lkml.org 
[lkml]   [2018]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: usercopy whitelist woe in scsi_sense_cache
    Hi.

    On středa 4. dubna 2018 22:21:53 CEST Kees Cook wrote:
    > ...
    > That means scsi_sense_cache should be 96 bytes in size? But a 22 byte
    > read starting at offset 94 happened? That seems like a 20 byte read
    > beyond the end of the SLUB object? Though if it were reading past the
    > actual end of the object, I'd expect the hardened usercopy BUG (rather
    > than the WARN) to kick in. Ah, it looks like
    > /sys/kernel/slab/scsi_sense_cache/slab_size shows this to be 128 bytes
    > of actual allocation, so the 20 bytes doesn't strictly overlap another
    > object (hence no BUG):
    > ...

    Actually, I can trigger a BUG too:

    [ 129.259213] usercopy: Kernel memory exposure attempt detected from
    SLUB
    object 'scsi_sense_cache' (offset 119, size 22)!
    [ 129.265167] ------------[ cut here ]------------
    [ 129.267579] kernel BUG at mm/usercopy.c:100!

    And also offset can be different, as you may see:

    [ 55.993224] Bad or missing usercopy whitelist? Kernel memory exposure
    attempt detected from SLUB object 'scsi_sense_cache' (offset 76, size
    22)!
    [ 55.998678] WARNING: CPU: 0 PID: 1305 at mm/usercopy.c:81
    usercopy_warn
    +0x7e/0xa0

    It looks like only the size stays the same.

    > Can you send me your .config? What SCSI drivers are you using in the
    > VM and on the real server?

    This is an Arch kernel with a config available here [1].

    For both server and VM "lspci -vv" shows "ahci" in use. Is this what you
    are
    asking for?

    > Are you able to see what ioctl()s smartctl is issuing? I'll try to
    > reproduce this on my end...

    As per [2], strace shows "SG_IO" requests. Is this detailed enough?

    Thanks for looking into it.

    Regards,
    Oleksandr

    [1] https://git.archlinux.org/svntogit/packages.git/plain/trunk/config?
    h=packages/linux&id=d7625be23f83416491d202d5cea96e5a871fb216
    [2] https://gist.github.com/6f58f8891468aeba1ab2cc9f45668735

    \
     
     \ /
      Last update: 2018-04-04 22:49    [W:4.403 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site