| Message ID | 20200712111013.11881-2-penguin-kernel@I-love.SAKURA.ne.jp (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. | expand |
[ Please Cc: fbdev Maintainer (happens to be me :) on fbdev patches, thanks. ] Hi, On 7/12/20 1:10 PM, Tetsuo Handa wrote: > I found that > > const int fd = open("/dev/fb0", O_ACCMODE); > struct fb_var_screeninfo var = { }; > ioctl(fd, FBIOGET_VSCREENINFO, &var); > var.xres = var.yres = 1; > ioctl(fd, FBIOPUT_VSCREENINFO, &var); > > causes general protection fault in bitfill_aligned(), for vc_do_resize() > updates vc->vc_{cols,rows} only when vc_do_resize() will return 0. > > [ 20.102222] BUG: unable to handle page fault for address: ffffb80500d7b000 > [ 20.102225] #PF: supervisor write access in kernel mode > [ 20.102226] #PF: error_code(0x0002) - not-present page > [ 20.102227] PGD 13a48c067 P4D 13a48c067 PUD 13a48d067 PMD 132525067 PTE 0 > [ 20.102230] Oops: 0002 [#1] SMP > [ 20.102232] CPU: 3 PID: 2786 Comm: a.out Not tainted 5.8.0-rc4+ #749 > [ 20.102233] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 > [ 20.102237] RIP: 0010:bitfill_aligned+0x87/0x120 [cfbfillrect] > [ 20.102277] Call Trace: > [ 20.102281] cfb_fillrect+0x159/0x340 [cfbfillrect] > [ 20.102747] vmw_fb_fillrect+0x12/0x30 [vmwgfx] > [ 20.102755] bit_clear_margins+0x92/0xf0 [fb] > [ 20.102760] fbcon_clear_margins+0x4c/0x50 [fb] > [ 20.102763] fbcon_switch+0x321/0x570 [fb] > [ 20.102771] redraw_screen+0xe0/0x250 > [ 20.102775] fbcon_modechanged+0x164/0x1b0 [fb] > [ 20.102779] fbcon_update_vcs+0x15/0x20 [fb] > [ 20.102781] fb_set_var+0x364/0x3c0 [fb] > [ 20.102817] do_fb_ioctl+0x2ff/0x3f0 [fb] > [ 20.103139] fb_ioctl+0x2e/0x40 [fb] > [ 20.103141] ksys_ioctl+0x86/0xc0 > [ 20.103146] __x64_sys_ioctl+0x15/0x20 > [ 20.103148] do_syscall_64+0x54/0xa0 > [ 20.103151] entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > If vc_do_resize() fails (e.g. kzalloc() failure) when var.xres or var.yres > is going to shrink, bit_clear_margins() hits integer underflow bug due to > info->var.xres < (vc->vc_cols * cw) or info->var.yres < (vc->vc_rows * ch). > Unexpectedly large rw or bh will try to overrun the __iomem region and > causes general protection fault. > > This crash is easily reproducible by calling vc_do_resize(vc, 0, 0) > which the reproducer above will do. Since fbcon_modechanged() is doing > > cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); > rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); > cols /= vc->vc_font.width; > rows /= vc->vc_font.height; > vc_resize(vc, cols, rows); > (...snipped...) > update_screen(vc); > > , var.xres < vc->vc_font.width makes cols = 0 and var.yres < vc->vc_font.height > makes rows = 0. But vc_do_resize() does not set vc->vc_cols = vc->vc_rows = 0 > due to > > new_cols = (cols ? cols : vc->vc_cols); > new_rows = (lines ? lines : vc->vc_rows); > > exception. > > Of course, the root problem is that callers of do_vc_resize() are not > handling vc_do_resize() failures, but it might not be easy to handle > them under complicated dependency. Therefore, as a band-aid workaround, > this patch checks integer underflow in "struct fbcon_ops"->clear_margins > call, assuming that vc->vc_cols * vc->vc_font.width and > vc->vc_rows * vc->vc_font.heigh do not cause integer overflow. > > I hope that we can survive even if info->var.{xres,yres} were increased > but vc->vc_{cols,rows} were not increased due to kzalloc() failure, for > the __iomem memory for cfb_fillrect() seems to be allocated upon driver > load. > > By the way, syzbot has several reports which are stalling inside filling > functions. Although reproducer for [1] is not found yet, it has tried > > r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0) > ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x4}) > > which corresponds to > > const int fd = open("/dev/fb0", O_ACCMODE); > struct fb_var_screeninfo var = { }; > var.yres_virtual = 0x500; > var.bits_per_pixel = 4; > ioctl(fd, FBIOPUT_VSCREENINFO, &var); > > and somehow hit unexpectedly long bit_clear_margins() loops. I don't know > why syzbot does not hit general protection fault, but it would depend on > environment because in my VMware environment ioctl(FBIOPUT_VSCREENINFO) > returns -EINVAL if var.xres == var.yres == 0. > > [1] https://syzkaller.appspot.com/bug?id=91ecc3bf32ab1a551c33a39dab7fc0c8cd7b7e16 > > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> How does this patch relate to: https://marc.info/?l=linux-fbdev&m=159415024816722&w=2 ? It seems to address the same issue, I've added George and Dan to Cc:. Best regards, -- Bartlomiej Zolnierkiewicz Samsung R&D Institute Poland Samsung Electronics > --- > drivers/video/fbdev/core/bitblit.c | 4 ++-- > drivers/video/fbdev/core/fbcon_ccw.c | 4 ++-- > drivers/video/fbdev/core/fbcon_cw.c | 4 ++-- > drivers/video/fbdev/core/fbcon_ud.c | 4 ++-- > 4 files changed, 8 insertions(+), 8 deletions(-) > > diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c > index ca935c09a261..35ebeeccde4d 100644 > --- a/drivers/video/fbdev/core/bitblit.c > +++ b/drivers/video/fbdev/core/bitblit.c > @@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, > region.color = color; > region.rop = ROP_COPY; > > - if (rw && !bottom_only) { > + if ((int) rw > 0 && !bottom_only) { > region.dx = info->var.xoffset + rs; > region.dy = 0; > region.width = rw; > @@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, > info->fbops->fb_fillrect(info, ®ion); > } > > - if (bh) { > + if ((int) bh > 0) { > region.dx = info->var.xoffset; > region.dy = info->var.yoffset + bs; > region.width = rs; > diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c > index dfa9a8aa4509..78f3a5621478 100644 > --- a/drivers/video/fbdev/core/fbcon_ccw.c > +++ b/drivers/video/fbdev/core/fbcon_ccw.c > @@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, > region.color = color; > region.rop = ROP_COPY; > > - if (rw && !bottom_only) { > + if ((int) rw > 0 && !bottom_only) { > region.dx = 0; > region.dy = info->var.yoffset; > region.height = rw; > @@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, > info->fbops->fb_fillrect(info, ®ion); > } > > - if (bh) { > + if ((int) bh > 0) { > region.dx = info->var.xoffset + bs; > region.dy = 0; > region.height = info->var.yres_virtual; > diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c > index ce08251bfd38..fd098ff17574 100644 > --- a/drivers/video/fbdev/core/fbcon_cw.c > +++ b/drivers/video/fbdev/core/fbcon_cw.c > @@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, > region.color = color; > region.rop = ROP_COPY; > > - if (rw && !bottom_only) { > + if ((int) rw > 0 && !bottom_only) { > region.dx = 0; > region.dy = info->var.yoffset + rs; > region.height = rw; > @@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, > info->fbops->fb_fillrect(info, ®ion); > } > > - if (bh) { > + if ((int) bh > 0) { > region.dx = info->var.xoffset; > region.dy = info->var.yoffset; > region.height = info->var.yres; > diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c > index 1936afc78fec..e165a3fad29a 100644 > --- a/drivers/video/fbdev/core/fbcon_ud.c > +++ b/drivers/video/fbdev/core/fbcon_ud.c > @@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, > region.color = color; > region.rop = ROP_COPY; > > - if (rw && !bottom_only) { > + if ((int) rw > 0 && !bottom_only) { > region.dy = 0; > region.dx = info->var.xoffset; > region.width = rw; > @@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, > info->fbops->fb_fillrect(info, ®ion); > } > > - if (bh) { > + if ((int) bh > 0) { > region.dy = info->var.yoffset; > region.dx = info->var.xoffset; > region.height = bh; >
On 2020/07/14 16:22, Bartlomiej Zolnierkiewicz wrote: > How does this patch relate to: > > https://marc.info/?l=linux-fbdev&m=159415024816722&w=2 > > ? > > It seems to address the same issue, I've added George and Dan to Cc:. George Kennedy's patch does not help for my case. You can try a.out built from ---------- #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/fb.h> int main(int argc, char *argv[]) { const int fd = open("/dev/fb0", O_ACCMODE); struct fb_var_screeninfo var = { }; ioctl(fd, FBIOGET_VSCREENINFO, &var); var.xres = var.yres = 16; ioctl(fd, FBIOPUT_VSCREENINFO, &var); return 0; } ---------- with a fault injection patch ---------- --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1214,6 +1214,10 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, if (new_screen_size > KMALLOC_MAX_SIZE) return -EINVAL; + if (!strcmp(current->comm, "a.out")) { + printk(KERN_INFO "Forcing memory allocation failure.\n"); + return -ENOMEM; + } newscreen = kzalloc(new_screen_size, GFP_USER); if (!newscreen) return -ENOMEM; ---------- . What my patch workarounds is cases when vc_do_resize() did not update vc->vc_{cols,rows} . Unless vc->vc_{cols,rows} are updated by vc_do_resize() in a way that avoids integer underflow at unsigned int rw = info->var.xres - (vc->vc_cols*cw); unsigned int bh = info->var.yres - (vc->vc_rows*ch); , this crash won't go away. [ 39.995757][ T2788] Forcing memory allocation failure. [ 39.996527][ T2788] BUG: unable to handle page fault for address: ffffa9d180d7b000 [ 39.996529][ T2788] #PF: supervisor write access in kernel mode [ 39.996530][ T2788] #PF: error_code(0x0002) - not-present page [ 39.996531][ T2788] PGD 13a48c067 P4D 13a48c067 PUD 13a48d067 PMD 1324e4067 PTE 0 [ 39.996547][ T2788] Oops: 0002 [#1] SMP [ 39.996550][ T2788] CPU: 2 PID: 2788 Comm: a.out Not tainted 5.8.0-rc5+ #757 [ 39.996551][ T2788] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 [ 39.996555][ T2788] RIP: 0010:bitfill_aligned+0x87/0x120 [cfbfillrect]
On 2020/07/14 19:27, Tetsuo Handa wrote: > On 2020/07/14 16:22, Bartlomiej Zolnierkiewicz wrote: >> How does this patch relate to: >> >> https://marc.info/?l=linux-fbdev&m=159415024816722&w=2 >> >> ? >> >> It seems to address the same issue, I've added George and Dan to Cc:. > > George Kennedy's patch does not help for my case. > OK. You can add Reported-and-tested-by: syzbot <syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com> to my patch. By the way, if /* bitfill_aligned() assumes that it's at least 8x8 */ is true, don't we need to also check that the rect to fill is at least 8x8 in bit_clear_margins() ? (Well, I feel did it mean multiple of 8x8 ? Then, what is bitfill_unaligned() for ?)
Hello Tetsuo,
Can you try the a.out built from the original Syzkaller modified repro C
program? It walks 0-7 through xres and yres of the fb_var_screeninfo struct.
// https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <linux/fb.h>
int verbose = 0;
void
dumpit(unsigned char *buf, int count, int addr)
{
int i, j;
char bp[256];
memset(bp, 0, 256);
for (i = j = 0; i < count; i++, j++) {
if (j == 16) {
j = 0;
printf("%s\n", bp);
memset(bp, 0, 256);
}
if (j == 0) {
sprintf(&bp[strlen(bp)], "%x: ", addr + i);
}
sprintf(&bp[strlen(bp)], "%02x ", buf[i]);
}
if (j != 0) {
printf("%s\n", bp);
}
}
uint64_t r[1] = {0xffffffffffffffff};
int main(int argc, char **argv)
{
syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0);
intptr_t res = 0;
uint32_t activate = FB_ACTIVATE_NOW;
struct fb_var_screeninfo *varp = (struct fb_var_screeninfo *)0x200001c0;
struct fb_var_screeninfo *starting_varp = malloc(sizeof(struct fb_var_screeninfo *));
char *vp = (char *)varp;
int i, sum, rtn, c;
extern char *optarg;
int limit = 0, passes = 0;
unsigned int start_address = 0;
unsigned int pattern = 0;
int breakit = 1;
while ((c = getopt (argc, argv, "a:v")) != -1)
switch (c)
{
case 'a':
activate = strtol(optarg, 0, 0);
break;
case 'v':
verbose++;
break;
default:
fprintf(stderr, "\nusage: %s [-a <activate code>] [-v]\n\n", argv[0]);
return -1;
}
int fd = open("/dev/fb0", O_RDWR);
if (fd < 0) {
perror("open");
return 0;
}
printf("fd: %d\n", fd);
r[0] = fd;
rtn = syscall(__NR_ioctl, r[0], 0x4600ul, 0x200001c0ul);
if (rtn < 0) {
perror("ioctl");
fprintf(stderr, "rtn=%d, errno=%d\n", rtn, errno);
}
if (verbose) {
printf("FBIOGET_VSCREENINFO:\n");
dumpit((unsigned char *)vp, sizeof(struct fb_var_screeninfo), 0x200001c0);
}
memcpy(starting_varp, varp, sizeof(struct fb_var_screeninfo));
fprintf(stderr, "activate = %d\n", activate);
varp->activate = activate;
if (verbose) {
printf("Pre FBIOPUT_VSCREENINFO:\n");
dumpit((unsigned char *)vp, sizeof(struct fb_var_screeninfo), 0x200001c0);
sleep(2);
}
rtn = syscall(__NR_ioctl, r[0], 0x4601ul, 0x200001c0ul);
if (rtn < 0) {
perror("ioctl");
fprintf(stderr, "rtn=%d, errno=%d\n", rtn, errno);
}
limit = 2;
for (pattern = 0 ; pattern < 8 ; pattern++) {
unsigned long addr = 0x200001c0;
passes = 0;
printf("\nWalk START addr = 0x%x, Break pattern=%x\n", addr, pattern);
while (addr <= 0x2000025c) {
fprintf(stderr, "======================== %d: addr=%x ========================\n", passes, addr);
memcpy(varp, starting_varp, sizeof(struct fb_var_screeninfo));
*(uint32_t*)addr = pattern;
varp->activate = activate;
printf("Pre FBIOPUT_VSCREENINFO: pattern=%x\n", pattern);
dumpit((unsigned char *)vp, sizeof(struct fb_var_screeninfo), 0x200001c0);
sleep(3);
rtn = syscall(__NR_ioctl, r[0], 0x4601ul, 0x200001c0ul);
if (rtn < 0) {
perror("ioctl");
fprintf(stderr, "rtn=%d, errno=%d\n", rtn, errno);
}
addr += 4;
passes++;
if (passes == limit)
break;
}
}
close(fd);
return 0;
}
With my patch it gets output like the following:
[root@localhost ~]# ./fb_break
fd: 3
activate = 0
Walk START addr = 0x200001c0, Break pattern=0
======================== 0: addr=200001c0 ========================
Pre FBIOPUT_VSCREENINFO: pattern=0
200001c0: 00 00 00 00 00 03 00 00 00 04 00 00 00 03 00 00
200001d0: 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00
200001e0: 10 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00
200001f0: 08 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00
20000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000210: 00 00 00 00 00 00 00 00 2c 01 00 00 90 01 00 00
20000220: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ioctl: Invalid argument
rtn=-1, errno=22
======================== 1: addr=200001c4 ========================
Pre FBIOPUT_VSCREENINFO: pattern=0
200001c0: 00 04 00 00 00 00 00 00 00 04 00 00 00 03 00 00
200001d0: 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00
200001e0: 10 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00
200001f0: 08 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00
20000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000210: 00 00 00 00 00 00 00 00 2c 01 00 00 90 01 00 00
20000220: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ioctl: Invalid argument
rtn=-1, errno=22
Walk START addr = 0x200001c0, Break pattern=1
======================== 0: addr=200001c0 ========================
Pre FBIOPUT_VSCREENINFO: pattern=1
200001c0: 01 00 00 00 00 03 00 00 00 04 00 00 00 03 00 00
200001d0: 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00
200001e0: 10 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00
200001f0: 08 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00
20000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000210: 00 00 00 00 00 00 00 00 2c 01 00 00 90 01 00 00
20000220: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ioctl: Invalid argument
rtn=-1, errno=22
...
======================== 1: addr=200001c4 ========================
Pre FBIOPUT_VSCREENINFO: pattern=7
200001c0: 00 04 00 00 07 00 00 00 00 04 00 00 00 03 00 00
200001d0: 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00
200001e0: 10 00 00 00 08 00 00 00 00 00 00 00 08 00 00 00
200001f0: 08 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00
20000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000210: 00 00 00 00 00 00 00 00 2c 01 00 00 90 01 00 00
20000220: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
20000250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ioctl: Invalid argument
rtn=-1, errno=22
[root@localhost ~]#
Thank you,
George
On 7/14/2020 6:27 AM, Tetsuo Handa wrote:
> On 2020/07/14 16:22, Bartlomiej Zolnierkiewicz wrote:
>> How does this patch relate to:
>>
>> https://marc.info/?l=linux-fbdev&m=159415024816722&w=2
>>
>> ?
>>
>> It seems to address the same issue, I've added George and Dan to Cc:.
> George Kennedy's patch does not help for my case.
>
> You can try a.out built from
>
> ----------
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> #include <sys/ioctl.h>
> #include <linux/fb.h>
>
> int main(int argc, char *argv[])
> {
> const int fd = open("/dev/fb0", O_ACCMODE);
> struct fb_var_screeninfo var = { };
> ioctl(fd, FBIOGET_VSCREENINFO, &var);
> var.xres = var.yres = 16;
> ioctl(fd, FBIOPUT_VSCREENINFO, &var);
> return 0;
> }
> ----------
>
> with a fault injection patch
>
> ----------
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -1214,6 +1214,10 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
>
> if (new_screen_size > KMALLOC_MAX_SIZE)
> return -EINVAL;
> + if (!strcmp(current->comm, "a.out")) {
> + printk(KERN_INFO "Forcing memory allocation failure.\n");
> + return -ENOMEM;
> + }
> newscreen = kzalloc(new_screen_size, GFP_USER);
> if (!newscreen)
> return -ENOMEM;
> ----------
>
> . What my patch workarounds is cases when vc_do_resize() did not update vc->vc_{cols,rows} .
> Unless vc->vc_{cols,rows} are updated by vc_do_resize() in a way that avoids integer underflow at
>
> unsigned int rw = info->var.xres - (vc->vc_cols*cw);
> unsigned int bh = info->var.yres - (vc->vc_rows*ch);
>
> , this crash won't go away.
>
> [ 39.995757][ T2788] Forcing memory allocation failure.
> [ 39.996527][ T2788] BUG: unable to handle page fault for address: ffffa9d180d7b000
> [ 39.996529][ T2788] #PF: supervisor write access in kernel mode
> [ 39.996530][ T2788] #PF: error_code(0x0002) - not-present page
> [ 39.996531][ T2788] PGD 13a48c067 P4D 13a48c067 PUD 13a48d067 PMD 1324e4067 PTE 0
> [ 39.996547][ T2788] Oops: 0002 [#1] SMP
> [ 39.996550][ T2788] CPU: 2 PID: 2788 Comm: a.out Not tainted 5.8.0-rc5+ #757
> [ 39.996551][ T2788] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020
> [ 39.996555][ T2788] RIP: 0010:bitfill_aligned+0x87/0x120 [cfbfillrect]
On 2020/07/15 2:15, George Kennedy wrote: > Can you try the a.out built from the original Syzkaller modified repro C program? It walks 0-7 through xres and yres of the fb_var_screeninfo struct. I'm not familiar with exploit code. What do you want to explain via this program? > struct fb_var_screeninfo *varp = (struct fb_var_screeninfo *)0x200001c0; > struct fb_var_screeninfo *starting_varp = malloc(sizeof(struct fb_var_screeninfo *)); > memcpy(starting_varp, varp, sizeof(struct fb_var_screeninfo)); > memcpy(varp, starting_varp, sizeof(struct fb_var_screeninfo)); At least, I suspect there is a memory corruption bug in this program because of malloc()ing only sizeof(struct fb_var_screeninfo *) bytes.
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c index ca935c09a261..35ebeeccde4d 100644 --- a/drivers/video/fbdev/core/bitblit.c +++ b/drivers/video/fbdev/core/bitblit.c @@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = color; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dx = info->var.xoffset + rs; region.dy = 0; region.width = rw; @@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dx = info->var.xoffset; region.dy = info->var.yoffset + bs; region.width = rs; diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c index dfa9a8aa4509..78f3a5621478 100644 --- a/drivers/video/fbdev/core/fbcon_ccw.c +++ b/drivers/video/fbdev/core/fbcon_ccw.c @@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = color; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dx = 0; region.dy = info->var.yoffset; region.height = rw; @@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dx = info->var.xoffset + bs; region.dy = 0; region.height = info->var.yres_virtual; diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c index ce08251bfd38..fd098ff17574 100644 --- a/drivers/video/fbdev/core/fbcon_cw.c +++ b/drivers/video/fbdev/core/fbcon_cw.c @@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = color; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dx = 0; region.dy = info->var.yoffset + rs; region.height = rw; @@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dx = info->var.xoffset; region.dy = info->var.yoffset; region.height = info->var.yres; diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c index 1936afc78fec..e165a3fad29a 100644 --- a/drivers/video/fbdev/core/fbcon_ud.c +++ b/drivers/video/fbdev/core/fbcon_ud.c @@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = color; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dy = 0; region.dx = info->var.xoffset; region.width = rw; @@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dy = info->var.yoffset; region.dx = info->var.xoffset; region.height = bh;
I found that const int fd = open("/dev/fb0", O_ACCMODE); struct fb_var_screeninfo var = { }; ioctl(fd, FBIOGET_VSCREENINFO, &var); var.xres = var.yres = 1; ioctl(fd, FBIOPUT_VSCREENINFO, &var); causes general protection fault in bitfill_aligned(), for vc_do_resize() updates vc->vc_{cols,rows} only when vc_do_resize() will return 0. [ 20.102222] BUG: unable to handle page fault for address: ffffb80500d7b000 [ 20.102225] #PF: supervisor write access in kernel mode [ 20.102226] #PF: error_code(0x0002) - not-present page [ 20.102227] PGD 13a48c067 P4D 13a48c067 PUD 13a48d067 PMD 132525067 PTE 0 [ 20.102230] Oops: 0002 [#1] SMP [ 20.102232] CPU: 3 PID: 2786 Comm: a.out Not tainted 5.8.0-rc4+ #749 [ 20.102233] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 02/27/2020 [ 20.102237] RIP: 0010:bitfill_aligned+0x87/0x120 [cfbfillrect] [ 20.102277] Call Trace: [ 20.102281] cfb_fillrect+0x159/0x340 [cfbfillrect] [ 20.102747] vmw_fb_fillrect+0x12/0x30 [vmwgfx] [ 20.102755] bit_clear_margins+0x92/0xf0 [fb] [ 20.102760] fbcon_clear_margins+0x4c/0x50 [fb] [ 20.102763] fbcon_switch+0x321/0x570 [fb] [ 20.102771] redraw_screen+0xe0/0x250 [ 20.102775] fbcon_modechanged+0x164/0x1b0 [fb] [ 20.102779] fbcon_update_vcs+0x15/0x20 [fb] [ 20.102781] fb_set_var+0x364/0x3c0 [fb] [ 20.102817] do_fb_ioctl+0x2ff/0x3f0 [fb] [ 20.103139] fb_ioctl+0x2e/0x40 [fb] [ 20.103141] ksys_ioctl+0x86/0xc0 [ 20.103146] __x64_sys_ioctl+0x15/0x20 [ 20.103148] do_syscall_64+0x54/0xa0 [ 20.103151] entry_SYSCALL_64_after_hwframe+0x44/0xa9 If vc_do_resize() fails (e.g. kzalloc() failure) when var.xres or var.yres is going to shrink, bit_clear_margins() hits integer underflow bug due to info->var.xres < (vc->vc_cols * cw) or info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will try to overrun the __iomem region and causes general protection fault. This crash is easily reproducible by calling vc_do_resize(vc, 0, 0) which the reproducer above will do. Since fbcon_modechanged() is doing cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; vc_resize(vc, cols, rows); (...snipped...) update_screen(vc); , var.xres < vc->vc_font.width makes cols = 0 and var.yres < vc->vc_font.height makes rows = 0. But vc_do_resize() does not set vc->vc_cols = vc->vc_rows = 0 due to new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows); exception. Of course, the root problem is that callers of do_vc_resize() are not handling vc_do_resize() failures, but it might not be easy to handle them under complicated dependency. Therefore, as a band-aid workaround, this patch checks integer underflow in "struct fbcon_ops"->clear_margins call, assuming that vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not cause integer overflow. I hope that we can survive even if info->var.{xres,yres} were increased but vc->vc_{cols,rows} were not increased due to kzalloc() failure, for the __iomem memory for cfb_fillrect() seems to be allocated upon driver load. By the way, syzbot has several reports which are stalling inside filling functions. Although reproducer for [1] is not found yet, it has tried r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fb0\x00', 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x4}) which corresponds to const int fd = open("/dev/fb0", O_ACCMODE); struct fb_var_screeninfo var = { }; var.yres_virtual = 0x500; var.bits_per_pixel = 4; ioctl(fd, FBIOPUT_VSCREENINFO, &var); and somehow hit unexpectedly long bit_clear_margins() loops. I don't know why syzbot does not hit general protection fault, but it would depend on environment because in my VMware environment ioctl(FBIOPUT_VSCREENINFO) returns -EINVAL if var.xres == var.yres == 0. [1] https://syzkaller.appspot.com/bug?id=91ecc3bf32ab1a551c33a39dab7fc0c8cd7b7e16 Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> --- drivers/video/fbdev/core/bitblit.c | 4 ++-- drivers/video/fbdev/core/fbcon_ccw.c | 4 ++-- drivers/video/fbdev/core/fbcon_cw.c | 4 ++-- drivers/video/fbdev/core/fbcon_ud.c | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-)