system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-18 09:18:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/arch/powerpc
History
Daniel Axtens 934bda59f2 powerpc/pseries/hvconsole: Fix stack overread via udbg 
While developing KASAN for 64-bit book3s, I hit the following stack
over-read.

It occurs because the hypercall to put characters onto the terminal
takes 2 longs (128 bits/16 bytes) of characters at a time, and so
hvc_put_chars() would unconditionally copy 16 bytes from the argument
buffer, regardless of supplied length. However, udbg_hvc_putc() can
call hvc_put_chars() with a single-byte buffer, leading to the error.

  ==================================================================
  BUG: KASAN: stack-out-of-bounds in hvc_put_chars+0xdc/0x110
  Read of size 8 at addr c0000000023e7a90 by task swapper/0

  CPU: 0 PID: 0 Comm: swapper Not tainted 5.2.0-rc2-next-20190528-02824-g048a6ab4835b #113
  Call Trace:
    dump_stack+0x104/0x154 (unreliable)
    print_address_description+0xa0/0x30c
    __kasan_report+0x20c/0x224
    kasan_report+0x18/0x30
    __asan_report_load8_noabort+0x24/0x40
    hvc_put_chars+0xdc/0x110
    hvterm_raw_put_chars+0x9c/0x110
    udbg_hvc_putc+0x154/0x200
    udbg_write+0xf0/0x240
    console_unlock+0x868/0xd30
    register_console+0x970/0xe90
    register_early_udbg_console+0xf8/0x114
    setup_arch+0x108/0x790
    start_kernel+0x104/0x784
    start_here_common+0x1c/0x534

  Memory state around the buggy address:
   c0000000023e7980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   c0000000023e7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
  >c0000000023e7a80: f1 f1 01 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
                           ^
   c0000000023e7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   c0000000023e7b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ==================================================================

Document that a 16-byte buffer is requred, and provide it in udbg.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2019-06-14 15:35:53 +10:00
..
boot treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 40 2019-05-24 17:27:12 +02:00
configs This pull request contains the following changes for MTD: 2019-05-12 17:57:52 -04:00
crypto treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
include powerpc/powernv: Show checkstop reason for NPU2 HMIs 2019-06-02 19:39:36 +10:00
kernel powerpc/pseries: Fix xive=off command line 2019-06-02 19:39:36 +10:00
kvm treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 114 2019-05-24 17:39:01 +02:00
lib powerpc/lib: only build ldstfp.o when CONFIG_PPC_FPU is set 2019-05-28 12:08:11 +10:00
math-emu powerpc: math-emu: remove unneeded header search paths 2019-01-14 20:39:27 +11:00
mm powerpc/mm: Make some symbols static that can be 2019-05-28 12:08:10 +10:00
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2019-03-16 12:20:08 -07:00
oprofile Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
perf treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 112 2019-05-24 17:39:01 +02:00
platforms powerpc/pseries/hvconsole: Fix stack overread via udbg 2019-06-14 15:35:53 +10:00
purgatory powerpc: disable KASAN instrumentation on early/critical files. 2019-05-03 01:20:26 +10:00
sysdev powerpc/pseries: Fix xive=off command line 2019-06-02 19:39:36 +10:00
tools powerpc/tools/checkpatch: Ignore DT_SPLIT_BINDING_PATCH 2018-12-04 19:45:01 +11:00
xmon treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 76 2019-05-24 17:37:51 +02:00
Kbuild powerpc: Add -Werror at arch/powerpc level 2018-10-19 00:56:17 +11:00
Kconfig mm: memblock: make keeping memblock memory opt-in rather than opt-out 2019-05-14 09:47:50 -07:00
Kconfig.debug powerpc/xmon: add read-only mode 2019-05-03 02:54:57 +10:00
Makefile treewide: prefix header search paths with $(srctree)/ 2019-05-18 11:49:57 +09:00
Makefile.postlink