Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-10-21 Thread Paolo Bonzini
Fixed now by commit 59bb47985c1d ("mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)"). Paolo On 11/09/19 22:38, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:    1e3778cb Merge tag 'scsi-fixes' of > git://git.kernel.org/pu.. > git tree:  

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-13 Thread Paolo Bonzini
On 13/09/19 17:32, Robin Murphy wrote: > Oh, that bit of usbdev_mmap() is already known to be pretty much totally > bogus for various reasons - there have been a few threads about it, of > which I think [1] is both the most recent and the most informative. > There was another patch[2], but that

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-13 Thread Paolo Bonzini
On 13/09/19 17:36, Alan Stern wrote: > On Fri, 13 Sep 2019, Paolo Bonzini wrote: > >> On 13/09/19 15:02, Greg Kroah-Hartman wrote: >>> Look at linux-next, we "should" have fixed up hcd_buffer_alloc() now to >>> not need this type of thing. If we got it wrong, please let us know and >>> then yes,

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-13 Thread Alan Stern
On Fri, 13 Sep 2019, Paolo Bonzini wrote: > On 13/09/19 15:02, Greg Kroah-Hartman wrote: > > Look at linux-next, we "should" have fixed up hcd_buffer_alloc() now to > > not need this type of thing. If we got it wrong, please let us know and > > then yes, a fix like this would be most appreciated

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-13 Thread Robin Murphy
On 13/09/2019 16:01, Paolo Bonzini wrote: On 13/09/19 15:02, Greg Kroah-Hartman wrote: Look at linux-next, we "should" have fixed up hcd_buffer_alloc() now to not need this type of thing. If we got it wrong, please let us know and then yes, a fix like this would be most appreciated :) I

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-13 Thread Paolo Bonzini
On 13/09/19 15:02, Greg Kroah-Hartman wrote: > Look at linux-next, we "should" have fixed up hcd_buffer_alloc() now to > not need this type of thing. If we got it wrong, please let us know and > then yes, a fix like this would be most appreciated :) I still see /* some USB hosts just

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-13 Thread Greg Kroah-Hartman
On Fri, Sep 13, 2019 at 09:34:32AM +0200, Paolo Bonzini wrote: > On 13/09/19 06:46, Greg Kroah-Hartman wrote: > > USB drivers expect kmalloc to return DMA-able memory. I don't know > > about specific alignment issues, that should only an issue for the host > > controller being used here, which

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-13 Thread Paolo Bonzini
On 13/09/19 06:46, Greg Kroah-Hartman wrote: > USB drivers expect kmalloc to return DMA-able memory. I don't know > about specific alignment issues, that should only an issue for the host > controller being used here, which you do not say in the above list. I have no idea, this is just the

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-12 Thread Greg Kroah-Hartman
On Thu, Sep 12, 2019 at 06:49:26PM +0200, Paolo Bonzini wrote: > [tl;dr: there could be a /dev/usb bug only affecting KASAN > configurations, jump to the end to skip the analysis and get to the bug > details] > > On 12/09/19 15:54, Vitaly Kuznetsov wrote: > > Hm, the bisection seems bogus but the

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-12 Thread Paolo Bonzini
[tl;dr: there could be a /dev/usb bug only affecting KASAN configurations, jump to the end to skip the analysis and get to the bug details] On 12/09/19 15:54, Vitaly Kuznetsov wrote: > Hm, the bisection seems bogus but the stack points us to the following > piece of code: > > 4776)

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-12 Thread Vitaly Kuznetsov
syzbot writes: > Hello, > > syzbot found the following crash on: > > HEAD commit:1e3778cb Merge tag 'scsi-fixes' of git://git.kernel.org/pu.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=15bdfc5e60 > kernel config:

Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-12 Thread Will Deacon
On Wed, Sep 11, 2019 at 01:38:08PM -0700, syzbot wrote: > syzbot found the following crash on: > > HEAD commit:1e3778cb Merge tag 'scsi-fixes' of git://git.kernel.org/pu.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=15bdfc5e60 > kernel config:

KASAN: slab-out-of-bounds Read in handle_vmptrld

2019-09-11 Thread syzbot
Hello, syzbot found the following crash on: HEAD commit:1e3778cb Merge tag 'scsi-fixes' of git://git.kernel.org/pu.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=15bdfc5e60 kernel config: https://syzkaller.appspot.com/x/.config?x=b89bb446a3faaba4