Re: BUG: bad usercopy in memdup_user

2017-12-31 Thread Dmitry Vyukov
On Wed, Dec 20, 2017 at 10:44 AM, David Laight wrote: > From: Al Viro >> Sent: 19 December 2017 21:49 >> > I suspect that an "offset and size within the kernel object" value >> > might make sense. But what does the _pointer_ tell you? >> >> Well, for example seeing a 0xfff4 where a po

RE: BUG: bad usercopy in memdup_user

2017-12-20 Thread David Laight
From: Al Viro > Sent: 19 December 2017 21:49 > > I suspect that an "offset and size within the kernel object" value > > might make sense. But what does the _pointer_ tell you? > > Well, for example seeing a 0xfff4 where a pointer to object > must have been is a pretty strong hint to s

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Linus Torvalds
On Tue, Dec 19, 2017 at 8:05 PM, Linus Torvalds wrote: > > And yes, we had a few cases where the hashing actually did hide the > values, and I've been applying patches to turn those from %p to %px. So far at least: 10a7e9d84915 Do not hash userspace addresses in fault handlers 85c3e4a5a185 m

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Linus Torvalds
On Tue, Dec 19, 2017 at 7:50 PM, Matthew Wilcox wrote: > On Tue, Dec 19, 2017 at 09:48:49PM +, Al Viro wrote: >> Well, for example seeing a 0xfff4 where a pointer to object >> must have been is a pretty strong hint to start looking for a way for >> that ERR_PTR(-ENOMEM) having ende

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Matthew Wilcox
On Tue, Dec 19, 2017 at 09:48:49PM +, Al Viro wrote: > Well, for example seeing a 0xfff4 where a pointer to object > must have been is a pretty strong hint to start looking for a way for > that ERR_PTR(-ENOMEM) having ended up there... Something like > 0x6e69622f7273752f is almost

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Linus Torvalds
On Tue, Dec 19, 2017 at 1:48 PM, Al Viro wrote: > On Tue, Dec 19, 2017 at 01:36:46PM -0800, Linus Torvalds wrote: > >> I suspect that an "offset and size within the kernel object" value >> might make sense. But what does the _pointer_ tell you? > > Well, for example seeing a 0xfff4 wh

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Laura Abbott
On 12/19/2017 01:36 PM, Linus Torvalds wrote: On Tue, Dec 19, 2017 at 5:22 AM, Matthew Wilcox wrote: Could we have a way to know that the printed address is hashed and not just a pointer getting completely scrogged? Perhaps prefix it with ... a hash! So this line would look like: The proble

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Matthew Wilcox
On Tue, Dec 19, 2017 at 01:36:46PM -0800, Linus Torvalds wrote: > On Tue, Dec 19, 2017 at 5:22 AM, Matthew Wilcox wrote: > > > > Could we have a way to know that the printed address is hashed and not just > > a pointer getting completely scrogged? Perhaps prefix it with ... a hash! > > So this li

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Randy Dunlap
On 12/19/2017 01:48 PM, Al Viro wrote: > On Tue, Dec 19, 2017 at 01:36:46PM -0800, Linus Torvalds wrote: > >> I suspect that an "offset and size within the kernel object" value >> might make sense. But what does the _pointer_ tell you? > > Well, for example seeing a 0xfff4 where a po

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Kees Cook
On Tue, Dec 19, 2017 at 1:36 PM, Linus Torvalds wrote: > In this case, there's obviously no permission issue: it's an error > report. So it's either "remove it, or switch to %px". Yup, my intention was to kill this %p and enhance the report to actually include the useful information like, "what i

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Al Viro
On Tue, Dec 19, 2017 at 01:36:46PM -0800, Linus Torvalds wrote: > I suspect that an "offset and size within the kernel object" value > might make sense. But what does the _pointer_ tell you? Well, for example seeing a 0xfff4 where a pointer to object must have been is a pretty strong

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Linus Torvalds
On Tue, Dec 19, 2017 at 5:22 AM, Matthew Wilcox wrote: > > Could we have a way to know that the printed address is hashed and not just > a pointer getting completely scrogged? Perhaps prefix it with ... a hash! > So this line would look like: The problem with that is that it will break tools tha

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Tobin C. Harding
Adding Linus On Tue, Dec 19, 2017 at 03:12:05PM +0100, Dmitry Vyukov wrote: > On Tue, Dec 19, 2017 at 3:08 PM, Tetsuo Handa > wrote: > > Dmitry Vyukov wrote: > >> On Tue, Dec 19, 2017 at 2:22 PM, Matthew Wilcox > >> wrote: > >> >> > >> This BUG is reporting > >> >> > >> > >> >> > >> [ 26.0897

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Tobin C. Harding
On Tue, Dec 19, 2017 at 05:22:46AM -0800, Matthew Wilcox wrote: > On Tue, Dec 19, 2017 at 07:37:46PM +1100, Tobin C. Harding wrote: > > On Tue, Dec 19, 2017 at 09:12:58AM +0100, Dmitry Vyukov wrote: > > > On Tue, Dec 19, 2017 at 1:57 AM, Kees Cook wrote: > > > > On Mon, Dec 18, 2017 at 6:22 AM, Te

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Dmitry Vyukov
On Tue, Dec 19, 2017 at 3:08 PM, Tetsuo Handa wrote: > Dmitry Vyukov wrote: >> On Tue, Dec 19, 2017 at 2:22 PM, Matthew Wilcox wrote: >> >> > >> This BUG is reporting >> >> > >> >> >> > >> [ 26.089789] usercopy: kernel memory overwrite attempt detected to >> >> > >> 22a5b430 (kmalloc-1

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Tetsuo Handa
Dmitry Vyukov wrote: > On Tue, Dec 19, 2017 at 2:22 PM, Matthew Wilcox wrote: > >> > >> This BUG is reporting > >> > >> > >> > >> [ 26.089789] usercopy: kernel memory overwrite attempt detected to > >> > >> 22a5b430 (kmalloc-1024) (1024 bytes) > >> > >> > >> > >> line. But isn't 000

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Dmitry Vyukov
On Tue, Dec 19, 2017 at 2:22 PM, Matthew Wilcox wrote: >> > >> This BUG is reporting >> > >> >> > >> [ 26.089789] usercopy: kernel memory overwrite attempt detected to >> > >> 22a5b430 (kmalloc-1024) (1024 bytes) >> > >> >> > >> line. But isn't 22a5b430 strange for kmalloc(1024,

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Matthew Wilcox
On Tue, Dec 19, 2017 at 07:37:46PM +1100, Tobin C. Harding wrote: > On Tue, Dec 19, 2017 at 09:12:58AM +0100, Dmitry Vyukov wrote: > > On Tue, Dec 19, 2017 at 1:57 AM, Kees Cook wrote: > > > On Mon, Dec 18, 2017 at 6:22 AM, Tetsuo Handa > > >> This BUG is reporting > > >> > > >> [ 26.089789] use

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Dmitry Vyukov
On Tue, Dec 19, 2017 at 10:04 AM, Tobin C. Harding wrote: >> >> > wrote: >> >> >> On 2017/12/18 22:40, syzbot wrote: >> >> >>> Hello, >> >> >>> >> >> >>> syzkaller hit the following crash on >> >> >>> 6084b576dca2e898f5c101baef151f7bfdbb606d >> >> >>> git://git.kernel.org/pub/scm/linux/kernel/gi

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Tobin C. Harding
On Tue, Dec 19, 2017 at 09:41:39AM +0100, Dmitry Vyukov wrote: > On Tue, Dec 19, 2017 at 9:37 AM, Tobin C. Harding wrote: > >> > wrote: > >> >> On 2017/12/18 22:40, syzbot wrote: > >> >>> Hello, > >> >>> > >> >>> syzkaller hit the following crash on > >> >>> 6084b576dca2e898f5c101baef151f7bfdbb6

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Dmitry Vyukov
On Tue, Dec 19, 2017 at 9:37 AM, Tobin C. Harding wrote: >> > wrote: >> >> On 2017/12/18 22:40, syzbot wrote: >> >>> Hello, >> >>> >> >>> syzkaller hit the following crash on >> >>> 6084b576dca2e898f5c101baef151f7bfdbb606d >> >>> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Tobin C. Harding
On Tue, Dec 19, 2017 at 09:12:58AM +0100, Dmitry Vyukov wrote: > On Tue, Dec 19, 2017 at 1:57 AM, Kees Cook wrote: > > On Mon, Dec 18, 2017 at 6:22 AM, Tetsuo Handa > > wrote: > >> On 2017/12/18 22:40, syzbot wrote: > >>> Hello, > >>> > >>> syzkaller hit the following crash on > >>> 6084b576dca2

Re: BUG: bad usercopy in memdup_user

2017-12-19 Thread Dmitry Vyukov
On Tue, Dec 19, 2017 at 1:57 AM, Kees Cook wrote: > On Mon, Dec 18, 2017 at 6:22 AM, Tetsuo Handa > wrote: >> On 2017/12/18 22:40, syzbot wrote: >>> Hello, >>> >>> syzkaller hit the following crash on >>> 6084b576dca2e898f5c101baef151f7bfdbb606d >>> git://git.kernel.org/pub/scm/linux/kernel/git/

Re: BUG: bad usercopy in memdup_user

2017-12-18 Thread Kees Cook
On Mon, Dec 18, 2017 at 6:22 AM, Tetsuo Handa wrote: > On 2017/12/18 22:40, syzbot wrote: >> Hello, >> >> syzkaller hit the following crash on 6084b576dca2e898f5c101baef151f7bfdbb606d >> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master >> compiler: gcc (GCC) 7.1.1 20170620

Re: BUG: bad usercopy in memdup_user

2017-12-18 Thread Tetsuo Handa
On 2017/12/18 22:40, syzbot wrote: > Hello, > > syzkaller hit the following crash on 6084b576dca2e898f5c101baef151f7bfdbb606d > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master > compiler: gcc (GCC) 7.1.1 20170620 > .config is attached > Raw console output is attached. > >