From: Omar Sandoval <osandov@osandov.com>
To: Kees Cook <keescook@chromium.org>
Cc: Jordan Glover <Golden_Miller83@protonmail.ch>,
"linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
Jens Axboe <axboe@kernel.dk>, Omar Sandoval <osandov@fb.com>,
Daniel Micay <danielmicay@gmail.com>
Subject: Re: "kyber: add tracepoints" causes write beyond size of object
Date: Wed, 14 Nov 2018 16:06:03 -0800 [thread overview]
Message-ID: <20181115000603.GA2313@vader> (raw)
In-Reply-To: <CAGXu5jLyRY0jgiNhTBB71nPxXscACA7fRBXv_Q_bkzoE-6Bj7A@mail.gmail.com>
On Wed, Nov 14, 2018 at 05:23:06PM -0600, Kees Cook wrote:
> On Sat, Nov 10, 2018 at 8:15 AM, Jordan Glover
> <Golden_Miller83@protonmail.ch> wrote:
> > Hello,
> >
> > Commit 6c3b7af1c975b87b86dcb2af233d1ae21eb05107 ("kyber: add tracepoints")[1] causes write beyond size of object. This was detected by "FORTIFY_SOURCE intra-object overflow checking"[2] feature which is part of linux-hardened out-of-tree patchset designed to catch such errors.
> >
> > The specific error is:
> >
> > In file included from ./include/linux/bitmap.h:9,
> > from ./include/linux/cpumask.h:12,
> > from ./arch/x86/include/asm/cpumask.h:5,
> > from ./arch/x86/include/asm/msr.h:11,
> > from ./arch/x86/include/asm/processor.h:21,
> > from ./arch/x86/include/asm/cpufeature.h:8,
> > from ./arch/x86/include/asm/thread_info.h:53,
> > from ./include/linux/thread_info.h:38,
> > from ./arch/x86/include/asm/preempt.h:7,
> > from ./include/linux/preempt.h:81,
> > from ./include/linux/rcupdate.h:40,
> > from ./include/linux/rculist.h:11,
> > from ./include/linux/pid.h:5,
> > from ./include/linux/sched.h:14,
> > from ./include/linux/blkdev.h:5,
> > from block/kyber-iosched.c:21:
> > In function ‘strlcpy’,
> > inlined from ‘perf_trace_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
> > ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
> > __write_overflow();
> > ^~~~~~~~~~~~~~~~~~
> > In function ‘strlcpy’,
> > inlined from ‘trace_event_raw_event_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
> > ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
> > __write_overflow();
> > ^~~~~~~~~~~~~~~~~~
> > make[1]: *** [scripts/Makefile.build:293: block/kyber-iosched.o] Error 1
> > make: *** [Makefile:1063: block] Error 2
> > make: *** Waiting for unfinished jobs....
> >
> > Using 'strlcpy' function is generally not recommended[3][4].
>
> Due to the macros, this was a little tricky to find, but it looks like
> a cut/paste typo:
>
> #define DOMAIN_LEN 16
> #define LATENCY_TYPE_LEN 8
>
> strlcpy(__entry->domain, domain, DOMAIN_LEN);
> strlcpy(__entry->type, type, DOMAIN_LEN);
>
> This should use strscpy() regardless, and should use sizeof(dst)
> instead of separate literals. The primary bug is using DOMAIN_LEN for
> __entry->type when it is actually LATENCY_TYPE_LEN bytes.
>
> Can you build a patch for this? I'm happy to review.
>
> Thanks for finding this!
Sorry, I forgot to reply to this thread, but Jens queued up a fix for
this already:
http://git.kernel.dk/cgit/linux-block/commit/?h=for-linus&id=18e962ac0781bcb70d433de3b2a325ff792b4288
next prev parent reply other threads:[~2018-11-15 0:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-10 14:15 "kyber: add tracepoints" causes write beyond size of object Jordan Glover
2018-11-14 23:23 ` Kees Cook
2018-11-15 0:06 ` Omar Sandoval [this message]
2018-11-15 0:23 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181115000603.GA2313@vader \
--to=osandov@osandov.com \
--cc=Golden_Miller83@protonmail.ch \
--cc=axboe@kernel.dk \
--cc=danielmicay@gmail.com \
--cc=keescook@chromium.org \
--cc=linux-block@vger.kernel.org \
--cc=osandov@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox