Received: by 2002:a05:6358:7058:b0:131:369:b2a3 with SMTP id 24csp9690524rwp; Thu, 20 Jul 2023 08:23:37 -0700 (PDT) X-Google-Smtp-Source: APBJJlGnjY2QVO+KyMqGs4L6NBIE/NKvbgN9oOBDSGLk12SDuy1aKbSZ0mXqCR5jXBJiW56Y0xxF X-Received: by 2002:a05:6a20:54a1:b0:126:5459:25d9 with SMTP id i33-20020a056a2054a100b00126545925d9mr8190395pzk.29.1689866616791; Thu, 20 Jul 2023 08:23:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1689866616; cv=none; d=google.com; s=arc-20160816; b=G04EyrYUzc5+8waQ0o9oB+hZQdG+CpX+AB3hd7kOFYFA9tjEbKCY7S9I1qG5j+H/Mj J3OiZVXVcncn+fI/tghiZBGOzTIxVrafxAZQrfhQ3oHM5KJ/UnqbLl9EUc2vQ2sJqkEH eZmc8pjwfOg/SM4jDePQYJaW3EvFz6F9GecOHpzaAK5En+tgAjO4+tzIr+5cEtEVg4gT LdHJNUEXNpS9ksNsXYs1eqYOMREOQ9Z7tIiM/UYs9qWY5N3KVp45P3CmkLg4QEPnT/eQ h+5sJS/iUYMk78CA/pvX81hg88aB/IAQ5IIcJv/rLGPiawaRbD2597z4+RvUyWHdkfmj 8I8A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:in-reply-to:from :references:cc:to:content-language:subject:user-agent:mime-version :date:message-id:sender:dkim-signature; bh=UhWP+ZeZ3WNU0D0D0pZXS3JRxCCkvCqQIqNPCWlWf2w=; fh=JBLCh9Ix0ZjKDmrZ9K8XNiJ0mWiaGucwP7G8Z6lmFig=; b=tQjX7Zqa2ZfDmI5X4YAd0AAcuLd5HgWax481/xuQFTeL4Mp/7HtQEVgo8HaW2XvIty WDd43i4jRIKiG/VSgdSsK4NIVNhn+x9ljtFJL8JCIHX7ReRm3ITApFVw1c4+Xmpynkqi TgBKwbuh5eu/InJhY7DfxnLPK7zaFraNsMmHczuIQQKv0/WE1U4wIf0UHMyapAU3YynE b2hhLiNOOvx+RtYKA3UyGA/VoIlAxRF+8KBlHtdj8hsEPNigQFWVk25BLoyN+n+m0snw l4G+ok7h/Kb7IsDTeppE+4VL3zGZPzjilpeaB+REJPjQ14LCuVp4Up28XN0kDkOKu8N/ ybMw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=H1m2U0JQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 9-20020a630209000000b00553b006cd9fsi1028542pgc.728.2023.07.20.08.23.23; Thu, 20 Jul 2023 08:23:36 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=H1m2U0JQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229821AbjGTOv1 (ORCPT + 99 others); Thu, 20 Jul 2023 10:51:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229933AbjGTOvY (ORCPT ); Thu, 20 Jul 2023 10:51:24 -0400 Received: from mail-ot1-x32c.google.com (mail-ot1-x32c.google.com [IPv6:2607:f8b0:4864:20::32c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 96E7826BB; Thu, 20 Jul 2023 07:51:21 -0700 (PDT) Received: by mail-ot1-x32c.google.com with SMTP id 46e09a7af769-6b867acbf6dso1211217a34.0; Thu, 20 Jul 2023 07:51:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1689864680; x=1690469480; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :sender:from:to:cc:subject:date:message-id:reply-to; bh=UhWP+ZeZ3WNU0D0D0pZXS3JRxCCkvCqQIqNPCWlWf2w=; b=H1m2U0JQGCymlTl2yk/Iv8QpPFjyeOzAmgIKNKBNGdcqPGqZg1ncSc8yMkB1mTlWOM 9MW7wXECdI3wFeIlTxsO9S1M4TKGls6iOImTKuq0qG7SG42sHxWjag9BHYg/My2EtlZF zguCQPrZQxPzU7DpTv2Zs+okeBB34iwpznElaCophc5BNunmlDXTAti60vMTkBWg47ob 6DcAbxUrnsUPZ0Lv2QemHtlVsS7Q3EelBzdFUCvfqJHvpvtM8p/rfLo2oi/we5+S78Yj XjFR7BcHdrJeZKBlo2ILlFM4m32aBDgtCmITgytJfUtlwN2cb7pwfJzQ3Ctosl+/q8s2 ycZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689864680; x=1690469480; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :sender:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=UhWP+ZeZ3WNU0D0D0pZXS3JRxCCkvCqQIqNPCWlWf2w=; b=UKGRzbY69FaCvE4zabsgeIIJOg0Gs2gdg/Nv+9sxzqxUlhBgOxa3KH2ncKfSsx4kFM zmZI7NJ+V8sr5us2cMrJrampjem2TMMuDVJ6m7nkTxv9XveCCuR+w0WN4GkHj55GtbaH uN8uz2FjkvzegUnLETD823RP0gcBESkoFM1wE2u9pBvQRDT0Q8/dOd28NR/AlLZa2glM bnVskgDc/UUv7KO5YabSq7zvuQk6wlfTqLg9yuqtAP2+EtWDEbsY+om6GMgh7U7nUObw QEFdS73yayjH5xN0QljigiH56+I6IJkjPPtslnIFMgvN3og3tO1+9U0LXUCfjfmZ5Gdm Rqig== X-Gm-Message-State: ABy/qLaBso0DoeEfvqJG3/aqTiWwnDDRhCdGGlu3f6KWgHxZ6Qe5ukPS i5tN7dlXjxWb9fkX/TVq1IQ= X-Received: by 2002:a9d:68da:0:b0:6b7:564d:f368 with SMTP id i26-20020a9d68da000000b006b7564df368mr2342631oto.5.1689864680517; Thu, 20 Jul 2023 07:51:20 -0700 (PDT) Received: from [192.168.1.119] ([216.130.59.33]) by smtp.gmail.com with ESMTPSA id s4-20020a056830148400b006b92509e76esm499039otq.32.2023.07.20.07.51.19 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 20 Jul 2023 07:51:20 -0700 (PDT) Sender: Larry Finger Message-ID: Date: Thu, 20 Jul 2023 09:51:19 -0500 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 Subject: Re: Crash in VirtualBox virtual machines running kernel 6.5 Content-Language: en-US To: Kees Cook , Kees Cook Cc: Hans de Goede , Azeem Shaikh , LKML , linux-hardening@vger.kernel.org, "Gustavo A. R. Silva" References: <202307190823.086EFD42D9@keescook> <202307190835.752D710D@keescook> From: Larry Finger In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-1.6 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,NICE_REPLY_A,RCVD_IN_DNSWL_BLOCKED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 7/19/23 17:37, Kees Cook wrote: > On July 19, 2023 2:24:52 PM PDT, Larry Finger wrote: >> On 7/19/23 10:36, Kees Cook wrote: >>> Okay, please try: >>> >>> diff --git a/fs/vboxsf/shfl_hostintf.h b/fs/vboxsf/shfl_hostintf.h >>> index aca829062c12..902fe3224453 100644 >>> --- a/fs/vboxsf/shfl_hostintf.h >>> +++ b/fs/vboxsf/shfl_hostintf.h >>> @@ -68,12 +68,11 @@ struct shfl_string { >>> /** UTF-8 or UTF-16 string. Nul terminated. */ >>> union { >>> - u8 utf8[2]; >>> - u16 utf16[1]; >>> - u16 ucs2[1]; /* misnomer, use utf16. */ >>> + DECLARE_FLEX_ARRAY(u8, utf8); >>> + DECLARE_FLEX_ARRAY(u16, utf16); >>> } string; >>> }; >>> -VMMDEV_ASSERT_SIZE(shfl_string, 6); >>> +VMMDEV_ASSERT_SIZE(shfl_string, 4); >>> /* The size of shfl_string w/o the string part. */ >>> #define SHFLSTRING_HEADER_SIZE 4 >>> >>> >>> The size assert doesn't seem to be used anywhere else, but I can do a >>> more careful binary analysis later today...'' >> >> Kees, >> >> The testing was harder than I expected. My standard kernel would not load the system disk on the VM, thus I had to build one using my distros configuration. It is really painful to wait for all those drivers to build, but I figured that might be faster than trying to find the incorrect parameter. >> >> I can finally report that vboxsf no longer generated a BUG. It is getting farther, but I am not done yet. It now generates a line that says "Unknown parameter tag" and then hangs. I have not tracked that down yet. >> >> I was not aware of the DECLARE_FLEX_ARRAY() macro. I had considered removing the union and creating a simple string[] declaration, but I do not mess with file systems, and decided to let the experts handle it. >> >> I will let you know what I find about that unknown parameter. It probably is coming from VirtualBox. > > It's possible the size really needs to stay 6 bytes. In that case, try adding a "u8 legacy_padding[2]" to the union and restore the VMMDEV_ASSERT_SIZE? Kees, You win the prize. Adding the 2 bytes of padding restored operations. Thanks, Larry