Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1284633 > unrolled thread

PAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517

Started byToralf Förster <toralf.foerster@gmx.de>
First post2015-12-05 21:00 +0100
Last post2015-12-05 21:30 +0100
Articles 2 — 2 participants

Back to article view | Back to linux.kernel


Contents

  PAX: size overflow detected in function __vhost_add_used_n  drivers/vhost/vhost.c:1517 Toralf Förster <toralf.foerster@gmx.de> - 2015-12-05 21:00 +0100
    Re: PAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517 "PaX Team" <pageexec@freemail.hu> - 2015-12-05 21:30 +0100

#1284633 — PAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517

FromToralf Förster <toralf.foerster@gmx.de>
Date2015-12-05 21:00 +0100
SubjectPAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517
Message-ID<qCr9U-5ju-9@gated-at.bofh.it>
run into the following at a 64bit hardened stable Gentoo Linux while running the following command at the host (probably just the ssh login was it yet) :

$ cd ~/devel/linux/; git archive --prefix linux-4.4.x/ v4.4-rc3 | (ssh root@n22kvm "cd /usr/src/; sudo tar -xf-")



Dec  5 20:39:26 t44 kernel: PAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517 cicus.491_193 max, count: 7, decl: last_used_idx; num: 0; context: vhost_virtqueue;
Dec  5 20:39:26 t44 kernel: CPU: 2 PID: 3708 Comm: vhost-3706 Tainted: G        W       4.2.6-hardened-r7 #2
Dec  5 20:39:26 t44 kernel: Hardware name: LENOVO 20AQCTO1WW/20AQCTO1WW, BIOS GJET83WW (2.33 ) 03/09/2015
Dec  5 20:39:26 t44 kernel:  ffffffffc096fe5a 0000000000000000 ffffffffc096fddc ffffc9000043bb78
Dec  5 20:39:26 t44 kernel:  ffffffff815ef500 ffff88033e30eec8 ffffffffc096fe5a ffffc9000043bba8
Dec  5 20:39:26 t44 kernel:  ffffffff811ae28b 000000000000fffb ffff880326d300a0 0000000000000005
Dec  5 20:39:26 t44 kernel: Call Trace:
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096fe5a>] ? __param_str_max_mem_regions+0x9a/0xae8 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096fddc>] ? __param_str_max_mem_regions+0x1c/0xae8 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffff815ef500>] dump_stack+0x45/0x5d
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096fe5a>] ? __param_str_max_mem_regions+0x9a/0xae8 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffff811ae28b>] report_size_overflow+0x3b/0x50
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096da7b>] __vhost_add_used_n+0x1db/0x1e0 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffff8137a0e6>] ? copy_user_enhanced_fast_string+0x16/0x20
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096e0e2>] vhost_add_used_n+0x92/0x1b0 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096eb7a>] vhost_add_used_and_signal_n+0x2a/0x50 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffffc097bd1b>] handle_rx+0x63b/0x910 [vhost_net]
Dec  5 20:39:26 t44 kernel:  [<ffffffffc097c00d>] handle_rx_net+0x1d/0x30 [vhost_net]
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096d7f8>] vhost_worker+0xf8/0x1a0 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffffc096d700>] ? vhost_log_write+0xa0/0xa0 [vhost]
Dec  5 20:39:26 t44 kernel:  [<ffffffff81085877>] kthread+0xf7/0x110
Dec  5 20:39:26 t44 kernel:  [<ffffffff81085780>] ? kthread_create_on_node+0x1b0/0x1b0
Dec  5 20:39:26 t44 kernel:  [<ffffffff815f690e>] ret_from_fork+0x3e/0x70
Dec  5 20:39:26 t44 kernel:  [<ffffffff81085780>] ? kthread_create_on_node+0x1b0/0x1b0


-- 
Toralf, pgp: C4EACDDE 0076E94E
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]


#1284638 — Re: PAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517

From"PaX Team" <pageexec@freemail.hu>
Date2015-12-05 21:30 +0100
SubjectRe: PAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517
Message-ID<qCrCW-5JB-5@gated-at.bofh.it>
In reply to#1284633
On 5 Dec 2015 at 20:51, Toralf Förster wrote:

> run into the following at a 64bit hardened stable Gentoo Linux while
> running the following command at the host (probably just the ssh login
> was it yet) : 
> 
> $ cd ~/devel/linux/; git archive --prefix linux-4.4.x/ v4.4-rc3 | (ssh root@n22kvm "cd /usr/src/; sudo tar -xf-")
> 
> 
> Dec  5 20:39:26 t44 kernel: PAX: size overflow detected in function __vhost_add_used_n drivers/vhost/vhost.c:1517 cicus.491_193 max, count: 7, decl: last_used_idx; num: 0; context: vhost_virtqueue;

it was already reported (and is fixed):
  https://forums.grsecurity.net/viewtopic.php?f=3&t=4329

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web