* "kyber: add tracepoints" causes write beyond size of object
@ 2018-11-10 14:15 Jordan Glover
2018-11-14 23:23 ` Kees Cook
0 siblings, 1 reply; 4+ messages in thread
From: Jordan Glover @ 2018-11-10 14:15 UTC (permalink / raw)
To: linux-block@vger.kernel.org
Cc: Jens Axboe, Omar Sandoval, Kees Cook, Daniel Micay
Hello,
Commit 6c3b7af1c975b87b86dcb2af233d1ae21eb05107 ("kyber: add tracepoints")[=
1] causes write beyond size of object. This was detected by "FORTIFY_SOURCE=
intra-object overflow checking"[2] feature which is part of linux-hardened=
out-of-tree patchset designed to catch such errors.
The specific error is:
In file included from ./include/linux/bitmap.h:9,
from ./include/linux/cpumask.h:12,
from ./arch/x86/include/asm/cpumask.h:5,
from ./arch/x86/include/asm/msr.h:11,
from ./arch/x86/include/asm/processor.h:21,
from ./arch/x86/include/asm/cpufeature.h:8,
from ./arch/x86/include/asm/thread_info.h:53,
from ./include/linux/thread_info.h:38,
from ./arch/x86/include/asm/preempt.h:7,
from ./include/linux/preempt.h:81,
from ./include/linux/rcupdate.h:40,
from ./include/linux/rculist.h:11,
from ./include/linux/pid.h:5,
from ./include/linux/sched.h:14,
from ./include/linux/blkdev.h:5,
from block/kyber-iosched.c:21:
In function =E2=80=98strlcpy=E2=80=99,
inlined from =E2=80=98perf_trace_kyber_latency=E2=80=99 at ./include/tr=
ace/events/kyber.h:14:1:
./include/linux/string.h:310:4: error: call to =E2=80=98__write_overflow=
=E2=80=99 declared with attribute error: detected write beyond size of obje=
ct passed as 1st parameter
__write_overflow();
^~~~~~~~~~~~~~~~~~
In function =E2=80=98strlcpy=E2=80=99,
inlined from =E2=80=98trace_event_raw_event_kyber_latency=E2=80=99 at .=
/include/trace/events/kyber.h:14:1:
./include/linux/string.h:310:4: error: call to =E2=80=98__write_overflow=
=E2=80=99 declared with attribute error: detected write beyond size of obje=
ct passed as 1st parameter
__write_overflow();
^~~~~~~~~~~~~~~~~~
make[1]: *** [scripts/Makefile.build:293: block/kyber-iosched.o] Error 1
make: *** [Makefile:1063: block] Error 2
make: *** Waiting for unfinished jobs....
Using 'strlcpy' function is generally not recommended[3][4].
Jordan
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm=
it/?h=3Dv4.20-rc1&id=3D6c3b7af1c975b87b86dcb2af233d1ae21eb05107
[2] https://github.com/anthraxx/linux-hardened/commit/9460692de8eb53fd62d59=
f564eba215e7c03a34b
[3] https://lwn.net/Articles/763641/
[4] https://outflux.net/slides/2018/lss/danger.pdf
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: "kyber: add tracepoints" causes write beyond size of object
2018-11-10 14:15 "kyber: add tracepoints" causes write beyond size of object Jordan Glover
@ 2018-11-14 23:23 ` Kees Cook
2018-11-15 0:06 ` Omar Sandoval
0 siblings, 1 reply; 4+ messages in thread
From: Kees Cook @ 2018-11-14 23:23 UTC (permalink / raw)
To: Jordan Glover
Cc: linux-block@vger.kernel.org, Jens Axboe, Omar Sandoval,
Daniel Micay
On Sat, Nov 10, 2018 at 8:15 AM, Jordan Glover
<Golden_Miller83@protonmail.ch> wrote:
> Hello,
>
> Commit 6c3b7af1c975b87b86dcb2af233d1ae21eb05107 ("kyber: add tracepoints")[1] causes write beyond size of object. This was detected by "FORTIFY_SOURCE intra-object overflow checking"[2] feature which is part of linux-hardened out-of-tree patchset designed to catch such errors.
>
> The specific error is:
>
> In file included from ./include/linux/bitmap.h:9,
> from ./include/linux/cpumask.h:12,
> from ./arch/x86/include/asm/cpumask.h:5,
> from ./arch/x86/include/asm/msr.h:11,
> from ./arch/x86/include/asm/processor.h:21,
> from ./arch/x86/include/asm/cpufeature.h:8,
> from ./arch/x86/include/asm/thread_info.h:53,
> from ./include/linux/thread_info.h:38,
> from ./arch/x86/include/asm/preempt.h:7,
> from ./include/linux/preempt.h:81,
> from ./include/linux/rcupdate.h:40,
> from ./include/linux/rculist.h:11,
> from ./include/linux/pid.h:5,
> from ./include/linux/sched.h:14,
> from ./include/linux/blkdev.h:5,
> from block/kyber-iosched.c:21:
> In function ‘strlcpy’,
> inlined from ‘perf_trace_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
> ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
> __write_overflow();
> ^~~~~~~~~~~~~~~~~~
> In function ‘strlcpy’,
> inlined from ‘trace_event_raw_event_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
> ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
> __write_overflow();
> ^~~~~~~~~~~~~~~~~~
> make[1]: *** [scripts/Makefile.build:293: block/kyber-iosched.o] Error 1
> make: *** [Makefile:1063: block] Error 2
> make: *** Waiting for unfinished jobs....
>
> Using 'strlcpy' function is generally not recommended[3][4].
Due to the macros, this was a little tricky to find, but it looks like
a cut/paste typo:
#define DOMAIN_LEN 16
#define LATENCY_TYPE_LEN 8
strlcpy(__entry->domain, domain, DOMAIN_LEN);
strlcpy(__entry->type, type, DOMAIN_LEN);
This should use strscpy() regardless, and should use sizeof(dst)
instead of separate literals. The primary bug is using DOMAIN_LEN for
__entry->type when it is actually LATENCY_TYPE_LEN bytes.
Can you build a patch for this? I'm happy to review.
Thanks for finding this!
-Kees
>
> Jordan
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.20-rc1&id=6c3b7af1c975b87b86dcb2af233d1ae21eb05107
>
> [2] https://github.com/anthraxx/linux-hardened/commit/9460692de8eb53fd62d59f564eba215e7c03a34b
>
> [3] https://lwn.net/Articles/763641/
>
> [4] https://outflux.net/slides/2018/lss/danger.pdf
--
Kees Cook
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: "kyber: add tracepoints" causes write beyond size of object
2018-11-14 23:23 ` Kees Cook
@ 2018-11-15 0:06 ` Omar Sandoval
2018-11-15 0:23 ` Kees Cook
0 siblings, 1 reply; 4+ messages in thread
From: Omar Sandoval @ 2018-11-15 0:06 UTC (permalink / raw)
To: Kees Cook
Cc: Jordan Glover, linux-block@vger.kernel.org, Jens Axboe,
Omar Sandoval, Daniel Micay
On Wed, Nov 14, 2018 at 05:23:06PM -0600, Kees Cook wrote:
> On Sat, Nov 10, 2018 at 8:15 AM, Jordan Glover
> <Golden_Miller83@protonmail.ch> wrote:
> > Hello,
> >
> > Commit 6c3b7af1c975b87b86dcb2af233d1ae21eb05107 ("kyber: add tracepoints")[1] causes write beyond size of object. This was detected by "FORTIFY_SOURCE intra-object overflow checking"[2] feature which is part of linux-hardened out-of-tree patchset designed to catch such errors.
> >
> > The specific error is:
> >
> > In file included from ./include/linux/bitmap.h:9,
> > from ./include/linux/cpumask.h:12,
> > from ./arch/x86/include/asm/cpumask.h:5,
> > from ./arch/x86/include/asm/msr.h:11,
> > from ./arch/x86/include/asm/processor.h:21,
> > from ./arch/x86/include/asm/cpufeature.h:8,
> > from ./arch/x86/include/asm/thread_info.h:53,
> > from ./include/linux/thread_info.h:38,
> > from ./arch/x86/include/asm/preempt.h:7,
> > from ./include/linux/preempt.h:81,
> > from ./include/linux/rcupdate.h:40,
> > from ./include/linux/rculist.h:11,
> > from ./include/linux/pid.h:5,
> > from ./include/linux/sched.h:14,
> > from ./include/linux/blkdev.h:5,
> > from block/kyber-iosched.c:21:
> > In function ‘strlcpy’,
> > inlined from ‘perf_trace_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
> > ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
> > __write_overflow();
> > ^~~~~~~~~~~~~~~~~~
> > In function ‘strlcpy’,
> > inlined from ‘trace_event_raw_event_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
> > ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
> > __write_overflow();
> > ^~~~~~~~~~~~~~~~~~
> > make[1]: *** [scripts/Makefile.build:293: block/kyber-iosched.o] Error 1
> > make: *** [Makefile:1063: block] Error 2
> > make: *** Waiting for unfinished jobs....
> >
> > Using 'strlcpy' function is generally not recommended[3][4].
>
> Due to the macros, this was a little tricky to find, but it looks like
> a cut/paste typo:
>
> #define DOMAIN_LEN 16
> #define LATENCY_TYPE_LEN 8
>
> strlcpy(__entry->domain, domain, DOMAIN_LEN);
> strlcpy(__entry->type, type, DOMAIN_LEN);
>
> This should use strscpy() regardless, and should use sizeof(dst)
> instead of separate literals. The primary bug is using DOMAIN_LEN for
> __entry->type when it is actually LATENCY_TYPE_LEN bytes.
>
> Can you build a patch for this? I'm happy to review.
>
> Thanks for finding this!
Sorry, I forgot to reply to this thread, but Jens queued up a fix for
this already:
http://git.kernel.dk/cgit/linux-block/commit/?h=for-linus&id=18e962ac0781bcb70d433de3b2a325ff792b4288
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: "kyber: add tracepoints" causes write beyond size of object
2018-11-15 0:06 ` Omar Sandoval
@ 2018-11-15 0:23 ` Kees Cook
0 siblings, 0 replies; 4+ messages in thread
From: Kees Cook @ 2018-11-15 0:23 UTC (permalink / raw)
To: Omar Sandoval
Cc: Jordan Glover, linux-block@vger.kernel.org, Jens Axboe,
Omar Sandoval, Daniel Micay
On Wed, Nov 14, 2018 at 6:06 PM, Omar Sandoval <osandov@osandov.com> wrote:
> On Wed, Nov 14, 2018 at 05:23:06PM -0600, Kees Cook wrote:
>> On Sat, Nov 10, 2018 at 8:15 AM, Jordan Glover
>> <Golden_Miller83@protonmail.ch> wrote:
>> > Hello,
>> >
>> > Commit 6c3b7af1c975b87b86dcb2af233d1ae21eb05107 ("kyber: add tracepoints")[1] causes write beyond size of object. This was detected by "FORTIFY_SOURCE intra-object overflow checking"[2] feature which is part of linux-hardened out-of-tree patchset designed to catch such errors.
>> >
>> > The specific error is:
>> >
>> > In file included from ./include/linux/bitmap.h:9,
>> > from ./include/linux/cpumask.h:12,
>> > from ./arch/x86/include/asm/cpumask.h:5,
>> > from ./arch/x86/include/asm/msr.h:11,
>> > from ./arch/x86/include/asm/processor.h:21,
>> > from ./arch/x86/include/asm/cpufeature.h:8,
>> > from ./arch/x86/include/asm/thread_info.h:53,
>> > from ./include/linux/thread_info.h:38,
>> > from ./arch/x86/include/asm/preempt.h:7,
>> > from ./include/linux/preempt.h:81,
>> > from ./include/linux/rcupdate.h:40,
>> > from ./include/linux/rculist.h:11,
>> > from ./include/linux/pid.h:5,
>> > from ./include/linux/sched.h:14,
>> > from ./include/linux/blkdev.h:5,
>> > from block/kyber-iosched.c:21:
>> > In function ‘strlcpy’,
>> > inlined from ‘perf_trace_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
>> > ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
>> > __write_overflow();
>> > ^~~~~~~~~~~~~~~~~~
>> > In function ‘strlcpy’,
>> > inlined from ‘trace_event_raw_event_kyber_latency’ at ./include/trace/events/kyber.h:14:1:
>> > ./include/linux/string.h:310:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
>> > __write_overflow();
>> > ^~~~~~~~~~~~~~~~~~
>> > make[1]: *** [scripts/Makefile.build:293: block/kyber-iosched.o] Error 1
>> > make: *** [Makefile:1063: block] Error 2
>> > make: *** Waiting for unfinished jobs....
>> >
>> > Using 'strlcpy' function is generally not recommended[3][4].
>>
>> Due to the macros, this was a little tricky to find, but it looks like
>> a cut/paste typo:
>>
>> #define DOMAIN_LEN 16
>> #define LATENCY_TYPE_LEN 8
>>
>> strlcpy(__entry->domain, domain, DOMAIN_LEN);
>> strlcpy(__entry->type, type, DOMAIN_LEN);
>>
>> This should use strscpy() regardless, and should use sizeof(dst)
>> instead of separate literals. The primary bug is using DOMAIN_LEN for
>> __entry->type when it is actually LATENCY_TYPE_LEN bytes.
>>
>> Can you build a patch for this? I'm happy to review.
>>
>> Thanks for finding this!
>
> Sorry, I forgot to reply to this thread, but Jens queued up a fix for
> this already:
>
> http://git.kernel.dk/cgit/linux-block/commit/?h=for-linus&id=18e962ac0781bcb70d433de3b2a325ff792b4288
Ah! Perfect. Thanks! :) I should be late to threads more often. ;)
-kees
--
Kees Cook
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-11-15 0:23 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-11-10 14:15 "kyber: add tracepoints" causes write beyond size of object Jordan Glover
2018-11-14 23:23 ` Kees Cook
2018-11-15 0:06 ` Omar Sandoval
2018-11-15 0:23 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox