# git rev-parse -q --verify 6754297c2924cd55843499bc2bb338843177931f^{commit} 6754297c2924cd55843499bc2bb338843177931f already have revision, skipping fetch # git checkout -q -f -B kisskb 6754297c2924cd55843499bc2bb338843177931f # git clean -qxdf # < git log -1 # commit 6754297c2924cd55843499bc2bb338843177931f # Author: Daniel Axtens # Date: Mon Jun 3 16:56:57 2019 +1000 # # powerpc/pseries/hvconsole: Fix stack overread via udbg # # While developing KASAN for 64-bit book3s, I hit the following stack # over-read. # # It occurs because the hypercall to put characters onto the terminal # takes 2 longs (128 bits/16 bytes) of characters at a time, and so # hvc_put_chars() would unconditionally copy 16 bytes from the argument # buffer, regardless of supplied length. However, udbg_hvc_putc() can # call hvc_put_chars() with a single-byte buffer, leading to the error. # # ================================================================== # BUG: KASAN: stack-out-of-bounds in hvc_put_chars+0xdc/0x110 # Read of size 8 at addr c0000000023e7a90 by task swapper/0 # # CPU: 0 PID: 0 Comm: swapper Not tainted 5.2.0-rc2-next-20190528-02824-g048a6ab4835b #113 # Call Trace: # dump_stack+0x104/0x154 (unreliable) # print_address_description+0xa0/0x30c # __kasan_report+0x20c/0x224 # kasan_report+0x18/0x30 # __asan_report_load8_noabort+0x24/0x40 # hvc_put_chars+0xdc/0x110 # hvterm_raw_put_chars+0x9c/0x110 # udbg_hvc_putc+0x154/0x200 # udbg_write+0xf0/0x240 # console_unlock+0x868/0xd30 # register_console+0x970/0xe90 # register_early_udbg_console+0xf8/0x114 # setup_arch+0x108/0x790 # start_kernel+0x104/0x784 # start_here_common+0x1c/0x534 # # Memory state around the buggy address: # c0000000023e7980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # c0000000023e7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 # >c0000000023e7a80: f1 f1 01 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 # ^ # c0000000023e7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # c0000000023e7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # ================================================================== # # Document that a 16-byte buffer is requred, and provide it in udbg. # # Signed-off-by: Daniel Axtens # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux-ld --version # < git log --format=%s --max-count=1 6754297c2924cd55843499bc2bb338843177931f # < make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-next_mpc85xx_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- mpc85xx_defconfig # make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-next_mpc85xx_defconfig_powerpc-gcc5 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-5.5.0-nolibc/powerpc64-linux/bin/powerpc64-linux- In file included from /kisskb/src/include/linux/kernel.h:11:0, from /kisskb/src/include/linux/list.h:9, from /kisskb/src/include/linux/module.h:9, from /kisskb/src/drivers/net/ethernet/freescale/fs_enet/mac-scc.c:15: /kisskb/src/drivers/net/ethernet/freescale/fs_enet/mac-scc.c: In function 'allocate_bd': /kisskb/src/include/linux/err.h:22:49: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] #define IS_ERR_VALUE(x) unlikely((unsigned long)(void *)(x) >= (unsigned long)-MAX_ERRNO) ^ /kisskb/src/include/linux/compiler.h:78:42: note: in definition of macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^ /kisskb/src/drivers/net/ethernet/freescale/fs_enet/mac-scc.c:139:6: note: in expansion of macro 'IS_ERR_VALUE' if (IS_ERR_VALUE(fep->ring_mem_addr)) ^ /kisskb/src/arch/powerpc/boot/dts/fsl/mpc8555cds.dts:334.3-21: Warning (pci_device_bus_num): /pci@e0008000/i8259@19000:bus-range: PCI bus number 1 out of range, expected (0 - 0) /kisskb/src/arch/powerpc/boot/dts/fsl/mpc8541cds.dts:334.3-21: Warning (pci_device_bus_num): /pci@e0008000/i8259@19000:bus-range: PCI bus number 1 out of range, expected (0 - 0) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbd5518) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) INFO: Uncompressed kernel (size 0xbc4ce4) overlaps the address of the wrapper(0x400000) INFO: Fixing the link_address of wrapper to (0xc00000) Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826359 Bytes = 5689.80 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826706 Bytes = 5690.14 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826505 Bytes = 5689.95 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c00314 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5829695 Bytes = 5693.06 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826714 Bytes = 5690.15 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826503 Bytes = 5689.94 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c00314 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5827827 Bytes = 5691.24 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826703 Bytes = 5690.14 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826673 Bytes = 5690.11 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c00314 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5827224 Bytes = 5690.65 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5829611 Bytes = 5692.98 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5828836 Bytes = 5692.22 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826322 Bytes = 5689.77 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c002a4 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5796836 Bytes = 5660.97 KiB = 5.53 MiB Load Address: 00000000 Entry Point: 00000000 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826742 Bytes = 5690.18 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c00314 Image Name: Linux-5.2.0-rc2-g6754297c2924 Created: Sat Jun 8 01:26:10 2019 Image Type: PowerPC Linux Kernel Image (gzip compressed) Data Size: 5826300 Bytes = 5689.75 KiB = 5.56 MiB Load Address: 00c00000 Entry Point: 00c00314 Completed OK # rm -rf /kisskb/build/powerpc-next_mpc85xx_defconfig_powerpc-gcc5 # Build took: 0:01:46.486425