Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Sender: Larry Finger <larry.finger@gmail.com>
Message-ID: <d29c7e51-deff-c82f-81d4-8322b0c28d22@lwfinger.net>
Date:   Wed, 19 Jul 2023 16:24:52 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: Crash in VirtualBox virtual machines running kernel 6.5
Content-Language: en-US
To:     Kees Cook <keescook@chromium.org>
Cc:     Hans de Goede <hdegoede@redhat.com>,
        Azeem Shaikh <azeemshaikh38@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>,
        linux-hardening@vger.kernel.org,
        "Gustavo A. R. Silva" <gustavoars@kernel.org>
References: <ab3a70e9-60ed-0f13-e3d4-8866eaccc8c1@lwfinger.net>
 <202307190823.086EFD42D9@keescook> <202307190835.752D710D@keescook>
From:   Larry Finger <Larry.Finger@lwfinger.net>
In-Reply-To: <202307190835.752D710D@keescook>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 7/19/23 10:36, Kees Cook wrote:
> Okay, please try:
> 
> diff --git a/fs/vboxsf/shfl_hostintf.h b/fs/vboxsf/shfl_hostintf.h
> index aca829062c12..902fe3224453 100644
> --- a/fs/vboxsf/shfl_hostintf.h
> +++ b/fs/vboxsf/shfl_hostintf.h
> @@ -68,12 +68,11 @@ struct shfl_string {
>   
>   	/** UTF-8 or UTF-16 string. Nul terminated. */
>   	union {
> -		u8 utf8[2];
> -		u16 utf16[1];
> -		u16 ucs2[1]; /* misnomer, use utf16. */
> +		DECLARE_FLEX_ARRAY(u8, utf8);
> +		DECLARE_FLEX_ARRAY(u16, utf16);
>   	} string;
>   };
> -VMMDEV_ASSERT_SIZE(shfl_string, 6);
> +VMMDEV_ASSERT_SIZE(shfl_string, 4);
>   
>   /* The size of shfl_string w/o the string part. */
>   #define SHFLSTRING_HEADER_SIZE  4
> 
> 
> The size assert doesn't seem to be used anywhere else, but I can do a
> more careful binary analysis later today...''

Kees,

The testing was harder than I expected. My standard kernel would not load the 
system disk on the VM, thus I had to build one using my distros configuration. 
It is really painful to wait for all those drivers to build, but I figured that 
might be faster than trying to find the incorrect parameter.

I can finally report that vboxsf no longer generated a BUG. It is getting 
farther, but I am not done yet. It now generates a line that says "Unknown 
parameter tag" and then hangs. I have not tracked that down yet.

I was not aware of the DECLARE_FLEX_ARRAY() macro. I had considered removing the 
union and creating a simple string[] declaration, but I do not mess with file 
systems, and decided to let the experts handle it.

I will let you know what I find about that unknown parameter. It probably is 
coming from VirtualBox.

Thanks,

Larry