[PATCH v2] kgdb: Fix buffer overflow in the qfThreadInfo packet handler

[Christian Aurich Zanettini Martins]

gdb_cmd_query() answers qfThreadInfo with a thread ID and a comma for
every online CPU, 9 bytes each, followed by the first page of tasks.
Only the tasks are paged, KGDB_MAX_THREAD_QUERY at a time, so the CPU
entries overrun remcom_out_buffer[BUFMAX] once there are enough CPUs.
On x86, where BUFMAX is 1024, a typical boot hits this from 109 online
CPUs (222 on arm64 and riscv), and GDB sends qfThreadInfo as soon as it
connects:

  BUG: KASAN: global-out-of-bounds in pack_threadid+0x2a8/0x2e0
  Write of size 1 at addr ffffffff86eecc20 by task swapper/0/1
  ...
  The buggy address belongs to the variable:
   remcom_out_buffer+0x400/0x420

Page the CPU entries together with the tasks, with one helper for both
loops, so no reply holds more than KGDB_MAX_THREAD_QUERY threads. The
CPUs still come first, which scripts/gdb relies on to detect KGDB.

Fixes: 25fc99991383 ("kgdb: fix gdb serial thread queries")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@xxxxxxxxx>
---

Notes:
    Changes in v2:
    - Move the shared paging code into append_threadid() (Doug)
    - Link to v1: https://lore.kernel.org/all/20261103190622.925741-1-christian.aurichzm@xxxxxxxxx/
    
    Tested in QEMU with KASAN and GDB 15.1. Unpatched, connecting GDB to
    a 109-CPU guest gives the report above; patched, 109, 128 and 255 CPUs
    return the full thread list with no report.
    
    Based on v7.4-rc1.

 kernel/debug/gdbstub.c | 45 ++++++++++++++++++++++--------------------
 1 file changed, 24 insertions(+), 21 deletions(-)

diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c
index fc6a7a8c1f6e..679fab102760 100644
--- a/kernel/debug/gdbstub.c
+++ b/kernel/debug/gdbstub.c
@@ -732,6 +732,22 @@ static int gdb_cmd_reboot(struct kgdb_state *ks)
 	return 0;
 }
 
+static void append_threadid(struct kgdb_state *ks, char **ptr, int *i,
+			    int *finished, int threadid)
+{
+	unsigned char thref[BUF_THREAD_ID_SIZE];
+
+	if (*i >= ks->thr_query && !*finished) {
+		int_to_threadref(thref, threadid);
+		*ptr = pack_threadid(*ptr, thref);
+		*(*ptr)++ = ',';
+		ks->thr_query++;
+		if (ks->thr_query % KGDB_MAX_THREAD_QUERY == 0)
+			*finished = 1;
+	}
+	(*i)++;
+}
+
 /* Handle the 'q' query packets */
 static void gdb_cmd_query(struct kgdb_state *ks)
 {
@@ -752,28 +768,15 @@ static void gdb_cmd_query(struct kgdb_state *ks)
 		i = 0;
 		remcom_out_buffer[0] = 'm';
 		ptr = remcom_out_buffer + 1;
-		if (remcom_in_buffer[1] == 'f') {
-			/* Each cpu is a shadow thread */
-			for_each_online_cpu(cpu) {
-				ks->thr_query = 0;
-				int_to_threadref(thref, -cpu - 2);
-				ptr = pack_threadid(ptr, thref);
-				*(ptr++) = ',';
-				i++;
-			}
-		}
+		if (remcom_in_buffer[1] == 'f')
+			ks->thr_query = 0;
 
-		for_each_process_thread(g, p) {
-			if (i >= ks->thr_query && !finished) {
-				int_to_threadref(thref, p->pid);
-				ptr = pack_threadid(ptr, thref);
-				*(ptr++) = ',';
-				ks->thr_query++;
-				if (ks->thr_query % KGDB_MAX_THREAD_QUERY == 0)
-					finished = 1;
-			}
-			i++;
-		}
+		/* Each cpu is a shadow thread */
+		for_each_online_cpu(cpu)
+			append_threadid(ks, &ptr, &i, &finished, -cpu - 2);
+
+		for_each_process_thread(g, p)
+			append_threadid(ks, &ptr, &i, &finished, p->pid);
 
 		*(--ptr) = '\0';
 		break;

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0