Hi.
On středa 4. dubna 2018 22:21:53 CEST Kees Cook wrote:
...
That means scsi_sense_cache should be 96 bytes in size? But a 22 byte
read starting at offset 94 happened? That seems like a 20 byte read
beyond the end of the SLUB object? Though if it were reading past the
actual end of the object, I'd expect the hardened usercopy BUG (rather
than the WARN) to kick in. Ah, it looks like
/sys/kernel/slab/scsi_sense_cache/slab_size shows this to be 128 bytes
of actual allocation, so the 20 bytes doesn't strictly overlap another
object (hence no BUG):
...
Actually, I can trigger a BUG too:
[ 129.259213] usercopy: Kernel memory exposure attempt detected from
SLUB
object 'scsi_sense_cache' (offset 119, size 22)!
[ 129.265167] ------------[ cut here ]------------
[ 129.267579] kernel BUG at mm/usercopy.c:100!
And also offset can be different, as you may see:
[ 55.993224] Bad or missing usercopy whitelist? Kernel memory exposure
attempt detected from SLUB object 'scsi_sense_cache' (offset 76, size
22)!
[ 55.998678] WARNING: CPU: 0 PID: 1305 at mm/usercopy.c:81
usercopy_warn
+0x7e/0xa0
It looks like only the size stays the same.
Can you send me your .config? What SCSI drivers are you using in the
VM and on the real server?
This is an Arch kernel with a config available here [1].
For both server and VM "lspci -vv" shows "ahci" in use. Is this what you
are
asking for?
Are you able to see what ioctl()s smartctl is issuing? I'll try to
reproduce this on my end...
As per [2], strace shows "SG_IO" requests. Is this detailed enough?
Thanks for looking into it.
Regards,
Oleksandr
[1] https://git.archlinux.org/svntogit/packages.git/plain/trunk/config?
h=packages/linux&id=d7625be23f83416491d202d5cea96e5a871fb216
[2] https://gist.github.com/6f58f8891468aeba1ab2cc9f45668735
