# git rev-parse -q --verify 6754297c2924cd55843499bc2bb338843177931f^{commit} 6754297c2924cd55843499bc2bb338843177931f already have revision, skipping fetch # git checkout -q -f -B kisskb 6754297c2924cd55843499bc2bb338843177931f # git clean -qxdf # < git log -1 # commit 6754297c2924cd55843499bc2bb338843177931f # Author: Daniel Axtens # Date: Mon Jun 3 16:56:57 2019 +1000 # # powerpc/pseries/hvconsole: Fix stack overread via udbg # # While developing KASAN for 64-bit book3s, I hit the following stack # over-read. # # It occurs because the hypercall to put characters onto the terminal # takes 2 longs (128 bits/16 bytes) of characters at a time, and so # hvc_put_chars() would unconditionally copy 16 bytes from the argument # buffer, regardless of supplied length. However, udbg_hvc_putc() can # call hvc_put_chars() with a single-byte buffer, leading to the error. # # ================================================================== # BUG: KASAN: stack-out-of-bounds in hvc_put_chars+0xdc/0x110 # Read of size 8 at addr c0000000023e7a90 by task swapper/0 # # CPU: 0 PID: 0 Comm: swapper Not tainted 5.2.0-rc2-next-20190528-02824-g048a6ab4835b #113 # Call Trace: # dump_stack+0x104/0x154 (unreliable) # print_address_description+0xa0/0x30c # __kasan_report+0x20c/0x224 # kasan_report+0x18/0x30 # __asan_report_load8_noabort+0x24/0x40 # hvc_put_chars+0xdc/0x110 # hvterm_raw_put_chars+0x9c/0x110 # udbg_hvc_putc+0x154/0x200 # udbg_write+0xf0/0x240 # console_unlock+0x868/0xd30 # register_console+0x970/0xe90 # register_early_udbg_console+0xf8/0x114 # setup_arch+0x108/0x790 # start_kernel+0x104/0x784 # start_here_common+0x1c/0x534 # # Memory state around the buggy address: # c0000000023e7980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # c0000000023e7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 # >c0000000023e7a80: f1 f1 01 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 # ^ # c0000000023e7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # c0000000023e7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # ================================================================== # # Document that a 16-byte buffer is requred, and provide it in udbg. # # Signed-off-by: Daniel Axtens # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-gcc --version # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-ld --version # < git log --format=%s --max-count=1 6754297c2924cd55843499bc2bb338843177931f # < make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-next_cell_defconfig_powerpc-gcc4.6 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- cell_defconfig # make -s -j 120 ARCH=powerpc O=/kisskb/build/powerpc-next_cell_defconfig_powerpc-gcc4.6 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- /kisskb/src/kernel/printk/printk.c: In function 'devkmsg_sysctl_set_loglvl': /kisskb/src/kernel/printk/printk.c:194:16: warning: 'old' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/rcu/srcutree.c: In function 'init_srcu_struct_fields': /kisskb/src/kernel/rcu/srcutree.c:140:32: warning: 'levelspread[]' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/rcu/srcutree.c:88:6: note: 'levelspread[]' was declared here /kisskb/src/fs/proc/inode.c: In function 'proc_reg_open': /kisskb/src/include/linux/list.h:65:12: warning: 'pdeo' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c:331:21: note: 'pdeo' was declared here /kisskb/src/drivers/base/regmap/regmap.c: In function 'regmap_raw_read': /kisskb/src/drivers/base/regmap/regmap.c:2589:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function '_regmap_raw_write': /kisskb/src/drivers/base/regmap/regmap.c:1850:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/udf/unicode.c: In function 'udf_name_conv_char': /kisskb/src/fs/udf/unicode.c:132:8: warning: 'c' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/tty/serial/8250/8250_core.c: In function 'univ8250_release_irq': /kisskb/src/drivers/tty/serial/8250/8250_core.c:247:18: warning: 'i' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/tty/serial/8250/8250_core.c:227:19: note: 'i' was declared here /kisskb/src/kernel/futex.c: In function 'do_futex': /kisskb/src/kernel/futex.c:1658:3: warning: 'oldval' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/futex.c:1633:6: note: 'oldval' was declared here /kisskb/src/mm/hugetlb.c: In function 'alloc_pool_huge_page': /kisskb/src/mm/hugetlb.c:1465:5: warning: 'page' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c: In function 'tun_get_user': /kisskb/src/drivers/net/tun.c:1851:30: warning: 'copylen' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c:1764:46: warning: 'linear' may be used uninitialized in this function [-Wuninitialized] WARNING: vmlinux.o(.text+0x352a): Section mismatch in reference from the variable start_here_multiplatform to the function .init.text:.early_setup() The function start_here_multiplatform() references the function __init .early_setup(). This is often because start_here_multiplatform lacks a __init annotation or the annotation of .early_setup is wrong. Completed OK # rm -rf /kisskb/build/powerpc-next_cell_defconfig_powerpc-gcc4.6 # Build took: 0:00:40.054921