| Message ID | 20201218040826.57203-1-decui@microsoft.com |
|---|---|
| State | New |
| Headers | show |
| Series | ACPI: scan: Fix a Hyper-V Linux VM panic caused by buffer overflow | expand |
> From: Dexuan Cui <decui@microsoft.com> > Sent: Thursday, December 17, 2020 8:08 PM > > Linux VM on Hyper-V crashes with the latest mainline: > ... > This is because of the recent buffer overflow detection in the > commit 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified > string functions") > > Here acpi_device_bus_id->bus_id can only hold 14 characters, while the > the acpi_device_hid(device) returns a 22-char string > "HYPER_V_GEN_COUNTER_V1". > > Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a > string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8 > chars. > > The field bus_id in struct acpi_device_bus_id was originally defined as > char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the > commit bb0958544f3c ("ACPI: use more understandable bus_id for ACPI > devices") > > It looks like so far an ID string of >=15 chars is only seen in the guest > BIOS/firmware by Hyper-V, and AFAIK the ID string > "HYPER_V_GEN_COUNTER_V1" > is never used by Linux VM on Hyper-V, so let's just truncate the string to > fix the panic. > > Signed-off-by: Dexuan Cui <decui@microsoft.com> IMO this patch should also go to the stable trees, so please add Cc: <stable@vger.kernel.org> Thanks, -- Dexuan
From: Dexuan Cui <decui@microsoft.com> Sent: Thursday, December 17, 2020 8:08 PM > > Linux VM on Hyper-V crashes with the latest mainline: > > [ 4.069624] detected buffer overflow in strcpy > [ 4.077733] kernel BUG at lib/string.c:1149! > .. > [ 4.085819] RIP: 0010:fortify_panic+0xf/0x11 > ... > [ 4.085819] Call Trace: > [ 4.085819] acpi_device_add.cold.15+0xf2/0xfb > [ 4.085819] acpi_add_single_object+0x2a6/0x690 > [ 4.085819] acpi_bus_check_add+0xc6/0x280 > [ 4.085819] acpi_ns_walk_namespace+0xda/0x1aa > [ 4.085819] acpi_walk_namespace+0x9a/0xc2 > [ 4.085819] acpi_bus_scan+0x78/0x90 > [ 4.085819] acpi_scan_init+0xfa/0x248 > [ 4.085819] acpi_init+0x2c1/0x321 > [ 4.085819] do_one_initcall+0x44/0x1d0 > [ 4.085819] kernel_init_freeable+0x1ab/0x1f4 > > This is because of the recent buffer overflow detection in the > commit 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string > functions") > > Here acpi_device_bus_id->bus_id can only hold 14 characters, while the > the acpi_device_hid(device) returns a 22-char string > "HYPER_V_GEN_COUNTER_V1". > > Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a > string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8 > chars. > > The field bus_id in struct acpi_device_bus_id was originally defined as > char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the > commit bb0958544f3c ("ACPI: use more understandable bus_id for ACPI devices") > > It looks like so far an ID string of >=15 chars is only seen in the guest > BIOS/firmware by Hyper-V, and AFAIK the ID string "HYPER_V_GEN_COUNTER_V1" > is never used by Linux VM on Hyper-V, so let's just truncate the string to > fix the panic. > > Signed-off-by: Dexuan Cui <decui@microsoft.com> > --- > drivers/acpi/scan.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c > index a1b226eb2ce2..b801442b6b1b 100644 > --- a/drivers/acpi/scan.c > +++ b/drivers/acpi/scan.c > @@ -674,7 +674,8 @@ int acpi_device_add(struct acpi_device *device, > } > if (!found) { > acpi_device_bus_id = new_bus_id; > - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); > + strlcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device), > + sizeof(acpi_device_bus_id->bus_id)); > acpi_device_bus_id->instance_no = 0; > list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); > } > -- > 2.19.1 Reviewed-by: Michael Kelley <mikelley@microsoft.com>
> From: Michael Kelley <mikelley@microsoft.com> > Sent: Tuesday, December 22, 2020 5:56 AM > From: Dexuan Cui > Sent: Thursday, December 17, 2020 > 8:08 PM > > > > Linux VM on Hyper-V crashes with the latest mainline: > > ... > > --- a/drivers/acpi/scan.c > > +++ b/drivers/acpi/scan.c > > @@ -674,7 +674,8 @@ int acpi_device_add(struct acpi_device *device, > > } > > if (!found) { > > acpi_device_bus_id = new_bus_id; > > - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); > > + strlcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device), > > + sizeof(acpi_device_bus_id->bus_id)); > > acpi_device_bus_id->instance_no = 0; > > list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); > > } > > Reviewed-by: Michael Kelley <mikelley@microsoft.com> Hi, ACPI maintainers, Would you please take a look at the small fix? Currently the mainline Linux kernel, running in a VM on Hyper-V, has been broken for almost 3 weeks, i.e. the VM always panics when it boots. The patch has already had Michael's Reviewed-by. BTW, the patch should have a stable tag: Cc: <stable@vger.kernel.org> Or, do you want the patch to go through the Hyper-V tree? https://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux.git/log/?h=hyperv-fixes The small patch is unlikely to cause a merge conflict, and it only affects Linux VMs on Hyper-V so far. Thanks, -- Dexuan
On 18/12/20 9:38 am, Dexuan Cui wrote: > Linux VM on Hyper-V crashes with the latest mainline: > > [ 4.069624] detected buffer overflow in strcpy > [ 4.077733] kernel BUG at lib/string.c:1149! > .. > [ 4.085819] RIP: 0010:fortify_panic+0xf/0x11 > ... > [ 4.085819] Call Trace: > [ 4.085819] acpi_device_add.cold.15+0xf2/0xfb > [ 4.085819] acpi_add_single_object+0x2a6/0x690 > [ 4.085819] acpi_bus_check_add+0xc6/0x280 > [ 4.085819] acpi_ns_walk_namespace+0xda/0x1aa > [ 4.085819] acpi_walk_namespace+0x9a/0xc2 > [ 4.085819] acpi_bus_scan+0x78/0x90 > [ 4.085819] acpi_scan_init+0xfa/0x248 > [ 4.085819] acpi_init+0x2c1/0x321 > [ 4.085819] do_one_initcall+0x44/0x1d0 > [ 4.085819] kernel_init_freeable+0x1ab/0x1f4 > > This is because of the recent buffer overflow detection in the > commit 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions") > > Here acpi_device_bus_id->bus_id can only hold 14 characters, while the > the acpi_device_hid(device) returns a 22-char string > "HYPER_V_GEN_COUNTER_V1". > > Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a > string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8 > chars. > > The field bus_id in struct acpi_device_bus_id was originally defined as > char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the > commit bb0958544f3c ("ACPI: use more understandable bus_id for ACPI devices") > > It looks like so far an ID string of >=15 chars is only seen in the guest > BIOS/firmware by Hyper-V, and AFAIK the ID string "HYPER_V_GEN_COUNTER_V1" > is never used by Linux VM on Hyper-V, so let's just truncate the string to > fix the panic. > > Signed-off-by: Dexuan Cui <decui@microsoft.com> > --- > drivers/acpi/scan.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c > index a1b226eb2ce2..b801442b6b1b 100644 > --- a/drivers/acpi/scan.c > +++ b/drivers/acpi/scan.c > @@ -674,7 +674,8 @@ int acpi_device_add(struct acpi_device *device, > } > if (!found) { > acpi_device_bus_id = new_bus_id; > - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); > + strlcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device), > + sizeof(acpi_device_bus_id->bus_id)); Please prefer strscpy() over strlcpy(): + strscpy(acpi_device_bus_id->bus_id, acpi_device_hid(device), + sizeof(acpi_device_bus_id->bus_id)); See: https://lore.kernel.org/lkml/CAHk-=wgfRnXz0W3D37d01q3JFkr_i_uTL=V6A6G1oUZcprmknw@mail.gmail.com/ Thanks, Dwaipayan. > acpi_device_bus_id->instance_no = 0; > list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); > }
On Tue, Jan 5, 2021 at 11:02 PM Dexuan Cui <decui@microsoft.com> wrote: > > > From: Michael Kelley <mikelley@microsoft.com> > > Sent: Tuesday, December 22, 2020 5:56 AM > > From: Dexuan Cui > > Sent: Thursday, December 17, 2020 > > 8:08 PM > > > > > > Linux VM on Hyper-V crashes with the latest mainline: > > > ... > > > --- a/drivers/acpi/scan.c > > > +++ b/drivers/acpi/scan.c > > > @@ -674,7 +674,8 @@ int acpi_device_add(struct acpi_device *device, > > > } > > > if (!found) { > > > acpi_device_bus_id = new_bus_id; > > > - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); > > > + strlcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device), > > > + sizeof(acpi_device_bus_id->bus_id)); > > > acpi_device_bus_id->instance_no = 0; > > > list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); > > > } > > > > Reviewed-by: Michael Kelley <mikelley@microsoft.com> > > Hi, ACPI maintainers, > Would you please take a look at the small fix? Currently the mainline Linux > kernel, running in a VM on Hyper-V, has been broken for almost 3 weeks, > i.e. the VM always panics when it boots. The root cause is a VM issue AFAICS, though. > The patch has already had Michael's Reviewed-by. > > BTW, the patch should have a stable tag: > Cc: <stable@vger.kernel.org> > > Or, do you want the patch to go through the Hyper-V tree? > https://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux.git/log/?h=hyperv-fixes > > The small patch is unlikely to cause a merge conflict, and it only affects > Linux VMs on Hyper-V so far. It doesn't look like the right fix to me, though. The problem appears to be that the string coming from _HID is too long (which is a spec violation). The patch truncates it to match the length of the target buffer, but that is not particularly useful. It would be better to use something like kstrdup_const() to initialize acpi_device_bus_id->bus_id IMV.
> From: Rafael J. Wysocki <rafael@kernel.org> > Sent: Thursday, January 7, 2021 5:48 AM > > > > Linux VM on Hyper-V crashes with the latest mainline: > > > > ... > The root cause is a VM issue AFAICS, though. Yes. > It doesn't look like the right fix to me, though. > > The problem appears to be that the string coming from _HID is too long > (which is a spec violation). Yes. We have requested Hyper-V team to fix the buggy BIOS/firmware, but we have to cope with the existing buggy Hyper-V hosts, at least before the Hyper-V fix is deployed to the hosts, and some old versions of the hosts may not get updated. :-( > The patch truncates it to match the > length of the target buffer, but that is not particularly useful. > > It would be better to use something like kstrdup_const() to initialize > acpi_device_bus_id->bus_id IMV. Makes sense. I'll submit v2 shortly. Thanks, -- Dexuan
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c index a1b226eb2ce2..b801442b6b1b 100644 --- a/drivers/acpi/scan.c +++ b/drivers/acpi/scan.c @@ -674,7 +674,8 @@ int acpi_device_add(struct acpi_device *device, } if (!found) { acpi_device_bus_id = new_bus_id; - strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device)); + strlcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device), + sizeof(acpi_device_bus_id->bus_id)); acpi_device_bus_id->instance_no = 0; list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list); }
Linux VM on Hyper-V crashes with the latest mainline: [ 4.069624] detected buffer overflow in strcpy [ 4.077733] kernel BUG at lib/string.c:1149! .. [ 4.085819] RIP: 0010:fortify_panic+0xf/0x11 ... [ 4.085819] Call Trace: [ 4.085819] acpi_device_add.cold.15+0xf2/0xfb [ 4.085819] acpi_add_single_object+0x2a6/0x690 [ 4.085819] acpi_bus_check_add+0xc6/0x280 [ 4.085819] acpi_ns_walk_namespace+0xda/0x1aa [ 4.085819] acpi_walk_namespace+0x9a/0xc2 [ 4.085819] acpi_bus_scan+0x78/0x90 [ 4.085819] acpi_scan_init+0xfa/0x248 [ 4.085819] acpi_init+0x2c1/0x321 [ 4.085819] do_one_initcall+0x44/0x1d0 [ 4.085819] kernel_init_freeable+0x1ab/0x1f4 This is because of the recent buffer overflow detection in the commit 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions") Here acpi_device_bus_id->bus_id can only hold 14 characters, while the the acpi_device_hid(device) returns a 22-char string "HYPER_V_GEN_COUNTER_V1". Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8 chars. The field bus_id in struct acpi_device_bus_id was originally defined as char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the commit bb0958544f3c ("ACPI: use more understandable bus_id for ACPI devices") It looks like so far an ID string of >=15 chars is only seen in the guest BIOS/firmware by Hyper-V, and AFAIK the ID string "HYPER_V_GEN_COUNTER_V1" is never used by Linux VM on Hyper-V, so let's just truncate the string to fix the panic. Signed-off-by: Dexuan Cui <decui@microsoft.com> --- drivers/acpi/scan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)