[BUG] regulator: fixed: KASAN slab-out-of-bounds in reg_fixed_voltage_probe

[BUG] regulator: fixed: KASAN slab-out-of-bounds in reg_fixed_voltage_probe

[CJ]

Hi,


I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer mounts sysfs, overrides the driver of the existing
dummy_udc.0 platform device with reg-fixed-voltage, unbinds that device from
its original driver, and then writes the device name into the
reg-fixed-voltage bind attribute. That binds the fixed-voltage regulator
driver to a platform device that was never instantiated for it.


reg_fixed_voltage_probe() then reads the platform data of that device as if
it were a regulator description. KASAN reports a 4-byte out-of-bounds read
in reg_fixed_voltage_probe() itself, reached through bind_store() ->
device_driver_attach() -> __driver_probe_device() -> really_probe() ->
platform_probe(). The read happens in the task that performed the sysfs
write.


This looks like the probe path trusting platform_data that belongs to a
different device. The driver does not verify that the platform device it is
bound to actually carries regulator data, so the fields it reads come from
whatever allocation the original device had. A length or type check on the
platform data, or refusing to probe a device that was not created for this
driver, would be the natural guard. I have not confirmed which read of the
probe is the first to go past the allocation boundary.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=062ee723310d23496f9b, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:
The reproducer is the program below, which requires no large encoded image:


mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/dummy_udc.0/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='reg-fixed-voltage\x00', 0x12)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='dummy_udc.0\x00', 0xb)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/platform/drivers/reg-fixed-voltage/bind\x00', 0x1, 0x0)
write(r2, &(0x7f0000000700)='dummy_udc.0\x00', 0xb)


console output: https://pastebin.com/raw/4C2dPj0T
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=31dfefc4a14efea3


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu