From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Paulo Alcantara (SUSE)" <paulo@paulo.ac>,
Steve French <stfrench@microsoft.com>,
Sasha Levin <sashal@kernel.org>,
linux-cifs@vger.kernel.org
Subject: [PATCH AUTOSEL 5.0 65/67] cifs: Fix slab-out-of-bounds when tracing SMB tcon
Date: Fri, 29 Mar 2019 20:50:45 -0400 [thread overview]
Message-ID: <20190330005047.25998-65-sashal@kernel.org> (raw)
In-Reply-To: <20190330005047.25998-1-sashal@kernel.org>
From: "Paulo Alcantara (SUSE)" <paulo@paulo.ac>
[ Upstream commit 68ddb496800acdb46172b4981dc3753ea9b39c25 ]
This patch fixes the following KASAN report:
[ 779.044746] BUG: KASAN: slab-out-of-bounds in string+0xab/0x180
[ 779.044750] Read of size 1 at addr ffff88814f327968 by task trace-cmd/2812
[ 779.044756] CPU: 1 PID: 2812 Comm: trace-cmd Not tainted 5.1.0-rc1+ #62
[ 779.044760] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-0-ga698c89-prebuilt.qemu.org 04/01/2014
[ 779.044761] Call Trace:
[ 779.044769] dump_stack+0x5b/0x90
[ 779.044775] ? string+0xab/0x180
[ 779.044781] print_address_description+0x6c/0x23c
[ 779.044787] ? string+0xab/0x180
[ 779.044792] ? string+0xab/0x180
[ 779.044797] kasan_report.cold.3+0x1a/0x32
[ 779.044803] ? string+0xab/0x180
[ 779.044809] string+0xab/0x180
[ 779.044816] ? widen_string+0x160/0x160
[ 779.044822] ? vsnprintf+0x5bf/0x7f0
[ 779.044829] vsnprintf+0x4e7/0x7f0
[ 779.044836] ? pointer+0x4a0/0x4a0
[ 779.044841] ? seq_buf_vprintf+0x79/0xc0
[ 779.044848] seq_buf_vprintf+0x62/0xc0
[ 779.044855] trace_seq_printf+0x113/0x210
[ 779.044861] ? trace_seq_puts+0x110/0x110
[ 779.044867] ? trace_raw_output_prep+0xd8/0x110
[ 779.044876] trace_raw_output_smb3_tcon_class+0x9f/0xc0
[ 779.044882] print_trace_line+0x377/0x890
[ 779.044888] ? tracing_buffers_read+0x300/0x300
[ 779.044893] ? ring_buffer_read+0x58/0x70
[ 779.044899] s_show+0x6e/0x140
[ 779.044906] seq_read+0x505/0x6a0
[ 779.044913] vfs_read+0xaf/0x1b0
[ 779.044919] ksys_read+0xa1/0x130
[ 779.044925] ? kernel_write+0xa0/0xa0
[ 779.044931] ? __do_page_fault+0x3d5/0x620
[ 779.044938] do_syscall_64+0x63/0x150
[ 779.044944] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 779.044949] RIP: 0033:0x7f62c2c2db31
[ 779.044955] Code: fe ff ff 48 8d 3d 17 9e 09 00 48 83 ec 08 e8 96 02
02 00 66 0f 1f 44 00 00 8b 05 fa fc 2c 00 48 63 ff 85 c0 75 13 31 c0
0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48
89
[ 779.044958] RSP: 002b:00007ffd6e116678 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 779.044964] RAX: ffffffffffffffda RBX: 0000560a38be9260 RCX: 00007f62c2c2db31
[ 779.044966] RDX: 0000000000002000 RSI: 00007ffd6e116710 RDI: 0000000000000003
[ 779.044966] RDX: 0000000000002000 RSI: 00007ffd6e116710 RDI: 0000000000000003
[ 779.044969] RBP: 00007f62c2ef5420 R08: 0000000000000000 R09: 0000000000000003
[ 779.044972] R10: ffffffffffffffa8 R11: 0000000000000246 R12: 00007ffd6e116710
[ 779.044975] R13: 0000000000002000 R14: 0000000000000d68 R15: 0000000000002000
[ 779.044981] Allocated by task 1257:
[ 779.044987] __kasan_kmalloc.constprop.5+0xc1/0xd0
[ 779.044992] kmem_cache_alloc+0xad/0x1a0
[ 779.044997] getname_flags+0x6c/0x2a0
[ 779.045003] user_path_at_empty+0x1d/0x40
[ 779.045008] do_faccessat+0x12a/0x330
[ 779.045012] do_syscall_64+0x63/0x150
[ 779.045017] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 779.045019] Freed by task 1257:
[ 779.045023] __kasan_slab_free+0x12e/0x180
[ 779.045029] kmem_cache_free+0x85/0x1b0
[ 779.045034] filename_lookup.part.70+0x176/0x250
[ 779.045039] do_faccessat+0x12a/0x330
[ 779.045043] do_syscall_64+0x63/0x150
[ 779.045048] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 779.045052] The buggy address belongs to the object at ffff88814f326600
which belongs to the cache names_cache of size 4096
[ 779.045057] The buggy address is located 872 bytes to the right of
4096-byte region [ffff88814f326600, ffff88814f327600)
[ 779.045058] The buggy address belongs to the page:
[ 779.045062] page:ffffea00053cc800 count:1 mapcount:0 mapping:ffff88815b191b40 index:0x0 compound_mapcount: 0
[ 779.045067] flags: 0x200000000010200(slab|head)
[ 779.045075] raw: 0200000000010200 dead000000000100 dead000000000200 ffff88815b191b40
[ 779.045081] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
[ 779.045083] page dumped because: kasan: bad access detected
[ 779.045085] Memory state around the buggy address:
[ 779.045089] ffff88814f327800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 779.045093] ffff88814f327880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 779.045097] >ffff88814f327900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 779.045099] ^
[ 779.045103] ffff88814f327980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 779.045107] ffff88814f327a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 779.045109] ==================================================================
[ 779.045110] Disabling lock debugging due to kernel taint
Correctly assign tree name str for smb3_tcon event.
Signed-off-by: Paulo Alcantara (SUSE) <paulo@paulo.ac>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/trace.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/cifs/trace.h b/fs/cifs/trace.h
index 59be48206932..b49bc925fb4f 100644
--- a/fs/cifs/trace.h
+++ b/fs/cifs/trace.h
@@ -378,19 +378,19 @@ DECLARE_EVENT_CLASS(smb3_tcon_class,
__field(unsigned int, xid)
__field(__u32, tid)
__field(__u64, sesid)
- __field(const char *, unc_name)
+ __string(name, unc_name)
__field(int, rc)
),
TP_fast_assign(
__entry->xid = xid;
__entry->tid = tid;
__entry->sesid = sesid;
- __entry->unc_name = unc_name;
+ __assign_str(name, unc_name);
__entry->rc = rc;
),
TP_printk("xid=%u sid=0x%llx tid=0x%x unc_name=%s rc=%d",
__entry->xid, __entry->sesid, __entry->tid,
- __entry->unc_name, __entry->rc)
+ __get_str(name), __entry->rc)
)
#define DEFINE_SMB3_TCON_EVENT(name) \
--
2.19.1
next prev parent reply other threads:[~2019-03-30 0:52 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-30 0:49 [PATCH AUTOSEL 5.0 01/67] ARC: u-boot args: check that magic number is correct Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 02/67] arc: hsdk_defconfig: Enable CONFIG_BLK_DEV_RAM Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 03/67] inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch() Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 04/67] perf/core: Restore mmap record type correctly Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 05/67] perf data: Don't store auxtrace index for directory data file Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 06/67] mips: bcm47xx: Enable USB power on Netgear WNDR3400v2 Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 07/67] ext4: avoid panic during forced reboot Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 08/67] ext4: add missing brelse() in add_new_gdb_meta_bg() Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 09/67] ext4: report real fs size after failed resize Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 10/67] ALSA: echoaudio: add a check for ioremap_nocache Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 11/67] ALSA: sb8: add a check for request_region Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 12/67] auxdisplay: hd44780: Fix memory leak on ->remove() Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 13/67] drm/udl: use drm_gem_object_put_unlocked Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 14/67] IB/mlx4: Fix race condition between catas error reset and aliasguid flows Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 15/67] i40iw: Avoid panic when handling the inetdev event Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 16/67] mmc: davinci: remove extraneous __init annotation Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 17/67] ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 18/67] paride/pf: cleanup queues when detection fails Sasha Levin
2019-03-30 0:49 ` [PATCH AUTOSEL 5.0 19/67] paride/pcd: " Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 20/67] thermal/intel_powerclamp: fix __percpu declaration of worker_data Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 21/67] thermal: samsung: Fix incorrect check after code merge Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 22/67] thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 23/67] thermal/int340x_thermal: Add additional UUIDs Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 24/67] thermal/int340x_thermal: fix mode setting Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 25/67] thermal/intel_powerclamp: fix truncated kthread name Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 26/67] scsi: iscsi: flush running unbind operations when removing a session Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 27/67] sched/cpufreq: Fix 32-bit math overflow Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 28/67] sched/core: Fix buffer overflow in cgroup2 property cpu.max Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 29/67] x86/mm: Don't leak kernel addresses Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 30/67] tools/power turbostat: return the exit status of a command Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 31/67] scsi: core: Also call destroy_rcu_head() for passthrough requests Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 32/67] scsi: qla2xxx: Fix NULL pointer crash due to stale CPUID Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 33/67] perf stat: Fix --no-scale Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 34/67] perf list: Don't forget to drop the reference to the allocated thread_map Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 35/67] perf tools: Fix errors under optimization level '-Og' Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 36/67] perf config: Fix an error in the config template documentation Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 37/67] perf config: Fix a memory leak in collect_config() Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 38/67] perf build-id: Fix memory leak in print_sdt_events() Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 39/67] perf top: Delete the evlist before perf_session, fixing heap-use-after-free issue Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 40/67] perf top: Fix error handling in cmd_top() Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 41/67] perf hist: Add missing map__put() in error case Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 42/67] perf map: Remove map from 'names' tree in __maps__remove() Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 43/67] perf maps: Purge all maps from the 'names' tree Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 44/67] perf top: Fix global-buffer-overflow issue Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 45/67] perf evsel: Free evsel->counts in perf_evsel__exit() Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 46/67] perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 47/67] perf tests: Fix memory leak by expr__find_other() in test__expr() Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 48/67] perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test() Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 49/67] ACPI / utils: Drop reference in test for device presence Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 50/67] PM / Domains: Avoid a potential deadlock Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 51/67] blk-iolatency: #include "blk.h" Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 52/67] drm/exynos/mixer: fix MIXER shadow registry synchronisation code Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 53/67] irqchip/stm32: Don't clear rising/falling config registers at init Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 54/67] irqchip/stm32: Don't set rising configuration " Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 55/67] irqchip/mbigen: Don't clear eventid when freeing an MSI Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 56/67] x86/hpet: Prevent potential NULL pointer dereference Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 57/67] x86/hyperv: " Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 58/67] x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 59/67] drm/nouveau/debugfs: Fix check of pm_runtime_get_sync failure Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 60/67] iommu/vt-d: Check capability before disabling protected memory Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 61/67] iommu/vt-d: Save the right domain ID used by hardware Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 62/67] x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 63/67] cifs: fix that return -EINVAL when do dedupe operation Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 64/67] fix incorrect error code mapping for OBJECTID_NOT_FOUND Sasha Levin
2019-03-30 0:50 ` Sasha Levin [this message]
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 66/67] x86/gart: Exclude GART aperture from kcore Sasha Levin
2019-03-30 0:50 ` [PATCH AUTOSEL 5.0 67/67] ext4: prohibit fstrim in norecovery mode Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190330005047.25998-65-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paulo@paulo.ac \
--cc=stable@vger.kernel.org \
--cc=stfrench@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome