Re: KASAN: use-after-free Write in vcs_read

Re: KASAN: use-after-free Write in vcs_read

[syzbot]

syzbot has bisected this issue to:

commit b1c32fcfadf5593ab7a63261cc8a5747c36e627e
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Tue Aug 18 08:57:05 2020 +0000

    vc_screen: extract vcs_read_buf_header

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=13259dee900000
start commit:   494d311a Add linux-next specific files for 20200821
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=10a59dee900000
console output: https://syzkaller.appspot.com/x/log.txt?x=17259dee900000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a61d44f28687f508
dashboard link: https://syzkaller.appspot.com/bug?extid=ad1f53726c3bd11180cb
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16704b7e900000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1588a046900000

Reported-by: syzbot+ad1f53726c3bd11180cb@syzkaller.appspotmail.com
Fixes: b1c32fcfadf5 ("vc_screen: extract vcs_read_buf_header")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: KASAN: use-after-free Write in vcs_read

[Jiri Slaby]

On 22. 08. 20, 9:31, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit b1c32fcfadf5593ab7a63261cc8a5747c36e627e
> Author: Jiri Slaby <jslaby@suse.cz>
> Date:   Tue Aug 18 08:57:05 2020 +0000
> 
>     vc_screen: extract vcs_read_buf_header

It's like 7th e-mail about the very same issue. Can it be
suspended/acknowledged somehow?

> Reported-by: syzbot+ad1f53726c3bd11180cb@syzkaller.appspotmail.com

I haven't managed to find the root cause on Fri yet, I will chase it on
Mon again.

thanks,
-- 
js
suse labs

Re: KASAN: use-after-free Write in vcs_read

[Jiri Slaby]

On 22. 08. 20, 9:34, Jiri Slaby wrote:
> On 22. 08. 20, 9:31, syzbot wrote:
>> syzbot has bisected this issue to:
>>
>> commit b1c32fcfadf5593ab7a63261cc8a5747c36e627e
>> Author: Jiri Slaby <jslaby@suse.cz>
>> Date:   Tue Aug 18 08:57:05 2020 +0000
>>
>>     vc_screen: extract vcs_read_buf_header
> 
> It's like 7th e-mail about the very same issue. Can it be
> suspended/acknowledged somehow?
> 
>> Reported-by: syzbot+ad1f53726c3bd11180cb@syzkaller.appspotmail.com
> 
> I haven't managed to find the root cause on Fri yet, I will chase it on
> Mon again.

Ah, I see now. And the easiest way of handling this is simply revert the
commit now, re-think and redo during the next merge window.

There are two issues with the patch:
1) vcs_read rounds the 'count' up to an even number. So if we read odd
bytes from the header (3 in the reproducer), the second byte of
(2-byte/ushort) write to temporary con_buf won't fit. It is because with
the patch applied, we only subtract the real number read (3 bytes) and
not the whole header (4 bytes).

2) in this scenario, we perform unaligned accesses now. 2-byte/ushort
writes to odd addresses. Due to the same reason as above.

So Greg, could you revert with the above reasoning? It reverts cleanly.
Or do you want me to send a revert?

thanks,
-- 
js
suse labs

Re: KASAN: use-after-free Write in vcs_read

[Greg KH]

On Mon, Aug 24, 2020 at 10:03:54AM +0200, Jiri Slaby wrote:
> On 22. 08. 20, 9:34, Jiri Slaby wrote:
> > On 22. 08. 20, 9:31, syzbot wrote:
> >> syzbot has bisected this issue to:
> >>
> >> commit b1c32fcfadf5593ab7a63261cc8a5747c36e627e
> >> Author: Jiri Slaby <jslaby@suse.cz>
> >> Date:   Tue Aug 18 08:57:05 2020 +0000
> >>
> >>     vc_screen: extract vcs_read_buf_header
> > 
> > It's like 7th e-mail about the very same issue. Can it be
> > suspended/acknowledged somehow?
> > 
> >> Reported-by: syzbot+ad1f53726c3bd11180cb@syzkaller.appspotmail.com
> > 
> > I haven't managed to find the root cause on Fri yet, I will chase it on
> > Mon again.
> 
> Ah, I see now. And the easiest way of handling this is simply revert the
> commit now, re-think and redo during the next merge window.
> 
> There are two issues with the patch:
> 1) vcs_read rounds the 'count' up to an even number. So if we read odd
> bytes from the header (3 in the reproducer), the second byte of
> (2-byte/ushort) write to temporary con_buf won't fit. It is because with
> the patch applied, we only subtract the real number read (3 bytes) and
> not the whole header (4 bytes).
> 
> 2) in this scenario, we perform unaligned accesses now. 2-byte/ushort
> writes to odd addresses. Due to the same reason as above.
> 
> So Greg, could you revert with the above reasoning? It reverts cleanly.
> Or do you want me to send a revert?

If you send a revert it is always easier for me to apply that :)

thanks,

greg k-h