From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jerome Marchand <jmarchan@redhat.com>,
David Howells <dhowells@redhat.com>
Subject: [PATCH 3.14 02/37] assoc_array: dont call compare_object() on a node
Date: Mon, 2 May 2016 17:11:51 -0700 [thread overview]
Message-ID: <20160503000423.655532217@linuxfoundation.org> (raw)
In-Reply-To: <20160503000423.577563140@linuxfoundation.org>
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Marchand <jmarchan@redhat.com>
commit 8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2 upstream.
Changes since V1: fixed the description and added KASan warning.
In assoc_array_insert_into_terminal_node(), we call the
compare_object() method on all non-empty slots, even when they're
not leaves, passing a pointer to an unexpected structure to
compare_object(). Currently it causes an out-of-bound read access
in keyring_compare_object detected by KASan (see below). The issue
is easily reproduced with keyutils testsuite.
Only call compare_object() when the slot is a leave.
KASan warning:
==================================================================
BUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838
Read of size 8 by task keyctl/1655
=============================================================================
BUG kmalloc-192 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647
___slab_alloc+0x563/0x5c0
__slab_alloc+0x51/0x90
kmem_cache_alloc_trace+0x263/0x300
assoc_array_insert+0xfd0/0x3a60
__key_link_begin+0xfc/0x270
key_create_or_update+0x459/0xaf0
SyS_add_key+0x1ba/0x350
entry_SYSCALL_64_fastpath+0x12/0x76
INFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080
INFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1
Bytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00 ...`............
Object ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff ...`.......`....
Object ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CPU: 0 PID: 1655 Comm: keyctl Tainted: G B 4.5.0-rc4-kasan+ #291
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491
ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969
ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650
Call Trace:
[<ffffffff81b60491>] dump_stack+0x85/0xc4
[<ffffffff815e2969>] print_trailer+0xf9/0x150
[<ffffffff815e9454>] object_err+0x34/0x40
[<ffffffff815ebe50>] kasan_report_error+0x230/0x550
[<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210
[<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70
[<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240
[<ffffffff81994cc3>] keyring_compare_object+0x213/0x240
[<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60
[<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70
[<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270
[<ffffffff8199786c>] __key_link_begin+0xfc/0x270
[<ffffffff81993389>] key_create_or_update+0x459/0xaf0
[<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10
[<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0
[<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0
[<ffffffff81534763>] ? memdup_user+0x53/0x80
[<ffffffff819983ea>] SyS_add_key+0x1ba/0x350
[<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0
[<ffffffff828bcf4e>] ? retint_user+0x18/0x23
[<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580
[<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19
[<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76
Memory state around the buggy address:
ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
>ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00
==================================================================
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/assoc_array.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -523,7 +523,9 @@ static bool assoc_array_insert_into_term
free_slot = i;
continue;
}
- if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) {
+ if (assoc_array_ptr_is_leaf(ptr) &&
+ ops->compare_object(assoc_array_ptr_to_leaf(ptr),
+ index_key)) {
pr_devel("replace in slot %d\n", i);
edit->leaf_p = &node->slots[i];
edit->dead_leaf = node->slots[i];
next prev parent reply other threads:[~2016-05-03 1:58 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-03 0:11 [PATCH 3.14 00/37] 3.14.68-stable review Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 01/37] ARM: OMAP2+: hwmod: Fix updating of sysconfig register Greg Kroah-Hartman
2016-05-03 0:11 ` Greg Kroah-Hartman [this message]
2016-05-03 0:11 ` [PATCH 3.14 03/37] usb: xhci: fix wild pointers in xhci_mem_cleanup Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 04/37] usb: hcd: out of bounds access in for_each_companion Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 05/37] lib: lz4: fixed zram with lz4 on big endian machines Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 06/37] x86/iopl/64: Properly context-switch IOPL on Xen PV Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 07/37] futex: Acknowledge a new waiter in counter before plist Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 08/37] drm/qxl: fix cursor position with non-zero hotspot Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 09/37] crypto: ccp - Prevent information leakage on export Greg Kroah-Hartman
2016-05-03 0:11 ` [PATCH 3.14 10/37] crypto: gcm - Fix rfc4543 decryption crash Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 11/37] nl80211: check netlink protocol in socket release notification Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 12/37] Input: gtco - fix crash on detecting device without endpoints Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 13/37] pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 14/37] i2c: cpm: Fix build break due to incompatible pointer types Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 15/37] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 16/37] EDAC: i7core, sb_edac: Dont return NOTIFY_BAD from mce_decoder callback Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 17/37] ASoC: s3c24xx: use const snd_soc_component_driver pointer Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 18/37] ASoC: rt5640: Correct the digital interface data select Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 19/37] efi: Fix out-of-bounds read in variable_matches() Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 20/37] workqueue: fix ghost PENDING flag while doing MQ IO Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 21/37] USB: usbip: fix potential out-of-bounds write Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 22/37] paride: make verbose parameter an int again Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 23/37] fbdev: da8xx-fb: fix videomodes of lcd panels Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 24/37] misc/bmp085: Enable building as a module Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 25/37] rtc: hym8563: fix invalid year calculation Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 27/37] drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 28/37] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty() Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 29/37] serial: sh-sci: Remove cpufreq notifier to fix crash/deadlock Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 30/37] include/linux/poison.h: fix LIST_POISON{1,2} offset Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 31/37] Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 32/37] perf stat: Document --detailed option Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 34/37] bus: imx-weim: Take the status property value into account Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 35/37] jme: Do not enable NIC WoL functions on S0 Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 36/37] jme: Fix device PM wakeup API usage Greg Kroah-Hartman
2016-05-03 0:12 ` [PATCH 3.14 37/37] sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a race Greg Kroah-Hartman
2016-05-03 7:19 ` [PATCH 3.14 00/37] 3.14.68-stable review Guenter Roeck
2016-05-03 18:21 ` Greg Kroah-Hartman
2016-05-03 15:00 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160503000423.655532217@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dhowells@redhat.com \
--cc=jmarchan@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox