A missing bounds check in write_comp_data() can lead to an out-of-bounds read
or write in the adjacent memory area, since the start_index is not validated
before accessing area[] in the function later, potentially hitting:
BUG: unable to handle page fault for address: ffffc90003792fe8
RIP: 0010:write_comp_data+0x7c/0xa0 kernel/kcov.c:263
Call Trace:
__do_sys_rseq kernel/rseq.c:549 [inline]
__se_sys_rseq kernel/rseq.c:547 [inline]
__x64_sys_rseq+0xc2/0x2e0 kernel/rseq.c:547
Fixes: ded97d2c2b2c ("kcov: support comparison operands collection")
Reported-by: syzbot+237f670105a254a230d4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=237f670105a254a230d4
Tested-by: syzbot+237f670105a254a230d4@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
kernel/kcov.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 35420f0ac524..479a84921833 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -236,7 +236,7 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
{
struct task_struct *t;
u64 *area;
- u64 count, start_index, end_pos, max_pos;
+ u64 count, start_index, end_pos, max_pos, tmp;
t = current;
if (!check_kcov_mode(KCOV_MODE_TRACE_CMP, t))
@@ -254,7 +254,9 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
count = READ_ONCE(area[0]);
/* Every record is KCOV_WORDS_PER_CMP 64-bit words. */
- start_index = 1 + count * KCOV_WORDS_PER_CMP;
+ if (check_mul_overflow(count, KCOV_WORDS_PER_CMP, &tmp))
+ return;
+ start_index = 1 + tmp;
end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);
if (likely(end_pos <= max_pos)) {
/* See comment in __sanitizer_cov_trace_pc(). */
--
2.43.0