBoW (ORCPT ); Tue, 10 Oct 2017 21:44:22 -0400 Subject: Re: BUG: KASAN: global-out-of-bounds in strscpy+0x807/0x970 To: Jakub Kicinski , Kees Cook Cc: LKML References: <20171010182805.52b9b2af@cakuba.netronome.com> From: Tyler Hicks Message-ID: Date: Tue, 10 Oct 2017 21:44:01 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <20171010182805.52b9b2af@cakuba.netronome.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="O52RC65txGfmQig8VwLNb4EEEvh11Exnj" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --O52RC65txGfmQig8VwLNb4EEEvh11Exnj Content-Type: multipart/mixed; boundary="2lnmgIpgIdnKeIgSdoVKh7AF8EXJ9Ip58"; protected-headers="v1" From: Tyler Hicks To: Jakub Kicinski , Kees Cook Cc: LKML Message-ID: Subject: Re: BUG: KASAN: global-out-of-bounds in strscpy+0x807/0x970 References: <20171010182805.52b9b2af@cakuba.netronome.com> In-Reply-To: <20171010182805.52b9b2af@cakuba.netronome.com> --2lnmgIpgIdnKeIgSdoVKh7AF8EXJ9Ip58 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 10/10/2017 09:28 PM, Jakub Kicinski wrote: > I'm hitting this on sysctl -a with net-next (4.14-rc4). Hey Jakub - thanks for the bug report! >=20 > I saw that seccomp_actions_logged_handler was introduced > not-so-long-ago by Tyler, is there a fix for this? No, this is the first I've heard of it. I'll have a look. Tyler >=20 > [ 753.503760] BUG: KASAN: global-out-of-bounds in strscpy+0x807/0x970 > [ 753.510892] Read of size 8 at addr ffffffffa96b97c8 by task sysctl/1= 787 > [ 753.518416]=20 > [ 753.520198] CPU: 1 PID: 1787 Comm: sysctl Not tainted 4.14.0-rc4-deb= ug-00822-g07ec06ef312a #316 > [ 753.538598] Call Trace: > [ 753.541449] dump_stack+0xb3/0x140 > [ 753.545372] ? _atomic_dec_and_lock+0x2b0/0x2b0 > [ 753.550564] ? show_regs_print_info+0x6d/0x6d > [ 753.555562] print_address_description+0x25f/0x440 > [ 753.561044] ? strscpy+0x807/0x970 > [ 753.564967] kasan_report+0x1b8/0x430 > [ 753.569182] ? strscpy+0x807/0x970 > [ 753.573107] strscpy+0x807/0x970 > [ 753.576838] ? strncpy+0xf0/0xf0 > [ 753.580576] ? sched_clock_cpu+0x18/0x290 > [ 753.585185] seccomp_actions_logged_handler+0x384/0x8d0 > [ 753.591157] ? seccomp_send_sigsys+0xa0/0xa0 > [ 753.596046] ? lock_downgrade+0x740/0x740 > [ 753.600648] ? get_lock_stats+0x18/0x160 > [ 753.605159] ? sysctl_head_grab+0x1b/0xc0 > [ 753.609766] ? lock_contended+0x1130/0x1130 > [ 753.614566] ? lock_release+0x14e0/0x14e0 > [ 753.619171] ? do_raw_spin_trylock+0x1c0/0x1c0 > [ 753.624261] ? lock_downgrade+0x660/0x740 > [ 753.628858] ? do_raw_spin_lock+0x1f0/0x1f0 > [ 753.633657] proc_sys_call_handler+0x216/0x3c0 > [ 753.638752] ? proc_sys_permission+0x250/0x250 > [ 753.643847] ? do_mmap+0x622/0xf50 > [ 753.647772] __vfs_read+0xea/0x9a0 > [ 753.651696] ? vfs_copy_file_range+0xc60/0xc60 > [ 753.656787] ? security_mmap_file+0x66/0x1d0 > [ 753.661686] ? common_file_perm+0x1e0/0x6b0 > [ 753.666485] ? vm_mmap_pgoff+0x1b6/0x250 > [ 753.670993] ? fsnotify+0x1c80/0x1c80 > [ 753.675209] ? apparmor_task_setrlimit+0x690/0x690 > [ 753.680687] ? vma_is_stack_for_current+0xb0/0xb0 > [ 753.686073] vfs_read+0x109/0x3e0 > [ 753.689900] SyS_read+0xcc/0x1d0 > [ 753.693628] ? kernel_write+0x1a0/0x1a0 > [ 753.698034] ? trace_hardirqs_on_caller+0x3cb/0x680 > [ 753.703610] ? trace_hardirqs_on_thunk+0x1a/0x1c > [ 753.708898] entry_SYSCALL_64_fastpath+0x1c/0xb1 > [ 753.714180] RIP: 0033:0x7f62c82296b0 > [ 753.718294] RSP: 002b:00007ffc2d6726c8 EFLAGS: 00000246 ORIG_RAX: 00= 00000000000000 > [ 753.726919] RAX: ffffffffffffffda RBX: 0000000000000046 RCX: 00007f6= 2c82296b0 > [ 753.735028] RDX: 0000000000000400 RSI: 00007f62c8722000 RDI: 0000000= 000000006 > [ 753.743138] RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000= 000000000 > [ 753.751246] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000= 000000000 > [ 753.759355] R13: 0000000001d63650 R14: 00007f62c87186a0 R15: 0000000= 000000028 > [ 753.767478]=20 > [ 753.769256] The buggy address belongs to the variable: > [ 753.775125] kprobes_seq_ops+0x1268/0x15c0 > [ 753.779820]=20 > [ 753.781595] Memory state around the buggy address: > [ 753.787075] ffffffffa96b9680: 00 00 00 00 00 00 00 00 00 00 00 00 0= 0 00 00 00 > [ 753.795301] ffffffffa96b9700: 00 00 00 00 00 00 00 00 00 00 00 00 0= 0 00 00 00 > [ 753.803526] >ffffffffa96b9780: 07 fa fa fa fa fa fa fa 00 05 fa fa f= a fa fa fa > [ 753.811751] ^ > [ 753.818105] ffffffffa96b9800: 02 fa fa fa fa fa fa fa 00 00 04 fa f= a fa fa fa > [ 753.826330] ffffffffa96b9880: 00 00 00 01 fa fa fa fa 00 00 00 00 0= 1 fa fa fa > [ 753.834554] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >=20 --2lnmgIpgIdnKeIgSdoVKh7AF8EXJ9Ip58-- --O52RC65txGfmQig8VwLNb4EEEvh11Exnj Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJZ3XdqAAoJENaSAD2qAscK9HMP/1tpS728xzruTzeP+VKUPQBz sdSAd6a2a/G6cvQewaFt1v298BqN3cYuvY4FYw4T/mt5WOTH8oV/tPN6YdB99Ws9 83bpbWF6ugLbg5O4OABA1g5OoJ2kQ+0GL40/ckv/s/85IAZNZ5ITwduwaDD8P80C zRMCJVcy2+fgH2r6+V7bQ5/jCE3CLGUYZ6WhymQeVDs0n4buBEN6GHZJxk5wj88w GNK2vRafDPtHbvHXv9ORw05KzMTa8IozIr5Ht7SmNDsZTb/xjcg8G0fmcCaFTkLo m7OQMhXnXplFUZUTBNjj0Ph64o4qcvcvx5VCNiGNdUicXjzYPCKOGd6uoLWTKpWe KlNSHABkBdBT6m3ntpvtQyr/mqt6kzAl9sF4S4/YIJHNUjMkaZ129vIHal1S1wAC j21suUUB3nV9vMnvW5IO6+oFWcy+mUrERC4ii9gjonLwhT0z5xkL4Dp2N+IpiM5t ho/L6YZJ+vKZ3rJ0r8XOQVy0D6aRy0n/d8ybLGfJQGMeQLkmSixQ8mdRpxuRdlxh Ibl4IJXn4ERqUhzuafOHE4KBhQFYPBz6ChtybvAyLwS9kiaLW3ac/BLXVh6fLlrJ lEZoUEXEoLfmI+o+mX6KXLD6kUL15ABE5BLZopcClyfBC3S9FlpBTEaa1bKAFX/m 4WFyl7OaZdlnsvNL3EdV =+fHi -----END PGP SIGNATURE----- --O52RC65txGfmQig8VwLNb4EEEvh11Exnj--