From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50C12C001E0 for ; Wed, 19 Jul 2023 22:44:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230306AbjGSWo5 (ORCPT ); Wed, 19 Jul 2023 18:44:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41268 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230253AbjGSWox (ORCPT ); Wed, 19 Jul 2023 18:44:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10CEC1FE6; Wed, 19 Jul 2023 15:44:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 999BF61840; Wed, 19 Jul 2023 22:44:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E474FC433CA; Wed, 19 Jul 2023 22:44:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1689806692; bh=KpGFKEUuiIitS8UfirDt+cuq2SuWxsDx+OdYFcxFU7M=; h=Date:From:To:CC:Subject:In-Reply-To:References:From; b=JpRakYUuJVAkIJR5HXblpzkI9PdUqU4i6XmbSMiTmtzfemV4WD1akHLy5SRrSFQpN un+aQppiWBaKop97bHOHt21+1n5Lni5eMuEOpIRbNOIQw+sidPK0D5Pg+bixMmM/iT 5x+yJ277k0CF6zsE7cPVFO/voXF/CTgmkLAMhiOiddjfli33xDNSUhJZVyNPVcWVMe /N7mjpOjsORLyfseS1M97Cx+eWLMUz5gcr35FhKsYEKzfkvyhrCKdrQjUpIFLkHSCx rHSKNa1leBY7DM/IVkwNmgKkCvpnnBeCpNNjaU+nXSyos4fD53d+gJSxubvCXqzjo2 SL/39Pi2aAirg== Date: Wed, 19 Jul 2023 15:37:02 -0700 From: Kees Cook To: Larry Finger , Kees Cook CC: Hans de Goede , Azeem Shaikh , LKML , linux-hardening@vger.kernel.org, "Gustavo A. R. Silva" Subject: Re: Crash in VirtualBox virtual machines running kernel 6.5 User-Agent: K-9 Mail for Android In-Reply-To: References: <202307190823.086EFD42D9@keescook> <202307190835.752D710D@keescook> Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On July 19, 2023 2:24:52 PM PDT, Larry Finger wrote: >On 7/19/23 10:36, Kees Cook wrote: >> Okay, please try: >>=20 >> diff --git a/fs/vboxsf/shfl_hostintf=2Eh b/fs/vboxsf/shfl_hostintf=2Eh >> index aca829062c12=2E=2E902fe3224453 100644 >> --- a/fs/vboxsf/shfl_hostintf=2Eh >> +++ b/fs/vboxsf/shfl_hostintf=2Eh >> @@ -68,12 +68,11 @@ struct shfl_string { >> /** UTF-8 or UTF-16 string=2E Nul terminated=2E */ >> union { >> - u8 utf8[2]; >> - u16 utf16[1]; >> - u16 ucs2[1]; /* misnomer, use utf16=2E */ >> + DECLARE_FLEX_ARRAY(u8, utf8); >> + DECLARE_FLEX_ARRAY(u16, utf16); >> } string; >> }; >> -VMMDEV_ASSERT_SIZE(shfl_string, 6); >> +VMMDEV_ASSERT_SIZE(shfl_string, 4); >> /* The size of shfl_string w/o the string part=2E */ >> #define SHFLSTRING_HEADER_SIZE 4 >>=20 >>=20 >> The size assert doesn't seem to be used anywhere else, but I can do a >> more careful binary analysis later today=2E=2E=2E'' > >Kees, > >The testing was harder than I expected=2E My standard kernel would not lo= ad the system disk on the VM, thus I had to build one using my distros conf= iguration=2E It is really painful to wait for all those drivers to build, b= ut I figured that might be faster than trying to find the incorrect paramet= er=2E > >I can finally report that vboxsf no longer generated a BUG=2E It is getti= ng farther, but I am not done yet=2E It now generates a line that says "Unk= nown parameter tag" and then hangs=2E I have not tracked that down yet=2E > >I was not aware of the DECLARE_FLEX_ARRAY() macro=2E I had considered rem= oving the union and creating a simple string[] declaration, but I do not me= ss with file systems, and decided to let the experts handle it=2E > >I will let you know what I find about that unknown parameter=2E It probab= ly is coming from VirtualBox=2E It's possible the size really needs to stay 6 bytes=2E In that case, try a= dding a "u8 legacy_padding[2]" to the union and restore the VMMDEV_ASSERT_S= IZE? --=20 Kees Cook