Bug 206071 - BUG: KASAN: slab-out-of-bounds Write in vgacon_scroll
Summary: BUG: KASAN: slab-out-of-bounds Write in vgacon_scroll
Status: NEW
Alias: None
Product: Drivers
Classification: Unclassified
Component: Console/Framebuffers (show other bugs)
Hardware: x86-64 Linux
: P1 normal
Assignee: James Simmons
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-01-04 10:48 UTC by donkeysnore
Modified: 2020-01-04 10:51 UTC (History)
0 users

See Also:
Kernel Version: Linux 5.5.0-rc4+
Subsystem:
Regression: No
Bisected commit-id:

Attachments
C reproduce syzkaller (11.61 KB, text/plain)
2020-01-04 10:49 UTC, donkeysnore 		Details
Linux config (128.63 KB, text/plain)
2020-01-04 10:51 UTC, donkeysnore 		Details
Add an attachment (proposed patch, testcase, etc.)

Description donkeysnore 2020-01-04 10:48:46 UTC 
==================================================================
BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x6a5/0x890
Write of size 42728 at addr ffff88806c8ba6e8 by task syz-executor.0/13463

CPU: 0 PID: 13463 Comm: syz-executor.0 Not tainted 5.5.0-rc4+ #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
Call Trace:
 dump_stack+0x94/0xce
 print_address_description.constprop.4+0x16/0x320
 __kasan_report+0x177/0x1db
 kasan_report+0xe/0x20
 check_memory_region+0x161/0x1c0
 memcpy+0x34/0x50
 vgacon_scroll+0x6a5/0x890
 con_scroll+0x519/0x5f0
 lf+0x248/0x290
 do_con_trol+0x231/0x58a0
 do_con_write.part.25+0x568/0x1c10
 con_write+0xa7/0xc0
 n_tty_write+0x907/0xdf0
 tty_write+0x3f4/0x910
 do_iter_write+0x3e7/0x560
 vfs_writev+0x164/0x2e0
 do_writev+0xff/0x290
 do_syscall_64+0x9c/0x390
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45a9e9
Code: bd b1 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b b1 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f4520ee3c88 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 000000000072bf00 RCX: 000000000045a9e9
RDX: 0000000000000001 RSI: 0000000020000440 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4520ee46d4
R13: 00000000004afce8 R14: 00000000006f9dd0 R15: 00000000ffffffff

The buggy address belongs to the page:
page:ffffea0001b22c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0
raw: 0100000000010000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88806c8bff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88806c8bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88806c8c0000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
                                        ^
 ffff88806c8c0080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
 ffff88806c8c0100: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Comment 1 donkeysnore 2020-01-04 10:49:44 UTC 
Created attachment 286609 [details]
C reproduce syzkaller
Comment 2 donkeysnore 2020-01-04 10:51:57 UTC 
Created attachment 286611 [details]
Linux config
Note You need to log in before you can comment on or make changes to this bug.