In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-multipath: fix flex array size in struct nvme_ns_head<\/p>\n
struct nvme_ns_head contains a flexible array member, current_path[],
\nwhich is indexed using the NUMA node ID:
\nhead->current_path[numa_node_id()]<\/p>\n
The structure is currently allocated as:
\nsize = sizeof(struct nvme_ns_head) +
\n (num_possible_nodes() * sizeof(struct nvme_ns *));
\nhead = kzalloc(size, GFP_KERNEL);<\/p>\n
This allocation assumes that NUMA node IDs are sequential and densely
\npacked from 0 .. num_possible_nodes() – 1. While this assumption holds
\non many systems, it is not always true on some architectures such as
\npowerpc.<\/p>\n
On some powerpc systems, NUMA node IDs can be sparse. For example:
\nNUMA:
\n NUMA node(s): 6
\n NUMA node0 CPU(s): 80-159
\n NUMA node8 CPU(s): 0-79
\n NUMA node252 CPU(s):
\n NUMA node253 CPU(s):
\n NUMA node254 CPU(s):
\n NUMA node255 CPU(s):<\/p>\n
That is, the possible\/online NUMA node IDs are: 0, 8, 252, 253, 254, 255
\nIn this case: num_possible_nodes() = 6<\/p>\n
So memory is allocated for only 6 entries in current_path[]. However,
\nthe array is later indexed using the actual NUMA node ID. As a result,
\naccesses such as:
\nhead->current_path[8] or
\nhead->current_path[252]
\ngoes out of bounds, leading to the following KASAN splat:<\/p>\n
==================================================================
\nBUG: KASAN: slab-out-of-bounds in nvme_mpath_revalidate_paths+0x22c\/0x290 [nvme_core]
\nWrite of size 8 at addr c00020003bda35b8 by task kworker\/u641:2\/1997<\/p>\n
CPU: 1 UID: 0 PID: 1997 Comm: kworker\/u641:2 Not tainted 7.1.0-rc5-dirty #14 PREEMPT(lazy)
\nHardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV
\nWorkqueue: async async_run_entry_fn
\nCall Trace:
\n[c000200037fa7510] [c0000000021c23d4] dump_stack_lvl+0x88\/0xdc (unreliable)
\n[c000200037fa7540] [c0000000009fda90] print_report+0x22c\/0x67c
\n[c000200037fa7630] [c0000000009fd508] kasan_report+0x108\/0x220
\n[c000200037fa7740] [c0000000009fff48] __asan_store8+0xe8\/0x120
\n[c000200037fa7760] [c008000018e76474] nvme_mpath_revalidate_paths+0x22c\/0x290 [nvme_core]
\n[c000200037fa7800] [c008000018e6556c] nvme_update_ns_info+0x4a4\/0x5e0 [nvme_core]
\n[c000200037fa7a50] [c008000018e66270] nvme_alloc_ns+0x6d8\/0x1a70 [nvme_core]
\n[c000200037fa7c20] [c008000018e679fc] nvme_scan_ns+0x3f4\/0x630 [nvme_core]
\n[c000200037fa7d10] [c00000000031f22c] async_run_entry_fn+0x9c\/0x3a0
\n[c000200037fa7db0] [c0000000002fa544] process_one_work+0x414\/0xa10
\n[c000200037fa7ec0] [c0000000002fbf00] worker_thread+0x320\/0x640
\n[c000200037fa7f80] [c00000000030d0f8] kthread+0x278\/0x290
\n[c000200037fa7fe0] [c00000000000ded8] start_kernel_thread+0x14\/0x18<\/p>\n
Allocated by task 1997 on cpu 1 at 35.928317s:<\/p>\n
The buggy address belongs to the object at c00020003bda3000
\n which belongs to the cache kmalloc-rnd-15-2k of size 2048
\nThe buggy address is located 16 bytes to the right of
\n allocated 1448-byte region [c00020003bda3000, c00020003bda35a8)<\/p>\n
The buggy address belongs to the physical page:<\/p>\n
Memory state around the buggy address:
\n c00020003bda3480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\n c00020003bda3500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\n>c00020003bda3580: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
\n ^
\n c00020003bda3600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
\n c00020003bda3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
\n==================================================================<\/p>\n
Fix this by allocating the flexible array using nr_node_ids instead
\nof num_possible_nodes(). Since nr_node_ids represents the maximum
\npossible NUMA node IDs, indexing current_path[] using numa_node_id()
\nbecomes safe even on systems with sparse node IDs.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-multipath: fix flex array size in struct nvme_ns_head<\/p>\n
struct nvme_ns_head contains a flexible array member, current_path[],
\nw<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7336","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}