diff mbox series

powerpc: pseries/hvconsole: fix stack overread

Message ID 20190523015708.20395-1-dja@axtens.net
State Superseded
Headers show
Series powerpc: pseries/hvconsole: fix stack overread | expand

Checks

Context Check Description
snowpatch_ozlabs/apply_patch success Successfully applied on branch next (8150a153c013aa2dd1ffae43370b89ac1347a7fb)
snowpatch_ozlabs/build-ppc64le fail Test build-ppc64le on branch next
snowpatch_ozlabs/build-ppc64be fail Test build-ppc64be on branch next
snowpatch_ozlabs/build-ppc64e fail Test build-ppc64e on branch next
snowpatch_ozlabs/build-pmac32 fail Test build-pmac32 on branch next
snowpatch_ozlabs/checkpatch fail Test checkpatch on branch next
snowpatch_ozlabs/apply_patch success Successfully applied on branch next (8150a153c013aa2dd1ffae43370b89ac1347a7fb)
snowpatch_ozlabs/build-ppc64le success Build succeeded
snowpatch_ozlabs/build-ppc64be success Build succeeded
snowpatch_ozlabs/build-ppc64e success Build succeeded
snowpatch_ozlabs/build-pmac32 success Build succeeded
snowpatch_ozlabs/checkpatch success total: 0 errors, 0 warnings, 0 checks, 11 lines checked

Commit Message

Daniel Axtens May 23, 2019, 1:57 a.m. UTC 
While developing kasan for 64-bit book3s, I hit the following stack
over-read.

It occurs because the hypercall to put characters onto the terminal
takes 2 longs (128 bits/16 bytes) of characters at a time, and so
hvc_put_chars would unconditionally copy 16 bytes from the argument
buffer, regardless of supplied length. However, sometimes
hvc_put_chars is called with less than 16 characters, leading to the
error.

Use memcpy to copy the correct length.

==================================================================
BUG: KASAN: stack-out-of-bounds in hvc_put_chars+0x44/0xc0
Read of size 8 at addr c00000000169fac0 by task swapper/0

CPU: 0 PID: 0 Comm: swapper Not tainted 5.1.0-rc2-00065-g7e26a58cb076 #43
Call Trace:
[c00000000169f770] [c000000000e83900] dump_stack+0xc4/0x114 (unreliable)
[c00000000169f7c0] [c0000000003f3034] print_address_description+0xd0/0x3cc
[c00000000169f850] [c0000000003f2c0c] kasan_report+0x20c/0x224
[c00000000169f920] [c0000000003f4808] __asan_load8+0x198/0x330
[c00000000169f9c0] [c0000000000d7264] hvc_put_chars+0x44/0xc0
[c00000000169fa40] [c00000000089b998] hvterm_raw_put_chars+0x78/0xb0
[c00000000169fa80] [c00000000089bff0] udbg_hvc_putc+0x110/0x1a0
[c00000000169fb30] [c000000000036610] udbg_write+0xa0/0x1a0
[c00000000169fb80] [c0000000001b9cd4] console_unlock+0x694/0x810
[c00000000169fc80] [c0000000001bc5ec] vprintk_emit+0x24c/0x310
[c00000000169fcf0] [c0000000001bde04] vprintk_func+0xd4/0x250
[c00000000169fd40] [c0000000001bd088] printk+0x38/0x4c
[c00000000169fd60] [c0000000012ec4a0] kasan_init+0x330/0x350
[c00000000169fde0] [c0000000012dc304] setup_arch+0x4b4/0x504
[c00000000169fe70] [c0000000012d3e50] start_kernel+0x10c/0x868
[c00000000169ff90] [c00000000000b360] start_here_common+0x1c/0x53c

Memory state around the buggy address:
 c00000000169f980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 c00000000169fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>c00000000169fa80: 00 00 00 00 f1 f1 f1 f1 01 f2 f2 f2 00 00 00 00
                                           ^
 c00000000169fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 c00000000169fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

CC: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Daniel Axtens <dja@axtens.net>
---
 arch/powerpc/platforms/pseries/hvconsole.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
index 74da18de853a..c39907b635eb 100644
--- a/arch/powerpc/platforms/pseries/hvconsole.c
+++ b/arch/powerpc/platforms/pseries/hvconsole.c
@@ -67,9 +67,10 @@  EXPORT_SYMBOL(hvc_get_chars);
  */
 int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
 {
-	unsigned long *lbuf = (unsigned long *) buf;
+	unsigned long lbuf[2];
 	long ret;
 
+	memcpy(lbuf, buf, count);
 
 	/* hcall will ret H_PARAMETER if 'count' exceeds firmware max.*/
 	if (count > MAX_VIO_PUT_CHARS)