Re: [devkmsg_write] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170

[Dmitry Vyukov]

On Tue, Nov 7, 2017 at 11:45 AM, Sergey Senozhatsky
<sergey.senozhatsky.work@xxxxxxxxx> wrote:
> Hello,
>
> On (11/07/17 17:39), Fengguang Wu wrote:
>> [   22.184920] Freeing unused kernel memory: 824K
>> [   22.199198] Freeing unused kernel memory: 1436K
>> [   22.228460] x86/mm: Checked W+X mappings: passed, no W+X pages found.
>> [   22.230474] rodata_test: all tests were successful
>> [   22.254830] ==================================================================
>> [   22.257125] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170
>> [   22.258648] Write of size 26 at addr ffff880013432540 by task init/1
>> [   22.260272]
>> [   22.260860] CPU: 0 PID: 1 Comm: init Not tainted 4.14.0-rc8 #14
>> [   22.262379] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
>> [   22.264441] Call Trace:
>> [   22.265206]  dump_stack+0x5d/0x81
>> [   22.266147]  print_address_description+0xa7/0x280
>> [   22.267369]  ? copyin+0xea/0x170
>> [   22.268282]  ? copyin+0xea/0x170
>> [   22.268990]  kasan_report+0xd3/0x150
>> [   22.269551]  ? quarantine_reduce+0x1/0x1a0
>> [   22.270177]  ? copyin+0xea/0x170
>> [   22.270703]  copyin+0xea/0x170
>> [   22.271202]  _copy_from_iter_full+0x14f/0x4f0
>> [   22.271857]  ? __kmalloc+0x1ad/0x2e0
>> [   22.272420]  devkmsg_write+0xb9/0x1a0
>> [   22.272999]  new_sync_write+0xd8/0x130
>> [   22.273579]  vfs_write+0x174/0x2b0
>> [   22.274113]  SyS_write+0x50/0xc0
>> [   22.274611]  do_int80_syscall_32+0x7a/0x1b0
>> [   22.275216]  entry_INT80_compat+0x2d/0x40
>
> at a glance I don't see anything suspicious in devkmsg_write().
>
>> [   22.276103] Allocated by task 1:
>> [   22.276597]  kasan_kmalloc+0x61/0xf0
>> [   22.277202]  __kmalloc+0x1ad/0x2e0
>> [   22.277720]  devkmsg_write+0x76/0x1a0
>> [   22.278268]  new_sync_write+0xd8/0x130
>> [   22.278826]  vfs_write+0x174/0x2b0
>> [   22.279342]  SyS_write+0x50/0xc0
>> [   22.279840]  do_int80_syscall_32+0x7a/0x1b0
>> [   22.280441]  entry_INT80_compat+0x2d/0x40
>
> devkmsg_write() does
>
>         buf = kmalloc(len+1, GFP_KERNEL);
>         ...
>         kfree(buf);
>
> kasan reports that this kfree() is actually happening in unpack_to_rootfs(),
> before we do copy_from_iter_full().


Please ignore the free stack. For slab-out-of-bound bugs the object is
not actually freed and KASAN prints the free stack where it was freed
before it was re-allocated as new object.

Can that len+1 overflow? Is it checked?


>> [   22.281326] Freed by task 1:
>> [   22.281788]  kasan_slab_free+0xac/0x180
>> [   22.282354]  kfree+0x105/0x310
>> [   22.282837]  unpack_to_rootfs+0x260/0x2a1
>> [   22.283420]  populate_rootfs+0x5d/0x86
>> [   22.283977]  do_one_initcall+0x3b/0x180
>> [   22.284544]  do_basic_setup+0xb4/0xd0
>> [   22.285091]  kernel_init_freeable+0x7b/0xed
>> [   22.285680]  kernel_init+0xe/0x110
>> [   22.286171]  ret_from_fork+0x25/0x30
>
> unpack_to_rootfs() does
>
>         header_buf = kmalloc(110, GFP_KERNEL);
>         symlink_buf = kmalloc(PATH_MAX + N_ALIGN(PATH_MAX) + 1, GFP_KERNEL);
>         name_buf = kmalloc(N_ALIGN(PATH_MAX), GFP_KERNEL);
>         ...
>         kfree(name_buf);
>         kfree(symlink_buf);
>         kfree(header_buf);
>
> kasan reports that one of the pointers was allocated in devkmsg_write().
> what am I missing?
>
>         -ss