lkml.org 
[lkml]   [2018]   [Sep]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: rng_dev_read: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64'
    n

    On 10 September 2018 at 21:53, Theodore Y. Ts'o <tytso@mit.edu> wrote:
    > On Mon, Sep 10, 2018 at 08:08:51PM +0300, Meelis Roos wrote:
    >> This is weekend's 4.19.0-rc2-00246-gd7b686ebf704 on a Thinkad T460s.
    >> There seems to be a usercopy warning from rng_dev read (full dmesg
    >> below).
    >
    > Looking at rng_dev_head(), which is in drivers/char/hw_random.c, it
    > looks like this was probably caused by a problem in the specific
    > hardware random number generator being used. Can you tell us which
    > one was in use?
    >

    The line right before the splat suggests that this is tpm_get_random()
    in drivers/char/tpm/tpm-interface.c

    [...]

    >> [146535.257274] tpm tpm0: A TPM error (379) occurred attempting get random
    >> [146535.257304] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' (offset 0, size 379)!

    The TPM return code '379' is returned from rng_get_data(), and
    interpreted as a byte count rather than an error code.


    >> [146535.257331] ------------[ cut here ]------------
    >> [146535.257338] kernel BUG at mm/usercopy.c:102!
    >> [146535.257361] invalid opcode: 0000 [#1] SMP PTI
    >> [146535.257375] CPU: 0 PID: 1729 Comm: rngd Not tainted 4.19.0-rc2-00246-gd7b686ebf704 #36
    >> [146535.257382] Hardware name: LENOVO 20F9003SMS/20F9003SMS, BIOS N1CET65W (1.33 ) 02/16/2018
    >> [146535.257402] RIP: 0010:usercopy_abort+0x6f/0x71
    >> [146535.257412] Code: 0f 45 c6 48 c7 c2 b4 26 80 a4 48 c7 c6 b5 53 7f a4 51 48 0f 45 f2 48 89 f9 41 52 48 89 c2 48 c7 c7 80 27 80 a4 e8 7e 3a ed ff <0f> 0b 49 89 e8 31 c9 44 89 e2 31 f6 48 c7 c7 e8 26 80 a4 e8 79 ff
    >> [146535.257421] RSP: 0018:ffffbc4ec076bdb0 EFLAGS: 00010246
    >> [146535.257433] RAX: 0000000000000065 RBX: ffff9c2d1464ad80 RCX: 0000000000000006
    >> [146535.257441] RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffff9c2d16a15500
    >> [146535.257449] RBP: 000000000000017b R08: ffffffffa3f11900 R09: 0000000000000065
    >> [146535.257457] R10: ffffffffa50908d8 R11: ffffffffa507efae R12: 0000000000000001
    >> [146535.257463] R13: ffff9c2d1464aefb R14: 000000000000017b R15: 000000000000017b
    >> [146535.257474] FS: 00007f023c524700(0000) GS:ffff9c2d16a00000(0000) knlGS:0000000000000000
    >> [146535.257484] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    >> [146535.257492] CR2: 00001834aa0fc000 CR3: 0000000309104005 CR4: 00000000003606f0
    >> [146535.257499] Call Trace:
    >> [146535.257524] __check_heap_object+0xd5/0x100
    >> [146535.257539] __check_object_size+0xf5/0x17c
    >> [146535.257554] rng_dev_read+0x6e/0x270
    >> [146535.257576] __vfs_read+0x31/0x170
    >> [146535.257604] vfs_read+0x85/0x130
    >> [146535.257631] ksys_read+0x4a/0xb0
    >> [146535.257658] do_syscall_64+0x4a/0xf0
    >> [146535.257695] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    >> [146535.257716] RIP: 0033:0x7f023c6f6394
    >> [146535.257735] Code: 84 00 00 00 00 00 41 54 55 49 89 d4 53 48 89 f5 89 fb 48 83 ec 10 e8 8b fc ff ff 4c 89 e2 41 89 c0 48 89 ee 89 df 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 48 89 44 24 08 e8 c7 fc ff ff 48
    >> [146535.257748] RSP: 002b:00007f023c523e10 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
    >> [146535.257767] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f023c6f6394
    >> [146535.257776] RDX: 00000000000009c4 RSI: 0000563938a24f00 RDI: 0000000000000003
    >> [146535.257790] RBP: 0000563938a24f00 R08: 0000000000000000 R09: 00007fff1df64080
    >> [146535.257803] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000000009c4
    >> [146535.257816] R13: 00007fff1dedba3f R14: 00007fff1dedba40 R15: 0000000000000000
    >> [146535.257836] Modules linked in: ipheth tun ipt_MASQUERADE nf_conntrack_netlink iptable_nat nf_nat_ipv4 xt_addrtype iptable_filter bpfilter xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c br_netfilter bridge stp llc overlay fuse bnep cpufreq_userspace snd_hda_codec_hdmi iwlmvm mac80211 uvcvideo snd_hda_codec_realtek videobuf2_vmalloc cdc_mbim iwlwifi x86_pkg_temp_thermal videobuf2_memops snd_hda_codec_generic intel_powerclamp cdc_wdm videobuf2_v4l2 coretemp videobuf2_common joydev pcspkr cdc_ncm btusb snd_hda_intel iTCO_wdt btrtl iTCO_vendor_support btbcm snd_hda_codec videodev snd_hwdep media usbnet btintel snd_hda_core mii cdc_acm cfg80211 bluetooth ecdh_generic mei_me mei intel_pch_thermal tpm_crb tpm_tis tpm_tis_core thinkpad_acpi tpm pcc_cpufreq ip_tables dm_crypt dm_mod
    >> [146535.258082] dax hid_generic rtsx_pci_sdmmc mmc_core crct10dif_pclmul e1000e i2c_i801 rtsx_pci mfd_core
    >> [146535.258139] ---[ end trace 40fa61fde8e22944 ]---
    >> [146535.258260] RIP: 0010:usercopy_abort+0x6f/0x71
    >> [146535.258290] Code: 0f 45 c6 48 c7 c2 b4 26 80 a4 48 c7 c6 b5 53 7f a4 51 48 0f 45 f2 48 89 f9 41 52 48 89 c2 48 c7 c7 80 27 80 a4 e8 7e 3a ed ff <0f> 0b 49 89 e8 31 c9 44 89 e2 31 f6 48 c7 c7 e8 26 80 a4 e8 79 ff
    >> [146535.258315] RSP: 0018:ffffbc4ec076bdb0 EFLAGS: 00010246
    >> [146535.258367] RAX: 0000000000000065 RBX: ffff9c2d1464ad80 RCX: 0000000000000006
    >> [146535.258391] RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffff9c2d16a15500
    >> [146535.258421] RBP: 000000000000017b R08: ffffffffa3f11900 R09: 0000000000000065
    >> [146535.258450] R10: ffffffffa50908d8 R11: ffffffffa507efae R12: 0000000000000001
    >> [146535.258485] R13: ffff9c2d1464aefb R14: 000000000000017b R15: 000000000000017b
    >> [146535.258520] FS: 00007f023c524700(0000) GS:ffff9c2d16a00000(0000) knlGS:0000000000000000
    >> [146535.258555] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    >> [146535.258593] CR2: 00001834aa0fc000 CR3: 0000000309104005 CR4: 00000000003606f0
    >>
    >> --
    >> Meelis Roos (mroos@linux.ee)

    \
     
     \ /
      Last update: 2018-09-10 22:02    [W:3.155 / U:0.280 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site