From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C97CAC43334 for ; Sun, 12 Jun 2022 18:00:36 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1075E8D012F; Sun, 12 Jun 2022 14:00:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0B7108D012E; Sun, 12 Jun 2022 14:00:36 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EC0938D012F; Sun, 12 Jun 2022 14:00:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id DE0278D012E for ; Sun, 12 Jun 2022 14:00:35 -0400 (EDT) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay13.hostedemail.com (Postfix) with ESMTP id AC4106072C for ; Sun, 12 Jun 2022 18:00:35 +0000 (UTC) X-FDA: 79570348830.08.3491379 Received: from mail-vs1-f49.google.com (mail-vs1-f49.google.com [209.85.217.49]) by imf21.hostedemail.com (Postfix) with ESMTP id 5959E1C009E for ; Sun, 12 Jun 2022 18:00:35 +0000 (UTC) Received: by mail-vs1-f49.google.com with SMTP id x187so3989061vsb.0 for ; Sun, 12 Jun 2022 11:00:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QEcsAXXaVRKVS5g+mazai8AK12VIklN03xS+L+Nhtx8=; b=PP4i51S8epeVaiFcz5OPgxIkS3qd19Nk14h3/oSNduTadgWRuqTUEPNVmfHTYFyE2M 3p6JSnKRvhcTkWYCFVD2AV+qSny3fhaYhzWnrbODqYBoWTolQB/C14r9TKL9P4YyNHnb nC8/ugQArQh5SOheJDI7I42rRIhYsRfzDk04S2Ur+NTMfTtydj2tZ6ZKG4PmCIP3xdPt GFJIO37e/CiP8A+XzHCSi9DTetlZe7ouDGJz6PTeBMtrrKRfxM1cdeT8hK6f6dYORv9I +LaMV229+AMbocrtcqfAuSUFhA00JlogeQHB2W3CGhpUUEvywz36qY+GLOeTuVyTEWJl khpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QEcsAXXaVRKVS5g+mazai8AK12VIklN03xS+L+Nhtx8=; b=7/ZdGCnabJXUipTFQKEeCYbpZ7u2DmDZMmXUf9dz/rd7u2S7maEMy8+orqH7Gw9G/W GWSfeYwKr0YDHFNGJ6Xf122vvCH/QpUTrNcaB9X5y9VdAGzD0GJVNkTSxfZeZdAHQlT6 1W+U1nDrqa9W9aMUhJwIRqruHzzFThJ5jM+GS0y2Vvn8X/QauTWeaGISG53qmd2cKDEh KAYl8ocOiS+HsmqAEiXpSnYButPvEcTiMfIdx4JiNG0lMS/VELvBDpdVJHNDqqeTNZdh x6pLA/9bAVzovd7GmQU8yQHwENul7dc8fqsF71GbKWEVVUEQ/8cAOH1uoVe2XUzv6tNn ictA== X-Gm-Message-State: AOAM532muxn7zhbuQdI5QdtLJzRbKgQtYBw2GoMFzyNsbw23p3d70909 czfCYJASR2Q1KsqK27NzABHqM+30QFkrgZPtl2bilw== X-Google-Smtp-Source: ABdhPJzhRA0NsYkN3KKihBGWs6FiVEoXnK8AyOCep8jLnBR9urWp92pMNL82G21RvEtLn0GH64iELoUYkorTnFHvnOE= X-Received: by 2002:a67:f3d0:0:b0:34b:b52d:d676 with SMTP id j16-20020a67f3d0000000b0034bb52dd676mr15884899vsn.6.1655056834360; Sun, 12 Jun 2022 11:00:34 -0700 (PDT) MIME-Version: 1.0 References: <20220606151312.6a9d098c85ed060d36519600@linux-foundation.org> <20220608021922.n2izu7n4yoadknkx@zlang-mailbox> <20220612044230.murerhsa765akogj@zlang-mailbox> In-Reply-To: From: Yu Zhao Date: Sun, 12 Jun 2022 11:59:58 -0600 Message-ID: Subject: Re: [Bug 216073] New: [s390x] kernel BUG at mm/usercopy.c:101! usercopy: Kernel memory exposure attempt detected from vmalloc 'n o area' (offset 0, size 1)! To: Matthew Wilcox , Uladzislau Rezki Cc: Zorro Lang , Alexander Gordeev , bugzilla-daemon@kernel.org, linux-s390@vger.kernel.org, linux-xfs@vger.kernel.org, Andrew Morton , Linux-MM , Kees Cook Content-Type: text/plain; charset="UTF-8" ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1655056835; a=rsa-sha256; cv=none; b=VS35V8FFMbCOIGrYL5ihC5f0W+p1HK+2toVv/7wIFBnjXVVbdo7rmcVzKfwLzPdtLUilCp Kz0dpwTli6owayZ9uKrYcArQb2WEB7RXvIRVqRF+nW+KCNk9dgWmw94+DUQ/5Fkghr4Wmi FYq1YBfJBNfiy9fnSmFxLJpXUSl5STo= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=PP4i51S8; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf21.hostedemail.com: domain of yuzhao@google.com designates 209.85.217.49 as permitted sender) smtp.mailfrom=yuzhao@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1655056835; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=QEcsAXXaVRKVS5g+mazai8AK12VIklN03xS+L+Nhtx8=; b=pqKYsYbVh5jRFUQ4zsw8PIUJ3kKH8ivs7/ggktnvCHP2aOZzoY6YHysDIZwApOE4/RAxKs gtnAywa9iOvwzSdGhKZ2Rtdz3d80TfIW/artwo5E114anqkgXnfhoHSDEr94DCL+GFvd34 4gdtA0mmT5KEVKKzfL7gcqfHg4qRT/w= X-Stat-Signature: et8645ocy1m5tns4zwno673u63wt5wjd X-Rspamd-Queue-Id: 5959E1C009E X-Rspam-User: X-Rspamd-Server: rspam10 Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=PP4i51S8; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf21.hostedemail.com: domain of yuzhao@google.com designates 209.85.217.49 as permitted sender) smtp.mailfrom=yuzhao@google.com X-HE-Tag: 1655056835-579056 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, Jun 12, 2022 at 11:27 AM Matthew Wilcox wrote: > > On Sun, Jun 12, 2022 at 03:03:20PM +0200, Uladzislau Rezki wrote: > > > @@ -181,8 +181,9 @@ static inline void check_heap_object(const void *ptr, unsigned long n, > > > return; > > > } > > > > > > - offset = ptr - area->addr; > > > - if (offset + n > get_vm_area_size(area)) > > > + /* XXX: We should also abort for free vmap_areas */ > > > + offset = (unsigned long)ptr - area->va_start; > > > > > I was a bit confused about "offset" and why it is needed here. It is always zero. > > So we can get rid of it to make it less confused. From the other hand a zero offset > > contributes to nothing. > > I don't think offset is necessarily zero. 'ptr' is a pointer somewhere > in the object, not necessarily the start of the object. > > > > > > > + if (offset + n >= area->va_end) > > > > > I think it is a bit wrong. As i see it, "n" is a size and what we would like to do > > here is boundary check: > > > > > > if (n > va_size(area)) > > usercopy_abort("vmalloc", NULL, to_user, 0, n); > > > > Hmm ... we should probably be more careful about wrapping. > > if (n > area->va_end - addr) > usercopy_abort("vmalloc", NULL, to_user, offset, n); > > ... and that goes for the whole function actually. I'll split that into > a separate change. Please let me know if there is something we want to test -- I can reproduce the problem reliably: ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:101! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP CPU: 4 PID: 3259 Comm: iptables Not tainted 5.19.0-rc1-lockdep+ #1 pc : usercopy_abort+0x9c/0xa0 lr : usercopy_abort+0x9c/0xa0 sp : ffffffc010bd78d0 x29: ffffffc010bd78e0 x28: 42ffff80ac08d8ec x27: 42ffff80ac08d8ec x26: 42ffff80ac08d8c0 x25: 000000000000000a x24: ffffffdf4c7e5120 x23: 000000000bec44c2 x22: efffffc000000000 x21: ffffffdf2896b0c0 x20: 0000000000000001 x19: 000000000000000b x18: 0000000000000000 x17: 2820636f6c6c616d x16: 0000000000000042 x15: 6574636574656420 x14: 74706d6574746120 x13: 0000000000000018 x12: 000000000000000d x11: ff80007fffffffff x10: 0000000000000001 x9 : db174b7f89103400 x8 : db174b7f89103400 x7 : 0000000000000000 x6 : 79706f6372657375 x5 : ffffffdf4d9c617e x4 : 0000000000000000 x3 : ffffffdf4b7d017c x2 : ffffff80eb188b18 x1 : 42ffff80ac08d8c8 x0 : 0000000000000066 Call trace: usercopy_abort+0x9c/0xa0 __check_object_size+0x38c/0x400 xt_obj_to_user+0xe4/0x200 xt_compat_target_to_user+0xd8/0x18c compat_copy_entries_to_user+0x278/0x424 do_ipt_get_ctl+0x7bc/0xb2c nf_getsockopt+0x7c/0xb4 ip_getsockopt+0xee8/0xfa4 raw_getsockopt+0xf4/0x23c sock_common_getsockopt+0x48/0x54 __sys_getsockopt+0x11c/0x2f8 __arm64_sys_getsockopt+0x60/0x70 el0_svc_common+0xfc/0x1cc do_el0_svc_compat+0x38/0x5c el0_svc_compat+0x68/0xf4 el0t_32_sync_handler+0xc0/0xf0 el0t_32_sync+0x190/0x194 Code: aa0903e4 a9017bfd 910043fd 9438be18 (d4210000) ---[ end trace 0000000000000000 ]---