From: Kamal Mostafa <kamal@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Jerome Marchand <jmarchan@redhat.com>,
David Howells <dhowells@redhat.com>,
Kamal Mostafa <kamal@canonical.com>
Subject: [PATCH 4.2.y-ckt 34/93] assoc_array: don't call compare_object() on a node
Date: Tue, 26 Apr 2016 11:16:34 -0700 [thread overview]
Message-ID: <1461694653-29506-35-git-send-email-kamal@canonical.com> (raw)
In-Reply-To: <1461694653-29506-1-git-send-email-kamal@canonical.com>
4.2.8-ckt9 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Jerome Marchand <jmarchan@redhat.com>
commit 8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2 upstream.
Changes since V1: fixed the description and added KASan warning.
In assoc_array_insert_into_terminal_node(), we call the
compare_object() method on all non-empty slots, even when they're
not leaves, passing a pointer to an unexpected structure to
compare_object(). Currently it causes an out-of-bound read access
in keyring_compare_object detected by KASan (see below). The issue
is easily reproduced with keyutils testsuite.
Only call compare_object() when the slot is a leave.
KASan warning:
==================================================================
BUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838
Read of size 8 by task keyctl/1655
=============================================================================
BUG kmalloc-192 (Not tainted): kasan: bad access detected
-----------------------------------------------------------------------------
Disabling lock debugging due to kernel taint
INFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647
___slab_alloc+0x563/0x5c0
__slab_alloc+0x51/0x90
kmem_cache_alloc_trace+0x263/0x300
assoc_array_insert+0xfd0/0x3a60
__key_link_begin+0xfc/0x270
key_create_or_update+0x459/0xaf0
SyS_add_key+0x1ba/0x350
entry_SYSCALL_64_fastpath+0x12/0x76
INFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080
INFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1
Bytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00 ...`............
Object ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff ...`.......`....
Object ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
CPU: 0 PID: 1655 Comm: keyctl Tainted: G B 4.5.0-rc4-kasan+ #291
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491
ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969
ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650
Call Trace:
[<ffffffff81b60491>] dump_stack+0x85/0xc4
[<ffffffff815e2969>] print_trailer+0xf9/0x150
[<ffffffff815e9454>] object_err+0x34/0x40
[<ffffffff815ebe50>] kasan_report_error+0x230/0x550
[<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210
[<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70
[<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240
[<ffffffff81994cc3>] keyring_compare_object+0x213/0x240
[<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60
[<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70
[<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270
[<ffffffff8199786c>] __key_link_begin+0xfc/0x270
[<ffffffff81993389>] key_create_or_update+0x459/0xaf0
[<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10
[<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0
[<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0
[<ffffffff81534763>] ? memdup_user+0x53/0x80
[<ffffffff819983ea>] SyS_add_key+0x1ba/0x350
[<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0
[<ffffffff828bcf4e>] ? retint_user+0x18/0x23
[<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580
[<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19
[<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76
Memory state around the buggy address:
ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
>ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00
==================================================================
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
lib/assoc_array.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/assoc_array.c b/lib/assoc_array.c
index 03dd576..59fd7c0 100644
--- a/lib/assoc_array.c
+++ b/lib/assoc_array.c
@@ -524,7 +524,9 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit,
free_slot = i;
continue;
}
- if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) {
+ if (assoc_array_ptr_is_leaf(ptr) &&
+ ops->compare_object(assoc_array_ptr_to_leaf(ptr),
+ index_key)) {
pr_devel("replace in slot %d\n", i);
edit->leaf_p = &node->slots[i];
edit->dead_leaf = node->slots[i];
--
2.7.4
next prev parent reply other threads:[~2016-04-26 18:38 UTC|newest]
Thread overview: 94+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-26 18:16 [4.2.y-ckt stable] Linux 4.2.8-ckt9 stable review Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 01/93] usbnet: cleanup after bind() in probe() Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 02/93] tunnel: Clear IPCB(skb)->opt before dst_link_failure called Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 03/93] net: jme: fix suspend/resume on JMC260 Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 04/93] net: qca_spi: clear IFF_TX_SKB_SHARING Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 05/93] sctp: lack the check for ports in sctp_v6_cmp_addr Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 06/93] qmi_wwan: add Sierra Wireless EM74xx device ID Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 07/93] cdc_ncm: toggle altsetting to force reset before setup Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 08/93] udp6: fix UDP/IPv6 encap resubmit path Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 09/93] net: validate variable length ll headers Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 10/93] ax25: add link layer header validation function Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 11/93] packet: validate variable length ll headers Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 12/93] sh_eth: fix NULL pointer dereference in sh_eth_ring_format() Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 13/93] macvtap: always pass ethernet header in linear Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 14/93] farsync: fix off-by-one bug in fst_add_one Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 15/93] qlge: Fix receive packets drop Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 16/93] bonding: fix bond_get_stats() Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 17/93] xfrm: Fix crash observed during device unregistration and decryption Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 18/93] qmi_wwan: add "D-Link DWM-221 B1" device id Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 19/93] rtnl: fix msg size calculation in if_nlmsg_size() Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 20/93] tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 21/93] ipv4: l2tp: fix a potential issue in l2tp_ip_recv Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 22/93] ipv6: l2tp: fix a potential issue in l2tp_ip6_recv Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 23/93] ipv6: Count in extension headers in skb->network_header Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 24/93] iwlwifi: pcie: lower the debug level for RSA semaphore access Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 25/93] HID: usbhid: fix inconsistent reset/resume/reset-resume behavior Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 26/93] ARM: OMAP2+: hwmod: Fix updating of sysconfig register Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 27/93] ARM: mvebu: Correct unit address for linksys Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 28/93] drm/qxl: fix cursor position with non-zero hotspot Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 29/93] Input: gtco - fix crash on detecting device without endpoints Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 30/93] s390/pci: add extra padding to function measurement block Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 31/93] ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320 Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 32/93] dmaengine: hsu: correct use of channel status register Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 33/93] ALSA: usb-audio: Add a quirk for Plantronics BT300 Kamal Mostafa
2016-04-26 18:16 ` Kamal Mostafa [this message]
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 35/93] kvm: x86: do not leak guest xcr0 into host interrupt handlers Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 36/93] netlink: don't send NETLINK_URELEASE for unbound sockets Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 37/93] ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 38/93] ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 39/93] nl80211: check netlink protocol in socket release notification Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 40/93] debugfs: Make automount point inodes permanently empty Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 41/93] ALSA: hda - Fix regression of monitor_present flag in eld proc file Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 42/93] dmaengine: dw: fix master selection Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 43/93] lib: lz4: fixed zram with lz4 on big endian machines Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 44/93] usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 45/93] xhci: resume USB 3 roothub first Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 46/93] usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 47/93] usb: xhci: fix wild pointers in xhci_mem_cleanup Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 48/93] xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 49/93] USB: uas: Add a new NO_REPORT_LUNS quirk Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 50/93] usb: hcd: out of bounds access in for_each_companion Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 51/93] drm/radeon: fix initial connector audio value Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 52/93] drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 53/93] dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 54/93] pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 55/93] crypto: sha1-mb - use corrcet pointer while completing jobs Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 56/93] crypto: ccp - Prevent information leakage on export Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 57/93] dm cache metadata: fix cmd_read_lock() acquiring write lock Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 58/93] video: ARM CLCD: runtime check for Versatile Kamal Mostafa
2016-04-26 18:16 ` [PATCH 4.2.y-ckt 59/93] drm/i915/userptr: Hold mmref whilst calling get-user-pages Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 60/93] drm/i915: Use fw_domains_put_with_fifo() on HSW Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 61/93] ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 62/93] powerpc: scan_features() updates incorrect bits for REAL_LE Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 63/93] powerpc: Update cpu_user_features2 in scan_features() Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 64/93] powerpc: Update TM user feature bits " Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 65/93] drm/radeon: add a quirk for a XFX R9 270X Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 66/93] usb: gadget: f_fs: Fix use-after-free Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 67/93] futex: Handle unlock_pi race gracefully Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 68/93] futex: Acknowledge a new waiter in counter before plist Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 69/93] asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic() Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 70/93] ALSA: pcxhr: Fix missing mutex unlock Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 71/93] drm/dp/mst: Validate port in drm_dp_payload_send_msg() Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 72/93] drm/amdgpu: use defines for CRTCs and AMFT blocks Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 73/93] drm/amdgpu: bump the afmt limit for CZ, ST, Polaris Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 74/93] drm/radeon: forbid mapping of userptr bo through radeon device file Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 75/93] amdgpu/uvd: add uvd fw version for amdgpu Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 76/93] drm: Loongson-3 doesn't fully support wc memory Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 77/93] x86/mm/xen: Suppress hugetlbfs in PV guests Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 78/93] x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 79/93] x86 EDAC, sb_edac.c: Take account of channel hashing when needed Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 80/93] s390/scm_blk: fix deadlock for requests != REQ_TYPE_FS Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 81/93] packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 82/93] net: sched: do not requeue a NULL skb Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 83/93] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 84/93] pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 85/93] s390/spinlock: avoid yield to non existent cpu Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 86/93] net: bcmgenet: device stats are unsigned long Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 87/93] Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 88/93] net: ethernet: davinci_emac: Fix Unbalanced pm_runtime_enable Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 89/93] net: ethernet: davinci_emac: Fix platform_data overwrite Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 90/93] net/mlx4_core: Implement pci_resume callback Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 91/93] net/mlx4_core: Avoid repeated calls to pci enable/disable Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 92/93] atl2: Disable unimplemented scatter/gather feature Kamal Mostafa
2016-04-26 18:17 ` [PATCH 4.2.y-ckt 93/93] openvswitch: use flow protocol when recalculating ipv6 checksums Kamal Mostafa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1461694653-29506-35-git-send-email-kamal@canonical.com \
--to=kamal@canonical.com \
--cc=dhowells@redhat.com \
--cc=jmarchan@redhat.com \
--cc=kernel-team@lists.ubuntu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®