Re: [devkmsg_write] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170

[Sergey Senozhatsky]

Hello,

On (11/07/17 17:39), Fengguang Wu wrote:
> [   22.184920] Freeing unused kernel memory: 824K
> [   22.199198] Freeing unused kernel memory: 1436K
> [   22.228460] x86/mm: Checked W+X mappings: passed, no W+X pages found.
> [   22.230474] rodata_test: all tests were successful
> [   22.254830] ==================================================================
> [   22.257125] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170
> [   22.258648] Write of size 26 at addr ffff880013432540 by task init/1
> [   22.260272] 
> [   22.260860] CPU: 0 PID: 1 Comm: init Not tainted 4.14.0-rc8 #14
> [   22.262379] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
> [   22.264441] Call Trace:
> [   22.265206]  dump_stack+0x5d/0x81
> [   22.266147]  print_address_description+0xa7/0x280
> [   22.267369]  ? copyin+0xea/0x170
> [   22.268282]  ? copyin+0xea/0x170
> [   22.268990]  kasan_report+0xd3/0x150
> [   22.269551]  ? quarantine_reduce+0x1/0x1a0
> [   22.270177]  ? copyin+0xea/0x170
> [   22.270703]  copyin+0xea/0x170
> [   22.271202]  _copy_from_iter_full+0x14f/0x4f0
> [   22.271857]  ? __kmalloc+0x1ad/0x2e0
> [   22.272420]  devkmsg_write+0xb9/0x1a0
> [   22.272999]  new_sync_write+0xd8/0x130
> [   22.273579]  vfs_write+0x174/0x2b0
> [   22.274113]  SyS_write+0x50/0xc0
> [   22.274611]  do_int80_syscall_32+0x7a/0x1b0
> [   22.275216]  entry_INT80_compat+0x2d/0x40

at a glance I don't see anything suspicious in devkmsg_write().

> [   22.276103] Allocated by task 1:
> [   22.276597]  kasan_kmalloc+0x61/0xf0
> [   22.277202]  __kmalloc+0x1ad/0x2e0
> [   22.277720]  devkmsg_write+0x76/0x1a0
> [   22.278268]  new_sync_write+0xd8/0x130
> [   22.278826]  vfs_write+0x174/0x2b0
> [   22.279342]  SyS_write+0x50/0xc0
> [   22.279840]  do_int80_syscall_32+0x7a/0x1b0
> [   22.280441]  entry_INT80_compat+0x2d/0x40

devkmsg_write() does

	buf = kmalloc(len+1, GFP_KERNEL);
	...
	kfree(buf);

kasan reports that this kfree() is actually happening in unpack_to_rootfs(),
before we do copy_from_iter_full().

> [   22.281326] Freed by task 1:
> [   22.281788]  kasan_slab_free+0xac/0x180
> [   22.282354]  kfree+0x105/0x310
> [   22.282837]  unpack_to_rootfs+0x260/0x2a1
> [   22.283420]  populate_rootfs+0x5d/0x86
> [   22.283977]  do_one_initcall+0x3b/0x180
> [   22.284544]  do_basic_setup+0xb4/0xd0
> [   22.285091]  kernel_init_freeable+0x7b/0xed
> [   22.285680]  kernel_init+0xe/0x110
> [   22.286171]  ret_from_fork+0x25/0x30

unpack_to_rootfs() does

	header_buf = kmalloc(110, GFP_KERNEL);
	symlink_buf = kmalloc(PATH_MAX + N_ALIGN(PATH_MAX) + 1, GFP_KERNEL);
	name_buf = kmalloc(N_ALIGN(PATH_MAX), GFP_KERNEL);
	...
	kfree(name_buf);
	kfree(symlink_buf);
	kfree(header_buf);

kasan reports that one of the pointers was allocated in devkmsg_write().
what am I missing?

	-ss