From: Eric Biggers <ebiggers@kernel.org>
To: Kees Cook <keescook@chromium.org>
Cc: tytso@mit.edu, Andreas Dilger <adilger.kernel@dilger.ca>,
Nathan Chancellor <nathan@kernel.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Tom Rix <trix@redhat.com>,
linux-kernel@vger.kernel.org, linux-ext4@vger.kernel.org,
llvm@lists.linux.dev, linux-hardening@vger.kernel.org
Subject: Re: [PATCH] ext4: Fix function prototype mismatch for ext4_feat_ktype
Date: Tue, 3 Jan 2023 22:43:37 -0800 [thread overview]
Message-ID: <Y7UgGSoeB+3yQD8V@sol.localdomain> (raw)
In-Reply-To: <Y7THENi5v2+fgUAc@gmail.com>
On Wed, Jan 04, 2023 at 12:23:44AM +0000, Eric Biggers wrote:
> I'm also surprised that this wasn't found earlier. Is it possible that CFI does
> not actually distinguish between the two function prototypes here?
>
It's because this code is only reached when ext4 is a loadable module and it is
being unloaded. I can reproduce the CFI failure by doing that.
In addition to the naming tweak I requested, can you also add Fixes and Cc
stable tags?
By the way, here's the log from the CFI failure I got:
[ 16.412498] CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698)
[ 16.413716] invalid opcode: 0000 [#1] PREEMPT SMP
[ 16.414299] CPU: 2 PID: 179 Comm: rmmod Tainted: G T 6.2.0-rc2 #28
[ 16.415223] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.1-1-1 04/01/2014
[ 16.416383] RIP: 0010:kobject_put+0xbb/0x1b0
[ 16.416926] Code: df e8 f9 03 00 00 4d 85 e4 74 24 49 83 3c 24 00 74 1d 0f 1f 44 00 00 48 89 df 4d 8b 1c 24 41 ba 68 59 b5 9
[ 16.419199] RSP: 0018:ffffc90000283e20 EFLAGS: 00010a13
[ 16.419842] RAX: 0000000000000000 RBX: ffff88800436c9c0 RCX: 0000000000000000
[ 16.420719] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88800436c9c0
[ 16.421595] RBP: ffffc90000283e40 R08: 0000000000000000 R09: 0000000000000000
[ 16.422465] R10: 0000000017461662 R11: ffffffff81216a20 R12: ffffffffa00f9510
[ 16.423330] R13: 0000000000000000 R14: ffff88800436ca80 R15: ffff888007643950
[ 16.424207] FS: 00007f7bf573f740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[ 16.425188] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 16.425814] CR2: 0000561eb661f818 CR3: 00000000074c9000 CR4: 00000000003506e0
[ 16.426574] Call Trace:
[ 16.426862] <TASK>
[ 16.427098] ext4_exit_sysfs+0x14/0x60 [ext4]
[ 16.427604] cleanup_module+0x67/0xedb [ext4]
[ 16.428099] __se_sys_delete_module+0x22d/0x3e0
[ 16.428593] ? syscall_enter_from_user_mode+0x2a/0x1d0
[ 16.429142] ? syscall_enter_from_user_mode+0x2a/0x1d0
[ 16.429694] __x64_sys_delete_module+0x11/0x20
[ 16.430173] do_syscall_64+0x53/0xb0
[ 16.430562] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 16.431151] RIP: 0033:0x7f7bf584ccfb
[ 16.431544] Code: 73 01 c3 48 8b 0d 8d f0 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 8
[ 16.433517] RSP: 002b:00007fff7d959068 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[ 16.434327] RAX: ffffffffffffffda RBX: 0000561eb6615750 RCX: 00007f7bf584ccfb
[ 16.435090] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000561eb66157b8
[ 16.435852] RBP: 0000000000000000 R08: 1999999999999999 R09: 0000000000000000
[ 16.436617] R10: 00007f7bf58c2ac0 R11: 0000000000000206 R12: 0000000000000000
[ 16.437472] R13: 00007fff7d9592d0 R14: 00007fff7d959d80 R15: 0000561eb66152a0
[ 16.438307] </TASK>
[ 16.438552] Modules linked in: ext4(-) crc32c_generic mbcache crc16 jbd2
[ 16.439321] ---[ end trace 0000000000000000 ]---
[ 16.439829] RIP: 0010:kobject_put+0xbb/0x1b0
[ 16.440294] Code: df e8 f9 03 00 00 4d 85 e4 74 24 49 83 3c 24 00 74 1d 0f 1f 44 00 00 48 89 df 4d 8b 1c 24 41 ba 68 59 b5 9
[ 16.442310] RSP: 0018:ffffc90000283e20 EFLAGS: 00010a13
[ 16.442960] RAX: 0000000000000000 RBX: ffff88800436c9c0 RCX: 0000000000000000
[ 16.443719] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88800436c9c0
[ 16.444472] RBP: ffffc90000283e40 R08: 0000000000000000 R09: 0000000000000000
[ 16.445231] R10: 0000000017461662 R11: ffffffff81216a20 R12: ffffffffa00f9510
[ 16.446012] R13: 0000000000000000 R14: ffff88800436ca80 R15: ffff888007643950
[ 16.446779] FS: 00007f7bf573f740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[ 16.447658] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 16.448276] CR2: 0000561eb661f818 CR3: 00000000074c9000 CR4: 00000000003506e0
next prev parent reply other threads:[~2023-01-04 6:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-03 23:46 [PATCH] ext4: Fix function prototype mismatch for ext4_feat_ktype Kees Cook
2023-01-04 0:12 ` Nathan Chancellor
2023-01-04 0:23 ` Eric Biggers
2023-01-04 6:43 ` Eric Biggers [this message]
2023-01-04 0:55 ` Gustavo A. R. Silva
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y7UgGSoeB+3yQD8V@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=adilger.kernel@dilger.ca \
--cc=keescook@chromium.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=trix@redhat.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox