Received-SPF: pass (google.com: domain of linux-kernel+bounces-188813-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <ced59dca-70cd-4680-b7d5-e0983aa9be74@quicinc.com>
Date: Fri, 24 May 2024 22:46:53 +0800
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] kobject_uevent: Fix OOB access within zap_modalias_env()
To: Greg KH <gregkh@linuxfoundation.org>
CC: <rafael@kernel.org>, <akpm@linux-foundation.org>,
        <dmitry.torokhov@gmail.com>, <linux-kernel@vger.kernel.org>,
        <stable@vger.kernel.org>
References: <1716524403-5415-1-git-send-email-quic_zijuhu@quicinc.com>
 <2024052418-casket-partition-c143@gregkh>
 <74465bf5-ca18-45f8-a881-e95561c59a02@quicinc.com>
 <2024052438-hesitate-chevron-dbd7@gregkh>
 <5acce173-0224-4a05-ae88-3eb1833fcb39@quicinc.com>
 <2024052458-unleash-atom-489b@gregkh>
 <0b916393-eb39-4467-9c99-ac1bc9746512@quicinc.com>
 <2024052405-award-recycling-6931@gregkh>
Content-Language: en-US
From: quic_zijuhu <quic_zijuhu@quicinc.com>
In-Reply-To: <2024052405-award-recycling-6931@gregkh>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit

On 5/24/2024 7:47 PM, Greg KH wrote:
> On Fri, May 24, 2024 at 05:08:06PM +0800, quic_zijuhu wrote:
>> On 5/24/2024 2:56 PM, Greg KH wrote:
>>> On Fri, May 24, 2024 at 01:34:49PM +0800, quic_zijuhu wrote:
>>>> On 5/24/2024 1:21 PM, Greg KH wrote:
>>>>> On Fri, May 24, 2024 at 01:15:01PM +0800, quic_zijuhu wrote:
>>>>>> On 5/24/2024 12:33 PM, Greg KH wrote:
>>>>>>> On Fri, May 24, 2024 at 12:20:03PM +0800, Zijun Hu wrote:
>>>>>>>> zap_modalias_env() wrongly calculates size of memory block
>>>>>>>> to move, so maybe cause OOB memory access issue, fixed by
>>>>>>>> correcting size to memmove.
>>>>>>>
>>>>>>> "maybe" or "does"?  That's a big difference :)
>>>>>>>
>>>>>> i found this issue by reading code instead of really meeting this issue.
>>>>>> this issue should be prone to happen if there are more than 1 other
>>>>>> environment vars.
>>>>>
>>>>> But does it?  Given that we have loads of memory checkers, and I haven't
>>>>> ever seen any report of any overrun, it would be nice to be sure.
>>>>>
>>>> yes. if @env includes env vairable MODALIAS and  more than one other env
>>>> vairables. then (env->buflen - len) must be greater that actual size of
>>>> "target block" shown previously, so the OOB issue must happen.
>>>
>>> Then why are none of the tools that we have for catching out-of-bound
>>> issues triggered here?  Are the tools broken or is this really just not
>>> ever happening?  It would be good to figure that out...
>>>
>> don't know why. perhaps, need to report our case to expert of tools.
> 
> Try running them yourself and see!
i find out the reason why the OOB issue is difficult to be observed.
the reason is that MODALIAS is the last variable added by most of
drivers by accident, and it skips the obvious wrong logic within
zap_modalias_env().

you maybe run below command to confirm the reason.
grep -l -r MODALIAS drivers/  | xargs grep add_uevent_var