Re: [PATCH v2] kgdb: Fix buffer overflow in the qfThreadInfo packet handler

[Doug Anderson]

Hi,

On Tue, Nov 10, 2026 at 12:20 AM Christian Aurich Zanettini Martins
<christian.aurichzm@xxxxxxxxx> wrote:
>
> gdb_cmd_query() answers qfThreadInfo with a thread ID and a comma for
> every online CPU, 9 bytes each, followed by the first page of tasks.
> Only the tasks are paged, KGDB_MAX_THREAD_QUERY at a time, so the CPU
> entries overrun remcom_out_buffer[BUFMAX] once there are enough CPUs.
> On x86, where BUFMAX is 1024, a typical boot hits this from 109 online
> CPUs (222 on arm64 and riscv), and GDB sends qfThreadInfo as soon as it
> connects:
>
>   BUG: KASAN: global-out-of-bounds in pack_threadid+0x2a8/0x2e0
>   Write of size 1 at addr ffffffff86eecc20 by task swapper/0/1
>   ...
>   The buggy address belongs to the variable:
>    remcom_out_buffer+0x400/0x420
>
> Page the CPU entries together with the tasks, with one helper for both
> loops, so no reply holds more than KGDB_MAX_THREAD_QUERY threads. The
> CPUs still come first, which scripts/gdb relies on to detect KGDB.
>
> Fixes: 25fc99991383 ("kgdb: fix gdb serial thread queries")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@xxxxxxxxx>
> ---
>
> Notes:
>     Changes in v2:
>     - Move the shared paging code into append_threadid() (Doug)
>     - Link to v1: https://lore.kernel.org/all/20261103190622.925741-1-christian.aurichzm@xxxxxxxxx/
>
>     Tested in QEMU with KASAN and GDB 15.1. Unpatched, connecting GDB to
>     a 109-CPU guest gives the report above; patched, 109, 128 and 255 CPUs
>     return the full thread list with no report.
>
>     Based on v7.4-rc1.
>
>  kernel/debug/gdbstub.c | 45 ++++++++++++++++++++++--------------------
>  1 file changed, 24 insertions(+), 21 deletions(-)

Reviewed-by: Douglas Anderson <dianders@xxxxxxxxxxxx>