Re: [LKP] 4ce5f9c9e7 [ 1.323881] WARNING: CPU: 0 PID: 1 at mm/slab_common.c:1031 kmalloc_slab

Sean Christopherson
2018-10-10T23:52:48Z

On Wed, Oct 10, 2018 at 05:06:52PM -0500, Eric W. Biederman wrote:
> ebiederm@xmission.com (Eric W. Biederman) writes:
>
> > So I am flummoxed. I am reading through the code and I don't see
> > anything that could trigger this, and when I ran the supplied reproducer
> > it did not reproduce for me.
>
> Even more so. With my tool chain the line that reports the failing
> address is impossible.
>
> [ 73.034423] RIP: 0010:copy_siginfo_from_user+0x4d/0xd0
>
> With the supplied configureation my tool chain only has 0x30 bytes for
> all of copy_siginfo_from_user. So I can't even begin to guess where
> in that function things are failing.
>
> Any additional information that you can provide would be a real help
> in tracking down this strange failure.

I don't have the exact toolchain, but I was able to get somewhat close
and may have found a smoking gun. 0x4d in my build is in the general
vicinity of "sig_sicodes[sig].limit" in known_siginfo_layout(). This
lines up with the register state from the log, e.g. RDI=0500104d8,
which is the mask generated by sig_specific_sicodes. From what I can
tell, @sig is never bounds checked. If the compiler generated an AND
instruction to compare against sig_specific_sicodes then that could
resolve true with any arbitrary value that happened to collide with
sig_specific_sicodes and result in an out-of-bounds access to
@sig_sicodes. siginfo_layout() for example explicitly checks @sig
before indexing @sig_sicode, e.g. "sig < ARRAY_SIZE(sig_sicodes)".

Maybe this?

---
kernel/signal.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/signal.c b/kernel/signal.c
index 1c2dd117fee0..6ee7491de906 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2865,7 +2865,8 @@ static bool known_siginfo_layout(int sig, int si_code)
if (si_code == SI_KERNEL)
return true;
else if ((si_code > SI_USER)) {
- if (sig_specific_sicodes(sig)) {
+ if (sig < ARRAY_SIZE(sig_sicodes) &&
+ sig_specific_sicodes(sig)) {
if (si_code <= sig_sicodes[sig].limit)
return true;
}