Skip to contentSkip to conversation

New: BUG: KASAN: null-ptr-deref in strncpy+0x3c/0x60

Bug 205885 [email protected] 1 participant 8 messages Dec 17, 2019 – Dec 18, 2019

lore
Share & tools
lore

[email protected]

author
#0 lore raw

https://bugzilla.kernel.org/show_bug.cgi?id=205885

            Bug ID: 205885
           Summary: BUG: KASAN: null-ptr-deref in strncpy+0x3c/0x60
           Product: Platform Specific/Hardware
           Version: 2.5
    Kernel Version: 5.5-rc2
          Hardware: PPC-32
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: PPC-32
          Assignee: [email protected]
          Reporter: [email protected]
        Regression: No

Created attachment 286331
--> https://bugzilla.kernel.org/attachment.cgi?id=286331&action=edit
screenshot (5.5-rc2, PowerMac G4 DP)

I get this hit at booting kernel 5.5-rc2 on my G4 DP:

[...]

BUG: KASAN: null-ptr-deref in strncpy+0x3c/0x60
Read of size 1 at addr 00000000 by task swapper/0/1

CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W        5.5.0-rc2-PowerMacG4
Call Trace:
[ee8edd78] [c07819e0] dump_stack+0xbc/0x118 (unreliable)
[ee8edda8] [c0244b48] __kasan_report+0x174/0x180
[ee8edde8] [c07949dc] strncpy+0x3c/0x60
[ee8ede18] [c0b6979c] mount_block_root+0x200/0x3e0
[ee8edef8] [c0b69b74] prepare_namespace+0x164/0x174
[ee8edf18] [c0005f3c] kernel_init+0x14/0xf0
[ee8edf38] [c001a348] ret_from_kernel_thread+0x14/0x1c
=================================================================
BUG: Kernel NULL pointer dereference on read at 0x0000000
Faulting instruction address: 0xc07949dc
Oops: Kernel access of bad area sig: 11 (#1]

[...]

For details see screenshot (I appled a median filter but tesseract still was not able to make much text out of it).

Signature · 2 lines
You are receiving this mail because:
You are watching the assignee of the bug.
author
#2 lore raw

[Bug 205885] BUG: KASAN: null-ptr-deref in strncpy+0x3c/0x60

In reply to [email protected]

https://bugzilla.kernel.org/show_bug.cgi?id=205885

Christophe Leroy ([email protected]) changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]

--- Comment #2 from Christophe Leroy ([email protected]) --- You didn't get that with 5.5-rc1 ?
You get that as well when KASAN is not activated ?

If answer to both is 'yes', can you bisect ?

Signature · 2 lines
You are receiving this mail because:
You are watching the assignee of the bug.
author
#4 lore raw

[Bug 205885] BUG: KASAN: null-ptr-deref in strncpy+0x3c/0x60

In reply to [email protected]

https://bugzilla.kernel.org/show_bug.cgi?id=205885

Erhard F. ([email protected]) changed:

What |Removed |Added
----------------------------------------------------------------------------

 Attachment #286333|0                           |1

is obsolete| |

--- Comment #4 from Erhard F. ([email protected]) --- Created attachment 286343
--> https://bugzilla.kernel.org/attachment.cgi?id=286343&action=edit
kernel .config (5.5-rc2, PowerMac G4 DP)

Signature · 2 lines
You are receiving this mail because:
You are watching the assignee of the bug.
author
#6 lore raw

[Bug 205885] [Bisected] BUG: KASAN: null-ptr-deref in strncpy+0x3c/0x60

In reply to [email protected]

https://bugzilla.kernel.org/show_bug.cgi?id=205885

Erhard F. ([email protected]) changed:

What |Removed |Added
----------------------------------------------------------------------------

 Attachment #286345|0                           |1

is obsolete| |

--- Comment #6 from Erhard F. ([email protected]) --- Created attachment 286347
--> https://bugzilla.kernel.org/attachment.cgi?id=286347&action=edit
bisect.log

# git bisect bad | tee -a ~/bisect01.log 
cccaa5e33525fc07f4a2ce0518e50b9ddf435e47 is the first bad commit
commit cccaa5e33525fc07f4a2ce0518e50b9ddf435e47
Author: Dominik Brodowski <[email protected]>
Date:   Tue Oct 23 22:41:09 2018 +0200

init: use do_mount() instead of ksys_mount()

In prepare_namespace(), do_mount() can be used instead of ksys_mount() as the first and third argument are const strings in the kernel, the second and fourth argument are passed through anyway, and the fifth argument is NULL.

In do_mount_root(), ksys_mount() is called with the first and third argument being already kernelspace strings, which do not need to be copied over from userspace to kernelspace (again). The second and fourth arguments are passed through to do_mount() anyway. The fifth argument, while already residing in kernelspace, needs to be put into a page of its own. Then, do_mount() can be used instead of ksys_mount().

Once this is done, there are no in-kernel users to ksys_mount() left, which can therefore be removed.

Signed-off-by Dominik Brodowski <[email protected]>
 fs/namespace.c           | 10 ++--------
 include/linux/syscalls.h |  2 --
 init/do_mounts.c         | 28 ++++++++++++++++++++++------
 3 files changed, 24 insertions(+), 16 deletions(-)
Signature · 2 lines
You are receiving this mail because:
You are watching the assignee of the bug.
author
#7 lore raw

[Bug 205885] [Bisected] BUG: KASAN: null-ptr-deref in strncpy+0x3c/0x60

In reply to [email protected]

https://bugzilla.kernel.org/show_bug.cgi?id=205885

Michael Ellerman ([email protected]) changed:

What |Removed |Added
----------------------------------------------------------------------------

             Status|NEW                         |RESOLVED
                 CC|                            |[email protected]
         Resolution|---                         |PATCH_ALREADY_AVAILABLE

--- Comment #7 from Michael Ellerman ([email protected]) --- This is fixed upstream:

https://git.kernel.org/torvalds/c/7de7de7ca0ae0fc70515ee3154af33af75edae2c

Signature · 2 lines
You are receiving this mail because:
You are watching the assignee of the bug.