From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757116AbdKGKp1 (ORCPT ); Tue, 7 Nov 2017 05:45:27 -0500 Received: from mail-pf0-f175.google.com ([209.85.192.175]:54858 "EHLO mail-pf0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751633AbdKGKpW (ORCPT ); Tue, 7 Nov 2017 05:45:22 -0500 X-Google-Smtp-Source: ABhQp+T3g9B6hl0mf6Ocx1U8y5JqRoBCJN2F0lv7TQmFJfDCRonGI45njkQ1V6EcRlv4/PSQ6BtLSw== Date: Tue, 7 Nov 2017 19:45:17 +0900 From: Sergey Senozhatsky To: Fengguang Wu Cc: linux-kernel@vger.kernel.org, Petr Mladek , Sergey Senozhatsky , Steven Rostedt , Linus Torvalds , Andrew Morton , Aleksey Makarov , Ingo Molnar , Nicolas Pitre , Dmitry Vyukov , Andrey Ryabinin , Alexander Potapenko Subject: Re: [devkmsg_write] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170 Message-ID: <20171107104517.GA470@jagdpanzerIV> References: <20171107093921.ulnjqoaycig5qqoy@wfg-t540p.sh.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171107093921.ulnjqoaycig5qqoy@wfg-t540p.sh.intel.com> User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On (11/07/17 17:39), Fengguang Wu wrote: > [ 22.184920] Freeing unused kernel memory: 824K > [ 22.199198] Freeing unused kernel memory: 1436K > [ 22.228460] x86/mm: Checked W+X mappings: passed, no W+X pages found. > [ 22.230474] rodata_test: all tests were successful > [ 22.254830] ================================================================== > [ 22.257125] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170 > [ 22.258648] Write of size 26 at addr ffff880013432540 by task init/1 > [ 22.260272] > [ 22.260860] CPU: 0 PID: 1 Comm: init Not tainted 4.14.0-rc8 #14 > [ 22.262379] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 > [ 22.264441] Call Trace: > [ 22.265206] dump_stack+0x5d/0x81 > [ 22.266147] print_address_description+0xa7/0x280 > [ 22.267369] ? copyin+0xea/0x170 > [ 22.268282] ? copyin+0xea/0x170 > [ 22.268990] kasan_report+0xd3/0x150 > [ 22.269551] ? quarantine_reduce+0x1/0x1a0 > [ 22.270177] ? copyin+0xea/0x170 > [ 22.270703] copyin+0xea/0x170 > [ 22.271202] _copy_from_iter_full+0x14f/0x4f0 > [ 22.271857] ? __kmalloc+0x1ad/0x2e0 > [ 22.272420] devkmsg_write+0xb9/0x1a0 > [ 22.272999] new_sync_write+0xd8/0x130 > [ 22.273579] vfs_write+0x174/0x2b0 > [ 22.274113] SyS_write+0x50/0xc0 > [ 22.274611] do_int80_syscall_32+0x7a/0x1b0 > [ 22.275216] entry_INT80_compat+0x2d/0x40 at a glance I don't see anything suspicious in devkmsg_write(). > [ 22.276103] Allocated by task 1: > [ 22.276597] kasan_kmalloc+0x61/0xf0 > [ 22.277202] __kmalloc+0x1ad/0x2e0 > [ 22.277720] devkmsg_write+0x76/0x1a0 > [ 22.278268] new_sync_write+0xd8/0x130 > [ 22.278826] vfs_write+0x174/0x2b0 > [ 22.279342] SyS_write+0x50/0xc0 > [ 22.279840] do_int80_syscall_32+0x7a/0x1b0 > [ 22.280441] entry_INT80_compat+0x2d/0x40 devkmsg_write() does buf = kmalloc(len+1, GFP_KERNEL); ... kfree(buf); kasan reports that this kfree() is actually happening in unpack_to_rootfs(), before we do copy_from_iter_full(). > [ 22.281326] Freed by task 1: > [ 22.281788] kasan_slab_free+0xac/0x180 > [ 22.282354] kfree+0x105/0x310 > [ 22.282837] unpack_to_rootfs+0x260/0x2a1 > [ 22.283420] populate_rootfs+0x5d/0x86 > [ 22.283977] do_one_initcall+0x3b/0x180 > [ 22.284544] do_basic_setup+0xb4/0xd0 > [ 22.285091] kernel_init_freeable+0x7b/0xed > [ 22.285680] kernel_init+0xe/0x110 > [ 22.286171] ret_from_fork+0x25/0x30 unpack_to_rootfs() does header_buf = kmalloc(110, GFP_KERNEL); symlink_buf = kmalloc(PATH_MAX + N_ALIGN(PATH_MAX) + 1, GFP_KERNEL); name_buf = kmalloc(N_ALIGN(PATH_MAX), GFP_KERNEL); ... kfree(name_buf); kfree(symlink_buf); kfree(header_buf); kasan reports that one of the pointers was allocated in devkmsg_write(). what am I missing? -ss