* Re: linux kernel security issuses at ses_enclosure_data_process , ses_intf_remove_enclosure, irlmp_seq_hb_idx report
[not found] <----An------QYmAn$4202951b-482d-4d92-98c2-3466de737b40@alibaba-inc.com>
@ 2015-10-19 10:15 ` Dan Carpenter
2015-10-19 10:15 ` [patch 1/2] ses: tighten range checking in ses_enclosure_data_process() Dan Carpenter
2015-10-19 10:16 ` [patch 2/2] ses: invalid free in ses_intf_remove_enclosure() Dan Carpenter
2 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2015-10-19 10:15 UTC (permalink / raw)
To: 程君(成淼)
Cc: security, throber3, James E.J. Bottomley, linux-scsi
Thanks Berry,
James, the first two issues are SCSI things. I'm sending patches for
them but I can't test them myself. Especially, I'm not positive that
[patch 2/2] ses: invalid free in ses_intf_remove_enclosure() is a
complete fix. Berry, would it be possible to test that one?
regards,
dan carpenter
On Mon, Oct 19, 2015 at 01:05:48PM +0800, 程君(成淼) wrote:
>
> Deal all: we find there security issuses in kernel 4.2，aslo check the lastest code，please check them。
> 1. ses_enclosure_data_process heap access overflow
> code：
> static void ses_enclosure_data_process(struct enclosure_device *edev,
> struct scsi_device *sdev,
> int create)
> {
> u32 result;
> unsigned char *buf = NULL, *type_ptr, *desc_ptr, *addl_desc_ptr = NULL;
> int i, j, page7_len, len, components;
> struct ses_device *ses_dev = edev->scratch;
> int types = ses_dev->page1_num_types;
> unsigned char *hdr_buf = kzalloc(INIT_ALLOC_SIZE, GFP_KERNEL);
>
> if (!hdr_buf)
> goto simple_populate;
>
> /* re-read page 10 */
> if (ses_dev->page10)
> ses_recv_diag(sdev, 10, ses_dev->page10, ses_dev->page10_len);
> /* Page 7 for the descriptors is optional */
> result = ses_recv_diag(sdev, 7, hdr_buf, INIT_ALLOC_SIZE);
> if (result)
> goto simple_populate;
>
> page7_len = len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
> /* add 1 for trailing '\0' we'll use */
> buf = kzalloc(len + 1, GFP_KERNEL);
> if (!buf)
> goto simple_populate;
> result = ses_recv_diag(sdev, 7, buf, len);
> if (result) {
> simple_populate:
> kfree(buf);
> buf = NULL;
> desc_ptr = NULL;
> len = 0;
> page7_len = 0;
> } else {
> desc_ptr = buf + 8; // if buf len == 4, heap access overflow
> len = (desc_ptr[2] << 8) + desc_ptr[3];
> /* skip past overall descriptor */
> desc_ptr += len + 4;
> }
> crash info:
>
> ==================================================================
> BUG: KASan: use after free in ses_enclosure_data_process+0xe3a/0xe60 [ses] at addr ffff8800ab03897b
> Read of size 1 by task systemd-udevd/2580
> =============================================================================
> BUG kmalloc-8 (Tainted: G B ): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> INFO: Slab 0xffffea0002ac0e00 objects=512 used=488 fp=0xffff8800ab038f80 flags=0x1ffff0000000080
> INFO: Object 0xffff8800ab038978 @offset=2424 fp=0xffff8800ab038990
>
> Bytes b4 ffff8800ab038968: 69 64 00 ab 00 88 ff ff 08 00 00 00 00 00 00 00 id..............
> Object ffff8800ab038978: 90 89 03 ab 00 88 ff ff ........
> CPU: 0 PID: 2580 Comm: systemd-udevd Tainted: G B 4.2.3 #2
> Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
> ffff8800ab038000 ffff88009bcaf678 ffffffff8280e5b9 0000000000000008
> ffff880118c07e00 ffff88009bcaf6a8 ffffffff8151a739 ffff880118c07e00
> ffffea0002ac0e00 ffff8800ab038978 0000000000000000 ffff88009bcaf6d8
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff8280e5b9>] dump_stack+0x45/0x57 lib/dump_stack.c:50
> [<ffffffff8151a739>] print_trailer+0xf9/0x150 mm/slub.c:650
> [<ffffffff8151f8e8>] object_err+0x38/0x50 mm/slub.c:657
> [< inline >] print_address_description mm/kasan/report.c:120
> [<ffffffff81522288>] kasan_report_error+0x1e8/0x3f0 mm/kasan/report.c:193
> [< inline >] kasan_report mm/kasan/report.c:230
> [<ffffffff815224d3>] __asan_report_load1_noabort+0x43/0x50 mm/kasan/report.c:248
> [<ffffffff81ee8be0>] ? device_private_init+0x190/0x190 drivers/base/core.c:947
> [<ffffffffc0ec33ca>] ? ses_enclosure_data_process+0xe3a/0xe60 [ses] drivers/scsi/ses.c:493
> [<ffffffffc0ec33ca>] ses_enclosure_data_process+0xe3a/0xe60 [ses] drivers/scsi/ses.c:493
> [<ffffffff8281ab34>] ? mutex_lock+0x14/0x60 kernel/locking/mutex.c:97
> [<ffffffffc0ec41ee>] ses_intf_add+0x9ae/0xded [ses] drivers/scsi/ses.c:712
> [<ffffffff81b04100>] ? bust_spinlocks+0xa0/0xa0 ??:?
> [<ffffffff81ef50fe>] class_interface_register+0x21e/0x370 drivers/base/class.c:458
> [<ffffffff81ef4ee0>] ? class_dev_iter_exit+0x10/0x10 drivers/base/class.c:344
> [<ffffffff81b041f0>] ? kvasprintf+0xf0/0xf0 lib/kasprintf.c:31
> [<ffffffffc0ea8000>] ? 0xffffffffc0ea8000
> [<ffffffff81ffcf5c>] scsi_register_interface+0x3c/0x50 drivers/scsi/scsi_sysfs.c:1191
> [<ffffffffc0ea8013>] ses_init+0x13/0x1000 [ses]
> [<ffffffff810021b1>] do_one_initcall+0x141/0x2f0 init/main.c:794
> [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40 init/main.c:924
> [< inline >] ? kasan_poison_shadow mm/kasan/kasan.c:49
> [<ffffffff81521976>] ? kasan_unpoison_shadow+0x36/0x50 mm/kasan/kasan.c:54
> [< inline >] ? kasan_poison_shadow mm/kasan/kasan.c:49
> [<ffffffff81521976>] ? kasan_unpoison_shadow+0x36/0x50 mm/kasan/kasan.c:54
> [< inline >] ? kasan_poison_shadow mm/kasan/kasan.c:49
> [<ffffffff81521976>] ? kasan_unpoison_shadow+0x36/0x50 mm/kasan/kasan.c:54
> [< inline >] ? register_global mm/kasan/kasan.c:49
> [<ffffffff81521a87>] ? __asan_register_globals+0x87/0xa0 mm/kasan/kasan.c:462
> [<ffffffff8280bf94>] do_init_module+0x1d0/0x5a8 kernel/module.c:3231
> [<ffffffff812c84f8>] load_module+0x6c48/0x9570 kernel/module.c:3535
> [<ffffffff812bce00>] ? __symbol_put+0x90/0x90 kernel/module.c:1051
> [<ffffffff812c18b0>] ? module_frob_arch_sections+0x20/0x20 kernel/module.c:3141
> [<ffffffff81575990>] ? open_exec+0x50/0x50 fs/exec.c:808
> [<ffffffff812bd505>] ? copy_module_from_fd.isra.49+0x1b5/0x2c0 kernel/module.c:2721
> [< inline >] SYSC_finit_module kernel/module.c:3618
> [<ffffffff812cb0f8>] SyS_finit_module+0x108/0x130 kernel/module.c:3599
> [<ffffffff812caff0>] ? SyS_init_module+0x1d0/0x1d0 kernel/module.c:3579
> [< inline >] ? trace_sys_exit include/trace/events/syscalls.h:42
> [<ffffffff8105b4f6>] ? syscall_trace_leave+0x246/0x2d0 arch/x86/kernel/ptrace.c:1620
> [<ffffffff8281f59d>] tracesys_phase2+0x88/0x8d arch/x86/entry/entry_64.S:265
> Memory state around the buggy address:
> ffff8800ab038800: fb fb fb fb fb fb fb 00 00 fb fb 00 fb fb fb fb
> ffff8800ab038880: fb fb fb 02 02 02 02 fb 02 02 02 02 fb 00 fb 00
> >ffff8800ab038900: 00 fb 00 fb fb 00 fb 00 00 00 00 00 00 00 05 fb
> ^
> ffff8800ab038980: fb fb fb fb fb fb fb fb fb 00 fb 00 00 fb 00 fb
> ffff8800ab038a00: fb fb 00 00 00 00 fb fb fb fb fb fb fb fb fb fb the same issuse may be exsit in ses_intf_add
>
> result = ses_recv_diag(sdev, 1, hdr_buf, INIT_ALLOC_SIZE);
> if (result)
> goto recv_failed;
>
> len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
> buf = kzalloc(len, GFP_KERNEL);
> if (!buf)
> goto err_free;
>
> result = ses_recv_diag(sdev, 1, buf, len);
> if (result)
> goto recv_failed;
>
> types = 0;
>
> /* we always have one main enclosure and the rest are referred
> * to as secondary subenclosures */
> num_enclosures = buf[1] + 1;
>
> /* begin at the enclosure descriptor */
> type_ptr = buf + 8; // // if len == 4, heap access overflow
>
> 2. out of bounds access in ses_intf_remove_enclosure
>
> 783 static void ses_intf_remove(struct device *cdev,
> 784 struct class_interface *intf)
> 785 {
> 786 struct scsi_device *sdev = to_scsi_device(cdev->parent);
> 787
> 788 if (!scsi_device_enclosure(sdev))
> 789 ses_intf_remove_component(sdev);
> 790 else
> 791 ses_intf_remove_enclosure(sdev); // this branch
> 792 }
>
> 759 static void ses_intf_remove_enclosure(struct scsi_device *sdev)
> 760 {
> 761 struct enclosure_device *edev;
> 762 struct ses_device *ses_dev;
> 763
> 764 /* exact match to this enclosure */
> 765 edev = enclosure_find(&sdev->sdev_gendev, NULL);
> 766 if (!edev)
> 767 return;
> 768
> 769 ses_dev = edev->scratch;
> 770 edev->scratch = NULL;
> 771
> 772 kfree(ses_dev->page10);
> 773 kfree(ses_dev->page1);
> 774 kfree(ses_dev->page2);
> 775 kfree(ses_dev);
> 776
> 777 kfree(edev->component[0].scratch); // bad
> 778
> 779 put_device(&edev->edev);
> 780 enclosure_unregister(edev);
> 781 }
>
>
> crash info：
>
> ==================================================================
> BUG: KASan: out of bounds access in ses_intf_remove+0x25d/0x270 [ses] at addr ffff88006545b6e8
> Read of size 8 by task pool/17977
> =============================================================================
> BUG kmalloc-1024 (Tainted: G B ): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> INFO: Slab 0xffffea0001951600 objects=32 used=13 fp=0xffff88006545f400 flags=0x1ffff0000004080
> INFO: Object 0xffff88006545b400 @offset=13312 fp=0x (null)
>
> Bytes b4 ffff88006545b3f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b400: 00 00 00 00 00 00 00 00 60 c4 e4 c0 ff ff ff ff ........`.......
> Object ffff88006545b410: 60 c4 e4 c0 ff ff ff ff 68 29 9a a4 00 88 ff ff `.......h)......
> Object ffff88006545b420: 40 54 19 2c 00 88 ff ff 30 ea d0 a4 00 88 ff ff @T.,....0.......
> Object ffff88006545b430: c0 24 06 85 00 88 ff ff 40 2c 9a a4 00 88 ff ff .$......@,......
> Object ffff88006545b440: e0 21 f0 b4 00 88 ff ff 80 f7 ec 17 01 88 ff ff .!..............
> Object ffff88006545b450: 80 fd 4d 83 ff ff ff ff 30 8c 6d 57 00 88 ff ff ..M.....0.mW....
> Object ffff88006545b460: 04 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b470: 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
> Object ffff88006545b480: 80 b4 45 65 00 88 ff ff 80 b4 45 65 00 88 ff ff ..Ee......Ee....
> Object ffff88006545b490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b4c0: 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b4d0: 60 25 06 85 00 88 ff ff e0 2c 9a a4 00 88 ff ff `%.......,......
> Object ffff88006545b4e0: ff ff ff 7f 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b4f0: f0 b4 45 65 00 88 ff ff f0 b4 45 65 00 88 ff ff ..Ee......Ee....
> Object ffff88006545b500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b520: 00 00 00 00 00 00 00 00 90 c8 f0 81 ff ff ff ff ................
> Object ffff88006545b530: 18 b4 45 65 00 88 ff ff 00 00 00 00 ff ff ff ff ..Ee............
> Object ffff88006545b540: ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b560: 00 00 00 00 00 00 00 00 e0 ff ff ff 0f 00 00 00 ................
> Object ffff88006545b570: 70 b5 45 65 00 88 ff ff 70 b5 45 65 00 88 ff ff p.Ee....p.Ee....
> Object ffff88006545b580: b0 d8 f0 81 ff ff ff ff 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b590: 90 b5 45 65 00 88 ff ff 90 b5 45 65 00 88 ff ff ..Ee......Ee....
> Object ffff88006545b5a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b5b0: 81 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................
> Object ffff88006545b5c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b5d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b5e0: 83 c2 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b5f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b610: ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b630: 00 00 00 00 00 00 00 00 38 b6 45 65 00 88 ff ff ........8.Ee....
> Object ffff88006545b640: 38 b6 45 65 00 88 ff ff 00 00 00 00 00 00 00 00 8.Ee............
> Object ffff88006545b650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b680: 80 b6 45 65 00 88 ff ff 80 b6 45 65 00 88 ff ff ..Ee......Ee....
> Object ffff88006545b690: a8 2e 28 5c 00 88 ff ff b0 2e 28 5c 00 88 ff ff ..(\......(\....
> Object ffff88006545b6a0: b0 2e 28 5c 00 88 ff ff 01 00 00 00 00 00 00 00 ..(\............
> Object ffff88006545b6b0: 60 c3 e4 c0 ff ff ff ff 00 00 00 00 00 00 00 00 `...............
> Object ffff88006545b6c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b6d0: 00 00 00 00 00 00 00 00 20 61 ec c0 ff ff ff ff ........ a......
> Object ffff88006545b6e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b6f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b7d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> Object ffff88006545b7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> CPU: 3 PID: 17977 Comm: pool Tainted: G B 4.2.3 #2
> Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
> ffff880065458000 ffff8800a50674b8 ffffffff8280e5b9 0000000000000400
> ffff880118c07500 ffff8800a50674e8 ffffffff8151a739 ffff880118c07500
> ffffea0001951600 ffff88006545b400 ffffffffc0ec60c0 ffff8800a5067518
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff8280e5b9>] dump_stack+0x45/0x57 lib/dump_stack.c:50
> [<ffffffff8151a739>] print_trailer+0xf9/0x150 mm/slub.c:650
> [<ffffffff8151f8e8>] object_err+0x38/0x50 mm/slub.c:657
> [< inline >] print_address_description mm/kasan/report.c:120
> [<ffffffff81522288>] kasan_report_error+0x1e8/0x3f0 mm/kasan/report.c:193
> [<ffffffff82025dec>] ? sg_device_destroy+0xec/0x190 drivers/scsi/sg.c:1551
> [< inline >] kasan_report mm/kasan/report.c:230
> [<ffffffff815225c3>] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:251
> [< inline >] ? ses_intf_remove_enclosure drivers/scsi/ses.c:777
> [<ffffffffc0ec02ed>] ? ses_intf_remove+0x25d/0x270 [ses] drivers/scsi/ses.c:791
> [< inline >] ses_intf_remove_enclosure drivers/scsi/ses.c:777
> [<ffffffffc0ec02ed>] ses_intf_remove+0x25d/0x270 [ses] drivers/scsi/ses.c:791
> [<ffffffff81ee5f5a>] device_del+0x2ba/0x6b0 drivers/base/core.c:1210
> [<ffffffff81ee5ca0>] ? cleanup_device_parent+0xf0/0xf0 drivers/base/core.c:793
> [< inline >] ? kobject_cleanup lib/kobject.c:635
> [<ffffffff81ad6239>] ? kobject_release+0x139/0x3a0 lib/kobject.c:658
> [<ffffffff81ee6372>] device_unregister+0x22/0xb0 drivers/base/core.c:1250
> [<ffffffff81ffdf6a>] __scsi_remove_device+0x1aa/0x210 drivers/scsi/scsi_sysfs.c:1075
> [<ffffffff81ffa16f>] scsi_forget_host+0x10f/0x1c0 drivers/scsi/scsi_scan.c:1862
> [< inline >] ? spin_unlock_irqrestore include/linux/spinlock.h:372
> [<ffffffff81f0ca15>] ? __pm_runtime_resume+0x85/0xa0 drivers/base/power/runtime.c:962
> [<ffffffff81fd2635>] scsi_remove_host+0xd5/0x210 drivers/scsi/hosts.c:173
> [<ffffffffc0e7cbe1>] usb_stor_disconnect+0xe1/0x200 [usb_storage]
> [<ffffffff82134d81>] usb_unbind_interface+0x161/0x830 drivers/usb/core/driver.c:411
> [<ffffffff81f09929>] ? rpm_idle+0x29/0x5b0 drivers/base/power/runtime.c:305
> [<ffffffff81ef149a>] __device_release_driver+0x17a/0x3c0 drivers/base/dd.c:662
> [<ffffffff81eee180>] ? unbind_store+0x270/0x270 drivers/base/bus.c:189
> [<ffffffff81ef1703>] device_release_driver+0x23/0x30 drivers/base/dd.c:693
> [<ffffffff81eefce4>] bus_remove_device+0x2d4/0x590 drivers/base/bus.c:601
> [<ffffffff81ee6026>] device_del+0x386/0x6b0 drivers/base/core.c:1217
> [< inline >] ? kref_sub include/linux/kref.h:74
> [< inline >] ? kref_put include/linux/kref.h:99
> [<ffffffff81ad5e66>] ? kobject_put+0x56/0xa0 lib/kobject.c:675
> [<ffffffff81ee5ca0>] ? cleanup_device_parent+0xf0/0xf0 drivers/base/core.c:793
> [<ffffffff82140f9c>] ? usb_remove_ep_devs+0x3c/0x80 drivers/usb/core/endpoint.c:214
> [<ffffffff8212bcaa>] ? remove_intf_ep_devs+0xfa/0x1a0 drivers/usb/core/message.c:1047
> [<ffffffff8212d2e5>] usb_disable_device+0x1d5/0x6e0 drivers/usb/core/message.c:1172
> [<ffffffff816c6fc0>] ? sysfs_kf_bin_read+0x2d0/0x2d0 fs/sysfs/file.c:86
> [<ffffffff8212eee6>] usb_set_configuration+0x236/0x1600 drivers/usb/core/message.c:1766
> [<ffffffff8144b840>] ? __alloc_pages_direct_compact+0x280/0x280 include/linux/mm.h:881
> [< inline >] ? perf_event_mmap_event kernel/events/core.c:5923
> [<ffffffff81415da0>] ? perf_event_mmap+0x510/0x9d0 kernel/events/core.c:5957
> [<ffffffff816c6fc0>] ? sysfs_kf_bin_read+0x2d0/0x2d0 fs/sysfs/file.c:86
> [<ffffffff8213ef55>] remove_store+0x75/0x90 drivers/usb/core/sysfs.c:669
> [<ffffffff81ee3fa0>] ? component_add+0x350/0x350 ??:?
> [<ffffffff81ee3fdc>] dev_attr_store+0x3c/0x70 drivers/base/core.c:137
> [< inline >] ? kasan_poison_shadow mm/kasan/kasan.c:49
> [<ffffffff815219ee>] ? kasan_kmalloc+0x5e/0x70 mm/kasan/kasan.c:353
> [<ffffffff816c70f1>] sysfs_kf_write+0x131/0x200 fs/sysfs/file.c:131
> [<ffffffff816c4bed>] kernfs_fop_write+0x1fd/0x3a0 fs/kernfs/file.c:312
> [<ffffffff815651e0>] __vfs_write+0xe0/0x3e0 fs/read_write.c:489
> [< inline >] ? set_pte_at ./arch/x86/include/asm/paravirt.h:524
> [< inline >] ? do_anonymous_page mm/memory.c:2721
> [< inline >] ? handle_pte_fault mm/memory.c:3258
> [< inline >] ? __handle_mm_fault mm/memory.c:3379
> [<ffffffff814b654a>] ? handle_mm_fault+0x160a/0x3470 mm/memory.c:3408
> [<ffffffff81565100>] ? __vfs_read+0x3d0/0x3d0 fs/read_write.c:419
> [<ffffffff819b5470>] ? common_perm+0x160/0x160 security/apparmor/lsm.c:159
> [< inline >] ? percpu_counter_add include/linux/percpu_counter.h:53
> [< inline >] ? percpu_counter_inc include/linux/percpu_counter.h:177
> [<ffffffff8156d3bb>] ? __sb_start_write+0xfb/0x2a0 fs/super.c:1204
> [<ffffffff814b4f40>] ? copy_page_range+0x12b0/0x12b0 mm/memory.c:1024
> [<ffffffff8156d2c0>] ? __sb_end_write+0xc0/0xc0 include/linux/list.h:189
> [<ffffffff819b6c18>] ? apparmor_file_permission+0x18/0x20 security/apparmor/lsm.c:446
> [<ffffffff818fb8bf>] ? security_file_permission+0x6f/0x1b0 security/security.c:738
> [<ffffffff815665fc>] ? rw_verify_area+0xbc/0x290 fs/read_write.c:404
> [<ffffffff81566be9>] vfs_write+0x139/0x4c0 fs/read_write.c:538
> [< inline >] SYSC_write fs/read_write.c:585
> [<ffffffff815699fe>] SyS_write+0x10e/0x230 fs/read_write.c:577
> [<ffffffff815698f0>] ? SyS_read+0x230/0x230 fs/read_write.c:559
> [<ffffffff8110dc1f>] ? do_page_fault+0x2f/0x80 arch/x86/mm/fault.c:1298
> [<ffffffff8281f472>] entry_SYSCALL_64_fastpath+0x16/0x75 arch/x86/entry/entry_64.S:186
> Memory state around the buggy address:
> ffff88006545b580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff88006545b600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> >ffff88006545b680: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
> ^
> ffff88006545b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ffff88006545b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>
> 3. out of bounds on stack in irlmp_seq_hb_idx
> irlmp_seq_start-> v = irlmp_seq_hb_idx(iter, &off);->irlmp_seq_hb_idx
> static void *irlmp_seq_start(struct seq_file *seq, loff_t *pos)
> {
> struct irlmp_iter_state *iter = seq->private;
> void *v;
> loff_t off = *pos;
>
> iter->hashbin = NULL;
> if (off-- == 0)
> return LSAP_START_TOKEN;
>
> iter->hashbin = irlmp->unconnected_lsaps;
> v = irlmp_seq_hb_idx(iter, &off); // local var stack address
> if (v)
> return v;
>
> if (off-- == 0)
> return LINK_START_TOKEN;
>
> iter->hashbin = irlmp->links;
> return irlmp_seq_hb_idx(iter, &off);
> }
>
> static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off)
> {
> void *element;
>
> spin_lock_irq(&iter->hashbin->hb_spinlock);
> for (element = hashbin_get_first(iter->hashbin);
> element != NULL;
> element = hashbin_get_next(iter->hashbin)) {
> if (!off || *off-- == 0) { // out of on stack
> /* NB: hashbin left locked */
> return element;
> }
> }
> spin_unlock_irq(&iter->hashbin->hb_spinlock);
> iter->hashbin = NULL;
> return NULL;
> }
>
> carsh info:
>
> BUG: KASan: out of bounds on stack in irlmp_seq_hb_idx+0x16c/0x1a0 [irda] at addr ffff880022c4f248
> Read of size 8 by task trinity-c6/19325
> page:ffffea00008b13c0 count:0 mapcount:0 mapping: (null) index:0x0
> flags: 0x1ffff0000000000()
> page dumped because: kasan: bad access detected
> CPU: 0 PID: 19325 Comm: trinity-c6 Tainted: G B 4.2.3 #2
> Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
> ffff8801128089e0 ffff880022c4f108 ffffffff8280e5b9 1ffffd400011627f
> ffff880022c4f1a0 ffff880022c4f188 ffffffff81522458 0000000000000010
> 0000000000000000 0000000000000046 ffffed0004589e4a 666666208106f6c0
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff8280e5b9>] dump_stack+0x45/0x57 lib/dump_stack.c:50
> [< inline >] print_address_description mm/kasan/report.c:132
> [<ffffffff81522458>] kasan_report_error+0x3b8/0x3f0 mm/kasan/report.c:193
> [< inline >] kasan_report mm/kasan/report.c:230
> [<ffffffff815225c3>] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:251
> [<ffffffffc0af6bac>] ? irlmp_seq_hb_idx+0x16c/0x1a0 [irda] net/irda/irlmp.c:1842
> [<ffffffffc0af6bac>] irlmp_seq_hb_idx+0x16c/0x1a0 [irda] net/irda/irlmp.c:1842
> [<ffffffffc0af6fb7>] irlmp_seq_start+0x147/0x230 [irda] net/irda/irlmp.c:1864
> [<ffffffffc0af6e70>] ? irlmp_seq_next+0x290/0x290 [irda] net/irda/irlmp.c:1888
> [<ffffffff815cd4b0>] seq_read+0x280/0x1150 fs/seq_file.c:225
> [<ffffffff81521bb8>] ? kasan_alloc_pages+0x38/0x40 mm/kasan/kasan.c:292
> [<ffffffff815cd230>] ? seq_lseek+0x370/0x370 fs/seq_file.c:321
> [<ffffffff81621010>] ? __fsnotify_inode_delete+0x10/0x10 fs/notify/fsnotify.c:37
> [< inline >] ? copy_from_user ./arch/x86/include/asm/uaccess.h:718
> [<ffffffff81569e60>] ? rw_copy_check_uvector+0x80/0x270 fs/read_write.c:733
> [<ffffffff816957d1>] proc_reg_read+0xc1/0x180 fs/proc/inode.c:202
> [<ffffffff81b0b91d>] ? import_iovec+0x9d/0x420 lib/iov_iter.c:802
> [<ffffffff81565608>] do_loop_readv_writev+0x128/0x1e0 fs/read_write.c:680
> [< inline >] ? fsnotify_perm include/linux/fsnotify.h:60
> [<ffffffff818fb99d>] ? security_file_permission+0x14d/0x1b0 security/security.c:742
> [<ffffffff81695710>] ? proc_reg_write+0x180/0x180 fs/proc/internal.h:82
> [<ffffffff81695710>] ? proc_reg_write+0x180/0x180 fs/proc/internal.h:82
> [<ffffffff815674f0>] do_readv_writev+0x580/0x690 fs/read_write.c:810
> [<ffffffff81566f70>] ? vfs_write+0x4c0/0x4c0 include/linux/sched.h:3096
> [<ffffffff817a448c>] ? __ext4_handle_dirty_metadata+0x4c/0x5d0 fs/ext4/ext4_jbd2.c:264
> [< inline >] ? touch_buffer fs/buffer.c:64
> [<ffffffff81602f1a>] ? __find_get_block+0x1ca/0x2a0 fs/buffer.c:1375
> [< inline >] ? brelse include/linux/buffer_head.h:287
> [< inline >] ? ext4_do_update_inode fs/ext4/inode.c:4503
> [<ffffffff816f7b60>] ? ext4_mark_iloc_dirty+0x13c0/0x24d0 fs/ext4/inode.c:4937
> [<ffffffff81567669>] vfs_readv+0x69/0xa0 fs/read_write.c:834
> [< inline >] kernel_readv fs/splice.c:582
> [<ffffffff815f7010>] default_file_splice_read+0x470/0x8f0 fs/splice.c:658
> [<ffffffff815f6ba0>] ? generic_file_splice_read+0x1e0/0x1e0 fs/splice.c:531
> [<ffffffff817f6220>] ? jbd2_buffer_abort_trigger+0x80/0x80 fs/jbd2/transaction.c:1277
> [<ffffffff815f2140>] ? page_cache_pipe_buf_release+0x70/0x70 fs/splice.c:91
> [<ffffffff815e9eb0>] ? __mark_inode_dirty+0x440/0x9e0 fs/fs-writeback.c:2015
> [<ffffffff816ffcd8>] ? ext4_da_write_end+0x378/0x820 fs/ext4/inode.c:2782
> [<ffffffff816fdd10>] ? ext4_write_begin+0x980/0x980 fs/ext4/ext4_jbd2.h:399
> [< inline >] ? kasan_poison_shadow mm/kasan/kasan.c:49
> [<ffffffff815219ee>] ? kasan_kmalloc+0x5e/0x70 mm/kasan/kasan.c:353
> [<ffffffff81430cfc>] ? generic_perform_write+0x31c/0x500 mm/filemap.c:2527
> [< inline >] ? spin_lock include/linux/spinlock.h:312
> [< inline >] ? __fsnotify_d_instantiate include/linux/fsnotify_backend.h:289
> [< inline >] ? fsnotify_d_instantiate include/linux/fsnotify.h:25
> [<ffffffff815a8b4f>] ? __d_instantiate+0x18f/0x390 fs/dcache.c:1763
> [<ffffffff815665fc>] ? rw_verify_area+0xbc/0x290 fs/read_write.c:404
> [<ffffffff815f4349>] do_splice_to+0xd9/0x120 fs/splice.c:1142
> [<ffffffff815f45cd>] splice_direct_to_actor+0x23d/0x7b0 fs/splice.c:1214
> [<ffffffff815f1af0>] ? generic_pipe_buf_nosteal+0x10/0x10 fs/splice.c:560
> [<ffffffff815f4390>] ? do_splice_to+0x120/0x120 fs/splice.c:1137
> [<ffffffff818fb8bf>] ? security_file_permission+0x6f/0x1b0 security/security.c:738
> [<ffffffff815665fc>] ? rw_verify_area+0xbc/0x290 fs/read_write.c:404
> [<ffffffff81aed4cd>] ? timerqueue_add+0x12d/0x2f0 lib/timerqueue.c:57
> [<ffffffff815f4c99>] do_splice_direct+0x159/0x270 fs/splice.c:1325
> [<ffffffff812824ab>] ? enqueue_hrtimer+0xdb/0x1e0 kernel/time/hrtimer.c:877
> [<ffffffff815f4b40>] ? splice_direct_to_actor+0x7b0/0x7b0 include/linux/fs.h:1920
> [<ffffffff815665fc>] ? rw_verify_area+0xbc/0x290 fs/read_write.c:404
> [<ffffffff81568a61>] do_sendfile+0x5f1/0x1250 fs/read_write.c:1227
> [<ffffffff81283f60>] ? hrtimer_init+0x100/0x100 include/trace/events/timer.h:134
> [<ffffffff81568470>] ? __compat_sys_pwritev64+0xc0/0xc0 fs/read_write.c:1128
> [< inline >] ? hrtimer_start include/linux/hrtimer.h:370
> [<ffffffff812878f6>] ? do_setitimer+0x4b6/0x610 kernel/time/itimer.c:222
> [< inline >] SYSC_sendfile64 fs/read_write.c:1288
> [<ffffffff8156b031>] SyS_sendfile64+0xf1/0x100 fs/read_write.c:1274
> [<ffffffff8156af40>] ? SyS_sendfile+0xd0/0xd0 fs/read_write.c:1271
> [<ffffffff8110dc1f>] ? do_page_fault+0x2f/0x80 arch/x86/mm/fault.c:1298
> [<ffffffff8281f472>] entry_SYSCALL_64_fastpath+0x16/0x75 arch/x86/entry/entry_64.S:186
> Memory state around the buggy address:
> ffff880022c4f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff880022c4f180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> >ffff880022c4f200: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f4 f4 f4 f3
> ^
> ffff880022c4f280: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff880022c4f300: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
> ==================================================================
> ==================================================================
>
> Sorry for webmail format. Hope to receive your reply as soon as possible. Best regards
> Berry Cheng @ Alibaba mobile security Team
>
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread* [patch 1/2] ses: tighten range checking in ses_enclosure_data_process()
[not found] <----An------QYmAn$4202951b-482d-4d92-98c2-3466de737b40@alibaba-inc.com>
2015-10-19 10:15 ` linux kernel security issuses at ses_enclosure_data_process , ses_intf_remove_enclosure, irlmp_seq_hb_idx report Dan Carpenter
@ 2015-10-19 10:15 ` Dan Carpenter
2015-10-19 10:16 ` [patch 2/2] ses: invalid free in ses_intf_remove_enclosure() Dan Carpenter
2 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2015-10-19 10:15 UTC (permalink / raw)
To: James E.J. Bottomley
Cc: linux-scsi, security, 程君(成淼),
throber3
"len" has to be at least 12 because we need that space for the overall
descriptor, otherwise we end up reading beyond the end of the array and
KASan complains. Later on we have some more range checking on desc_ptr
but we are checking the start of the "desc_ptr" buffer instead of the
end of the buffer (desc_ptr + 4). Let's tighten that up as well.
Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index dcb0d76..ff474c7 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -476,6 +476,8 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
goto simple_populate;
page7_len = len = (hdr_buf[2] << 8) + hdr_buf[3] + 4;
+ if (len < 12)
+ goto simple_populate;
/* add 1 for trailing '\0' we'll use */
buf = kzalloc(len + 1, GFP_KERNEL);
if (!buf)
@@ -504,15 +506,19 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
struct enclosure_component *ecomp;
if (desc_ptr) {
- if (desc_ptr >= buf + page7_len) {
+ if (desc_ptr + 4 >= buf + page7_len) {
desc_ptr = NULL;
} else {
len = (desc_ptr[2] << 8) + desc_ptr[3];
desc_ptr += 4;
/* Add trailing zero - pushes into
* reserved space */
- desc_ptr[len] = '\0';
- name = desc_ptr;
+ if (desc_ptr + len >= buf + page7_len) {
+ desc_ptr = NULL;
+ } else {
+ desc_ptr[len] = '\0';
+ name = desc_ptr;
+ }
}
}
if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 3+ messages in thread