Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 19 Jul 2023 15:37:02 -0700
From:   Kees Cook <kees@kernel.org>
To:     Larry Finger <Larry.Finger@lwfinger.net>,
        Kees Cook <keescook@chromium.org>
CC:     Hans de Goede <hdegoede@redhat.com>,
        Azeem Shaikh <azeemshaikh38@gmail.com>,
        LKML <linux-kernel@vger.kernel.org>,
        linux-hardening@vger.kernel.org,
        "Gustavo A. R. Silva" <gustavoars@kernel.org>
Subject: Re: Crash in VirtualBox virtual machines running kernel 6.5
User-Agent: K-9 Mail for Android
In-Reply-To: <d29c7e51-deff-c82f-81d4-8322b0c28d22@lwfinger.net>
References: <ab3a70e9-60ed-0f13-e3d4-8866eaccc8c1@lwfinger.net> <202307190823.086EFD42D9@keescook> <202307190835.752D710D@keescook> <d29c7e51-deff-c82f-81d4-8322b0c28d22@lwfinger.net>
Message-ID: <DC28E9B9-0F7A-4CA5-9FA9-6A4AB5DCD9D5@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On July 19, 2023 2:24:52 PM PDT, Larry Finger <Larry=2EFinger@lwfinger=2Ene=
t> wrote:
>On 7/19/23 10:36, Kees Cook wrote:
>> Okay, please try:
>>=20
>> diff --git a/fs/vboxsf/shfl_hostintf=2Eh b/fs/vboxsf/shfl_hostintf=2Eh
>> index aca829062c12=2E=2E902fe3224453 100644
>> --- a/fs/vboxsf/shfl_hostintf=2Eh
>> +++ b/fs/vboxsf/shfl_hostintf=2Eh
>> @@ -68,12 +68,11 @@ struct shfl_string {
>>     	/** UTF-8 or UTF-16 string=2E Nul terminated=2E */
>>   	union {
>> -		u8 utf8[2];
>> -		u16 utf16[1];
>> -		u16 ucs2[1]; /* misnomer, use utf16=2E */
>> +		DECLARE_FLEX_ARRAY(u8, utf8);
>> +		DECLARE_FLEX_ARRAY(u16, utf16);
>>   	} string;
>>   };
>> -VMMDEV_ASSERT_SIZE(shfl_string, 6);
>> +VMMDEV_ASSERT_SIZE(shfl_string, 4);
>>     /* The size of shfl_string w/o the string part=2E */
>>   #define SHFLSTRING_HEADER_SIZE  4
>>=20
>>=20
>> The size assert doesn't seem to be used anywhere else, but I can do a
>> more careful binary analysis later today=2E=2E=2E''
>
>Kees,
>
>The testing was harder than I expected=2E My standard kernel would not lo=
ad the system disk on the VM, thus I had to build one using my distros conf=
iguration=2E It is really painful to wait for all those drivers to build, b=
ut I figured that might be faster than trying to find the incorrect paramet=
er=2E
>
>I can finally report that vboxsf no longer generated a BUG=2E It is getti=
ng farther, but I am not done yet=2E It now generates a line that says "Unk=
nown parameter tag" and then hangs=2E I have not tracked that down yet=2E
>
>I was not aware of the DECLARE_FLEX_ARRAY() macro=2E I had considered rem=
oving the union and creating a simple string[] declaration, but I do not me=
ss with file systems, and decided to let the experts handle it=2E
>
>I will let you know what I find about that unknown parameter=2E It probab=
ly is coming from VirtualBox=2E

It's possible the size really needs to stay 6 bytes=2E In that case, try a=
dding a "u8 legacy_padding[2]" to the union and restore the VMMDEV_ASSERT_S=
IZE?


--=20
Kees Cook