# git rev-parse -q --verify 6754297c2924cd55843499bc2bb338843177931f^{commit} 6754297c2924cd55843499bc2bb338843177931f already have revision, skipping fetch # git checkout -q -f -B kisskb 6754297c2924cd55843499bc2bb338843177931f # git clean -qxdf # < git log -1 # commit 6754297c2924cd55843499bc2bb338843177931f # Author: Daniel Axtens # Date: Mon Jun 3 16:56:57 2019 +1000 # # powerpc/pseries/hvconsole: Fix stack overread via udbg # # While developing KASAN for 64-bit book3s, I hit the following stack # over-read. # # It occurs because the hypercall to put characters onto the terminal # takes 2 longs (128 bits/16 bytes) of characters at a time, and so # hvc_put_chars() would unconditionally copy 16 bytes from the argument # buffer, regardless of supplied length. However, udbg_hvc_putc() can # call hvc_put_chars() with a single-byte buffer, leading to the error. # # ================================================================== # BUG: KASAN: stack-out-of-bounds in hvc_put_chars+0xdc/0x110 # Read of size 8 at addr c0000000023e7a90 by task swapper/0 # # CPU: 0 PID: 0 Comm: swapper Not tainted 5.2.0-rc2-next-20190528-02824-g048a6ab4835b #113 # Call Trace: # dump_stack+0x104/0x154 (unreliable) # print_address_description+0xa0/0x30c # __kasan_report+0x20c/0x224 # kasan_report+0x18/0x30 # __asan_report_load8_noabort+0x24/0x40 # hvc_put_chars+0xdc/0x110 # hvterm_raw_put_chars+0x9c/0x110 # udbg_hvc_putc+0x154/0x200 # udbg_write+0xf0/0x240 # console_unlock+0x868/0xd30 # register_console+0x970/0xe90 # register_early_udbg_console+0xf8/0x114 # setup_arch+0x108/0x790 # start_kernel+0x104/0x784 # start_here_common+0x1c/0x534 # # Memory state around the buggy address: # c0000000023e7980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # c0000000023e7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 # >c0000000023e7a80: f1 f1 01 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 # ^ # c0000000023e7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # c0000000023e7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 # ================================================================== # # Document that a 16-byte buffer is requred, and provide it in udbg. # # Signed-off-by: Daniel Axtens # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/powerpc64-linux/bin/powerpc64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/powerpc64-linux/bin/powerpc64-linux-ld --version # < git log --format=%s --max-count=1 6754297c2924cd55843499bc2bb338843177931f # < make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-next-rand_powerpc-randconfig_powerpc-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/powerpc64-linux/bin/powerpc64-linux- randconfig KCONFIG_SEED=0x55771FCC # Added to kconfig CONFIG_STANDALONE=y # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # Added to kconfig CONFIG_CPU_BIG_ENDIAN=y # Added to kconfig CONFIG_PPC64=y # Added to kconfig CONFIG_PPC_DISABLE_WERROR=y # Added to kconfig CONFIG_SECTION_MISMATCH_WARN_ONLY=y # Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y # Added to kconfig CONFIG_CC_STACKPROTECTOR_STRONG=n # Added to kconfig CONFIG_GCC_PLUGINS=n # Added to kconfig CONFIG_LD_HEAD_STUB_CATCH=y # Added to kconfig CONFIG_TRIM_UNUSED_KSYMS=n # yes \n | make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-next-rand_powerpc-randconfig_powerpc-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/powerpc64-linux/bin/powerpc64-linux- oldconfig yes: standard output: Broken pipe # make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-next-rand_powerpc-randconfig_powerpc-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/powerpc64-linux/bin/powerpc64-linux- /kisskb/src/arch/powerpc/platforms/pseries/lpar.c: In function 'update_vcpu_disp_stat': /kisskb/src/arch/powerpc/platforms/pseries/lpar.c:160:14: error: implicit declaration of function 'cpu_relative_dispatch_distance' [-Werror=implicit-function-declaration] distance = cpu_relative_dispatch_distance(disp->last_disp_cpu, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/arch/powerpc/platforms/pseries/lpar.c:186:13: error: implicit declaration of function 'cpu_home_node_dispatch_distance'; did you mean 'sum_zone_node_page_state'? [-Werror=implicit-function-declaration] distance = cpu_home_node_dispatch_distance(disp_cpu); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sum_zone_node_page_state /kisskb/src/arch/powerpc/platforms/pseries/lpar.c: In function 'vcpudispatch_stats_write': /kisskb/src/arch/powerpc/platforms/pseries/lpar.c:473:8: error: implicit declaration of function 'init_cpu_associativity'; did you mean 'set_cpu_active'? [-Werror=implicit-function-declaration] rc = init_cpu_associativity(); ^~~~~~~~~~~~~~~~~~~~~~ set_cpu_active /kisskb/src/arch/powerpc/platforms/pseries/lpar.c:485:4: error: implicit declaration of function 'destroy_cpu_associativity' [-Werror=implicit-function-declaration] destroy_cpu_associativity(); ^~~~~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors make[4]: *** [/kisskb/src/scripts/Makefile.build:279: arch/powerpc/platforms/pseries/lpar.o] Error 1 make[3]: *** [/kisskb/src/scripts/Makefile.build:489: arch/powerpc/platforms/pseries] Error 2 make[3]: *** Waiting for unfinished jobs.... make[2]: *** [/kisskb/src/scripts/Makefile.build:489: arch/powerpc/platforms] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/kisskb/src/Makefile:1071: arch/powerpc] Error 2 make[1]: *** Waiting for unfinished jobs.... /kisskb/src/kernel/locking/lockdep.c:2821:13: warning: 'print_lock_trace' defined but not used [-Wunused-function] static void print_lock_trace(struct lock_trace *trace, unsigned int spaces) ^~~~~~~~~~~~~~~~ /kisskb/src/drivers/cpufreq/powernv-cpufreq.c: In function 'init_chip_info': /kisskb/src/drivers/cpufreq/powernv-cpufreq.c:1070:1: warning: the frame size of 1040 bytes is larger than 1024 bytes [-Wframe-larger-than=] } ^ /kisskb/src/drivers/usb/misc/usbtest.c: In function 'test_queue': /kisskb/src/drivers/usb/misc/usbtest.c:2148:1: warning: the frame size of 1248 bytes is larger than 1024 bytes [-Wframe-larger-than=] } ^ make: *** [Makefile:179: sub-make] Error 2 Command 'make -s -j 48 ARCH=powerpc O=/kisskb/build/powerpc-next-rand_powerpc-randconfig_powerpc-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/powerpc64-linux/bin/powerpc64-linux- ' returned non-zero exit status 2 # rm -rf /kisskb/build/powerpc-next-rand_powerpc-randconfig_powerpc-gcc8 # Build took: 0:04:44.041784