Hi,
We are working on a memory error detector AddressSanitizer for Linux
kernel
(https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel),
it can detect use-after-free and buffer-overflow errors.
Here one of the reports from the tool:
[ 166.124485] ERROR: AddressSanitizer: heap-buffer-overflow on
address ffff880024ab8600
[ 166.126613] ffff880024ab8600 is located 0 bytes to the right of
512-byte region [ffff880024ab8400, ffff880024ab8600)
[ 166.129583] Accessed by thread T2505:
[ 166.130732] #0 inlined describe_heap_address
./arch/x86/mm/asan/report.c:164
[ 166.130732] #0 ffffffff810dd277 (asan_report_error+0x2f7/0x400)
./arch/x86/mm/asan/report.c:278
[ 166.132475] #1 ffffffff810dc6a0 (asan_check_region+0x30/0x40)
./arch/x86/mm/asan/asan.c:37
[ 166.134485] #2 ffffffff810dd3c3 (__tsan_read1+0x13/0x20) ??:0
[ 166.136397] #3 inlined sd_read_cache_type ./drivers/scsi/sd.c:2426
[ 166.136397] #3 ffffffff81675546
(sd_revalidate_disk+0x23d6/0x28d0) ./drivers/scsi/sd.c:2720
[ 166.138531] #4 ffffffff812f437b (revalidate_disk+0x4b/0xc0)
./fs/block_dev.c:975
[ 166.140449] #5 ffffffff8167143e (sd_rescan+0x3e/0x50)
./drivers/scsi/sd.c:1473
[ 166.142539] #6 ffffffff8162c164 (scsi_rescan_device+0x64/0x90)
./drivers/scsi/scsi_scan.c:1566
[ 166.144557] #7 ffffffff81694e65 (ata_scsi_dev_rescan+0xf5/0x170)
./drivers/ata/libata-scsi.c:3986
[ 166.146680] #8 inlined trace_workqueue_execute_end
./kernel/workqueue.c:2186
[ 166.146680] #8 ffffffff81111640 (process_one_work+0x2d0/0x750)
./kernel/workqueue.c:2191
[ 166.149012] #9 ffffffff81111d23 (worker_thread+0x263/0x640)
./include/linux/list.h:188
[ 166.151061] #10 ffffffff8111c092 (kthread+0x132/0x140) kthread.c:0
[ 166.152853] #11 ffffffff8192841c (ret_from_fork+0x7c/0xb0)
./arch/x86/kernel/entry_64.S:570
[ 166.154790]
[ 166.155389] Allocated by thread T2505:
[ 166.156801] #0 ffffffff810dc768 (asan_slab_alloc+0x48/0xb0)
./arch/x86/mm/asan/asan.c:91
[ 166.158850] #1 inlined slab_alloc ./mm/slab.c:3475
[ 166.158850] #1 inlined __do_kmalloc ./mm/slab.c:3749
[ 166.158850] #1 ffffffff812832ec (__kmalloc+0xbc/0x500) ./mm/slab.c:3763
[ 166.161364] #2 ffffffff81673234 (sd_revalidate_disk+0xc4/0x28d0)
./drivers/scsi/sd.c:2698
[ 166.164302] #3 ffffffff812f437b (revalidate_disk+0x4b/0xc0)
./fs/block_dev.c:975
[ 166.167012] #4 ffffffff8167143e (sd_rescan+0x3e/0x50)
./drivers/scsi/sd.c:1473
[ 166.169478] #5 ffffffff8162c164 (scsi_rescan_device+0x64/0x90)
./drivers/scsi/scsi_scan.c:1566
[ 166.172321] #6 ffffffff81694e65 (ata_scsi_dev_rescan+0xf5/0x170)
./drivers/ata/libata-scsi.c:3986
[ 166.175156] #7 inlined trace_workqueue_execute_end
./kernel/workqueue.c:2186
[ 166.175156] #7 ffffffff81111640 (process_one_work+0x2d0/0x750)
./kernel/workqueue.c:2191
[ 166.177222] #8 ffffffff81111d23 (worker_thread+0x263/0x640)
./include/linux/list.h:188
[ 166.179193] #9 ffffffff8111c092 (kthread+0x132/0x140) kthread.c:0
[ 166.180988] #10 ffffffff8192841c (ret_from_fork+0x7c/0xb0)
./arch/x86/kernel/entry_64.S:570
[ 166.182931]
[ 166.183537] Shadow bytes around the buggy address:
[ 166.185391] ffff880024ab8380: fa fa fa fa fa fa fa fa fa fa fa fa
fa fa fa fa
[ 166.187758] ffff880024ab8400: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 166.190227] ffff880024ab8480: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 166.192684] ffff880024ab8500: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 166.195152] ffff880024ab8580: 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00
[ 166.197649] =>ffff880024ab8600:[fa]fa fa fa fa fa fa fa fa fa fa fa
fa fa fa fa
[ 166.199128] ffff880024ab8680: fa fa fa fa fa fa fa fa fa fa fa fa
fa fa fa fa
[ 166.200962] ffff880024ab8700: fa fa fa fa fa fa fa fa fd fd fd fd
fd fd fd fd
[ 166.203069] ffff880024ab8780: fd fd fd fd fd fd fd fd fd fd fd fd
fd fd fd fd
[ 166.205202] ffff880024ab8800: fd fd fd fd fd fd fd fd fd fd fd fd
fd fd fd fd
[ 166.207302] ffff880024ab8880: fd fd fd fd fd fd fd fd fd fd fd fd
fd fd fd fd
[ 166.209237] Shadow byte legend (one shadow byte represents 8
application bytes):
[ 166.211273] Addressable: 00
[ 166.212358] Partially addressable: 01 02 03 04 05 06 07
[ 166.213871] Heap redzone: fa
[ 166.214979] Heap kmalloc redzone: fb
[ 166.216062] Freed heap region: fd
[ 166.217149] Shadow gap: fe
The code in sd_read_cache_type does the following:
while (offset < len) {
...
}
...
if ((buffer[offset] & 0x3f) != modepage) {
sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
goto defaults;
}
When control leaves the while loop, offset >= len, so buffer[offset]
reads random garbage out-of-bounds.
It the worst case it can lead to crash, or if (buffer[offset] & 0x3f)
happen to be == modepage, then it will read more garbage.
Please help validate and triage this.
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
