From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751672AbdJXXyg (ORCPT ); Tue, 24 Oct 2017 19:54:36 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:56417 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751529AbdJXXyf (ORCPT ); Tue, 24 Oct 2017 19:54:35 -0400 Subject: Re: out of bounds strscpy from seccomp_actions_logged_handler To: Dave Jones References: <20171024234616.nkrctcxzet7elyej@codemonkey.org.uk> Cc: Kees Cook , Linux Kernel From: Tyler Hicks Message-ID: <8d59f73f-3ecb-277d-1e70-682792689a6d@canonical.com> Date: Tue, 24 Oct 2017 18:54:25 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <20171024234616.nkrctcxzet7elyej@codemonkey.org.uk> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="LiKjWm3pKm5cTRcUjE9RgmQDNfNRowrq2" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --LiKjWm3pKm5cTRcUjE9RgmQDNfNRowrq2 Content-Type: multipart/mixed; boundary="bQka8WLeVH1l2awiTrBU6tfT76hKKThHw"; protected-headers="v1" From: Tyler Hicks To: Dave Jones Cc: Kees Cook , Linux Kernel Message-ID: <8d59f73f-3ecb-277d-1e70-682792689a6d@canonical.com> Subject: Re: out of bounds strscpy from seccomp_actions_logged_handler References: <20171024234616.nkrctcxzet7elyej@codemonkey.org.uk> In-Reply-To: <20171024234616.nkrctcxzet7elyej@codemonkey.org.uk> --bQka8WLeVH1l2awiTrBU6tfT76hKKThHw Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 10/24/2017 06:46 PM, Dave Jones wrote: > (Triggered with trinity, but it seems just a 'cat > /proc/sys/kernel/seccomp/actions_logged' reproduces just as easily). Hi Dave - Thanks for the report. This is a false positive that was previously discussed here: https://lkml.kernel.org/r/<20171010182805.52b9b2af@cakuba.netronome.com> Tyler >=20 >=20 > BUG: KASAN: global-out-of-bounds in strscpy+0x133/0x2d0 > Read of size 8 at addr ffffffff824b0028 by task trinity-c63/6883 >=20 > CPU: 3 PID: 6883 Comm: trinity-c63 Not tainted 4.14.0-rc6-think+ #1=20 > Call Trace: > dump_stack+0xbc/0x145 > ? dma_virt_map_sg+0xfb/0xfb > print_address_description+0x2d/0x260 > kasan_report+0x277/0x360 > ? strscpy+0x133/0x2d0 > strscpy+0x133/0x2d0 > ? strcasecmp+0xb0/0xb0 > seccomp_actions_logged_handler+0x2c5/0x440 > ? seccomp_send_sigsys+0xd0/0xd0 > ? lock_downgrade+0x310/0x310 > ? lock_release+0x890/0x890 > ? do_raw_spin_unlock+0x147/0x220 > ? do_raw_spin_trylock+0x100/0x100 > ? do_raw_spin_trylock+0x40/0x100 > ? do_raw_spin_lock+0x110/0x110 > proc_sys_call_handler+0x1b1/0x1f0 > ? seccomp_send_sigsys+0xd0/0xd0 > ? proc_sys_readdir+0x6d0/0x6d0 > do_iter_read+0x23b/0x280 > vfs_readv+0x107/0x180 > ? compat_rw_copy_check_uvector+0x1d0/0x1d0 > ? native_sched_clock+0xf9/0x1a0 > ? cyc2ns_read_end+0x10/0x10 > ? __fget_light+0x181/0x200 > ? fget_raw+0x10/0x10 > ? __lock_is_held+0x2e/0xd0 > ? rcu_read_lock_sched_held+0x90/0xa0 > ? __context_tracking_exit.part.4+0x223/0x290 > ? context_tracking_recursion_enter+0x50/0x50 > ? __task_pid_nr_ns+0x1c4/0x300 > ? do_preadv+0xb0/0xf0 > do_preadv+0xb0/0xf0 > ? SyS_preadv+0x10/0x10 > do_syscall_64+0x182/0x400 > ? syscall_return_slowpath+0x270/0x270 > ? rcu_read_lock_sched_held+0x90/0xa0 > ? __context_tracking_exit.part.4+0x223/0x290 > ? mark_held_locks+0x1b/0xa0 > ? return_from_SYSCALL_64+0x2d/0x7a > ? trace_hardirqs_on_caller+0x17a/0x250 > ? trace_hardirqs_on_thunk+0x1a/0x1c > entry_SYSCALL64_slow_path+0x25/0x25 > RIP: 0033:0x7f52d5f45219 > RSP: 002b:00007fff8a422838 EFLAGS: 00000246 > ORIG_RAX: 0000000000000147 > RAX: ffffffffffffffda RBX: 0000000000000147 RCX: 00007f52d5f45219 > RDX: 00000000000000f3 RSI: 000055d6d5b413d0 RDI: 00000000000000b2 > RBP: 00007fff8a4228e0 R08: 0000316c1272491c R09: 0000000000000000 > R10: 00000000725c3dd7 R11: 0000000000000246 R12: 0000000000000002 > R13: 00007f52d645b058 R14: 00007f52d661b698 R15: 00007f52d645b000 >=20 > The buggy address belongs to the variable: > kdb_rwtypes+0x1268/0x1320 >=20 > Memory state around the buggy address: > ffffffff824aff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffffffff824aff80: 00 00 00 00 00 00 00 00 00 00 00 00 07 fa fa fa >> ffffffff824b0000: fa fa fa fa 00 05 fa fa fa fa fa fa 02 fa fa fa > ^ > ffffffff824b0080: fa fa fa fa 00 00 01 fa fa fa fa fa 00 00 04 fa > ffffffff824b0100: fa fa fa fa 00 06 fa fa fa fa fa fa 00 07 fa fa > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > Disabling lock debugging due to kernel taint >=20 --bQka8WLeVH1l2awiTrBU6tfT76hKKThHw-- --LiKjWm3pKm5cTRcUjE9RgmQDNfNRowrq2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJZ79KyAAoJENaSAD2qAscKWgYP/0ZjZR0LcfqDZOw8ItxPU7Qs iIXRBoa1jaqj7Z5BMWvJqy/IOaBAtwX0Wa1ol4lKL29doURm9lkwT+sLNJ88rbXj jxk64NSfyuF8lxGR2dqtLQrKvFZytvvKG/frw8M0eb+ZX34+7xdiK8+/REv5y5Lq t06X7cit3YKaqsXi8Uooc/ZcmvEGXl1P2I4Q9KGyCqpFE6nitpBk/GnIsGZcwM/q 7xLA3aqchcSVKXMgm7+j8ruKdKUc8PfE5X0qo+zhjRBhwnfYJ34XFc06MJ4kPCFI IQL157wRKk3nGmA4cnJKvSqSpCAozLlZx4780KJfxo77gZNPhT0enGYjEew6wKcw OKa21qJK53DwkyuMnBkeMpSapgYzH+4r6ZqwcSAwEO/zXbHUL9xeDAcbmaZjwQwP qxZDuUM5VU7a5ZyaNIhbhCBhbGWfBhGucFCsqoioSDjUw8fvOapxk9cLk0cAjkzt uch5bTqCkjLKouBp1/4yoHPkjLw8X3SFrtEXWqdHaomtzOPZ7J6GL/feuiKKB4SU cKSD+Ylsc3ZsoyTbjIObRPMx8We2U5Lcf2DJm2RxeAK6vHGwT7S3dv+CS5p8nNpI CeB1OyMaEL3Jk+u0cy1w7mNvywLdMOc+S/1bMp5Nl2eQYUVkbj+x8wjUq+QphRH5 uw0bzADwBPag4ae+HhIt =NfNk -----END PGP SIGNATURE----- --LiKjWm3pKm5cTRcUjE9RgmQDNfNRowrq2--