KASAN: global-out-of-bounds Read in fbcon_get

KASAN: global-out-of-bounds Read in fbcon_get_font
Status: fixed on 2020/11/13 22:55
Reported-by: syzbot+b4b0445a9d0c9f5a0a45@syzkaller.appspotmail.com
Fix commit: 30386c13a1bf fbcon: Fix global-out-of-bounds read in fbcon_get_font()
First crash: 776d, last: 460d

Fix bisection: fixed by (bisect log) :
commit 30386c13a1bfb0d1ce59ea83b825aa73bd516bc5
Author: Peilin Ye <yepeilin.cs@gmail.com>
Date: Thu Sep 24 13:43:48 2020 +0000

fbcon: Fix global-out-of-bounds read in fbcon_get_font()

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: global-out-of-bounds Read in fbcon_get_font	C	inconclusive	inconclusive	41	473d	770d	17/22	fixed on 2020/11/16 12:12
linux-4.19	KASAN: global-out-of-bounds Read in fbcon_get_font	C		done	47	465d	777d	1/1	fixed on 2020/11/10 07:26

Sample crash report:

audit: type=1400 audit(1588043166.476:8): avc:  denied  { execmem } for  pid=6335 comm="syz-executor193" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
==================================================================
BUG: KASAN: global-out-of-bounds in memcpy include/linux/string.h:347 [inline]
BUG: KASAN: global-out-of-bounds in fbcon_get_font+0x262/0x530 drivers/video/fbdev/core/fbcon.c:2424
Read of size 31 at addr ffffffff86e6949c by task syz-executor193/6337

CPU: 1 PID: 6337 Comm: syz-executor193 Not tainted 4.14.177-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x13e/0x194 lib/dump_stack.c:58
 print_address_description.cold+0x5/0x1e2 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393
 memcpy+0x20/0x50 mm/kasan/kasan.c:302
 memcpy include/linux/string.h:347 [inline]
 fbcon_get_font+0x262/0x530 drivers/video/fbdev/core/fbcon.c:2424
 con_font_get drivers/tty/vt/vt.c:4098 [inline]
 con_font_op+0x1c6/0xf70 drivers/tty/vt/vt.c:4249
 do_fontx_ioctl drivers/tty/vt/vt_ioctl.c:273 [inline]
 vt_ioctl+0x16d2/0x1f20 drivers/tty/vt/vt_ioctl.c:945
 tty_ioctl+0x6c5/0x1220 drivers/tty/tty_io.c:2661
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x441289
RSP: 002b:00007ffd9884c5f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441289
RDX: 0000000020000000 RSI: 0000000000004b6b RDI: 0000000000000003
RBP: 0000000000008bd7 R08: 000000000000000d R09: 00000000004002c8
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004020b0
R13: 0000000000402140 R14: 0000000000000000 R15: 0000000000000000

The buggy address belongs to the variable:
 fontdata_8x16+0xffc/0x1120

Memory state around the buggy address:
 ffffffff86e69380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff86e69400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffff86e69480: 00 00 00 00 fa fa fa fa 06 fa fa fa fa fa fa fa
                               ^
 ffffffff86e69500: 05 fa fa fa fa fa fa fa 06 fa fa fa fa fa fa fa
 ffffffff86e69580: 00 00 03 fa fa fa fa fa 00 00 00 00 00 00 00 00
==================================================================

Crashes (42):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info
ci2-linux-4-14	2020/04/28 03:08	linux-4.14.y	050272a0423e	0ce7569e	.config	log	report	syz	C
ci2-linux-4-14	2020/01/01 17:55	linux-4.14.y	4c5bf01e16a7	25a0186e	.config	log	report	syz	C
ci2-linux-4-14	2019/12/03 12:03	linux-4.14.y	fbc5fe7a54d0	ab342da3	.config	log	report	syz	C
ci2-linux-4-14	2019/12/10 03:36	linux-4.14.y	a844dc4c5442	b31eda3d	.config	log	report	syz
ci2-linux-4-14	2020/10/14 12:25	linux-4.14.y	cbfa1702aaf6	fc7735a2	.config	log	report			info
ci2-linux-4-14	2020/10/05 13:46	linux-4.14.y	cbfa1702aaf6	1880b4a9	.config	log	report			info
ci2-linux-4-14	2020/09/27 15:25	linux-4.14.y	cbfa1702aaf6	5dd8aee8	.config	log	report			info
ci2-linux-4-14	2020/09/25 08:00	linux-4.14.y	cbfa1702aaf6	54289b08	.config	log	report			info
ci2-linux-4-14	2020/08/26 18:31	linux-4.14.y	d7e78d08fa77	318430cb	.config	log	report
ci2-linux-4-14	2020/08/24 10:43	linux-4.14.y	6a24ca2506d6	cef5ae68	.config	log	report
ci2-linux-4-14	2020/08/06 20:31	linux-4.14.y	ca4f2c56d416	4ca1c0ea	.config	log	report
ci2-linux-4-14	2020/08/04 17:07	linux-4.14.y	7f2c5eb458b8	80a06902	.config	log	report
ci2-linux-4-14	2020/07/31 12:02	linux-4.14.y	e5a54aa2d312	8df85ed9	.config	log	report
ci2-linux-4-14	2020/07/23 22:29	linux-4.14.y	69b94dd6dcd1	70c104a1	.config	log	report
ci2-linux-4-14	2020/07/06 11:45	linux-4.14.y	b850307b279c	ac5a135b	.config	log	report
ci2-linux-4-14	2020/07/04 04:30	linux-4.14.y	b850307b279c	51095195	.config	log	report
ci2-linux-4-14	2020/07/03 21:33	linux-4.14.y	b850307b279c	6e569755	.config	log	report
ci2-linux-4-14	2020/07/02 16:36	linux-4.14.y	b850307b279c	f30c14bf	.config	log	report
ci2-linux-4-14	2020/06/25 04:38	linux-4.14.y	b850307b279c	9d60b18e	.config	log	report
ci2-linux-4-14	2020/06/22 11:48	linux-4.14.y	b850307b279c	eabcced4	.config	log	report
ci2-linux-4-14	2020/06/17 06:09	linux-4.14.y	b850307b279c	b9f3810b	.config	log	report
ci2-linux-4-14	2020/06/13 06:24	linux-4.14.y	b850307b279c	f4724dd3	.config	log	report
ci2-linux-4-14	2020/06/11 21:59	linux-4.14.y	b850307b279c	1beaee21	.config	log	report
ci2-linux-4-14	2020/06/04 07:21	linux-4.14.y	c6db52a88798	b0d1c0d5	.config	log	report
ci2-linux-4-14	2020/06/03 05:19	linux-4.14.y	4f68020fef1c	f3ba1b5b	.config	log	report
ci2-linux-4-14	2020/05/29 18:00	linux-4.14.y	4f68020fef1c	bed08304	.config	log	report
ci2-linux-4-14	2020/05/29 09:29	linux-4.14.y	4f68020fef1c	d19ed305	.config	log	report
ci2-linux-4-14	2020/05/26 06:26	linux-4.14.y	a41ba30d9df2	8ca3b7d2	.config	log	report
ci2-linux-4-14	2020/05/24 09:35	linux-4.14.y	a41ba30d9df2	96c92ad3	.config	log	report
ci2-linux-4-14	2020/05/12 11:48	linux-4.14.y	ab9dfda23248	a497a5b4	.config	log	report
ci2-linux-4-14	2020/05/12 02:43	linux-4.14.y	ab9dfda23248	9eb09c40	.config	log	report
ci2-linux-4-14	2020/05/06 04:40	linux-4.14.y	d71f695ce745	35b8eb30	.config	log	report
ci2-linux-4-14	2020/04/23 11:18	linux-4.14.y	c10b57a567e4	2e44d63e	.config	log	report
ci2-linux-4-14	2020/04/10 22:10	linux-4.14.y	4520f06b03ae	a8c6a3f8	.config	log	report
ci2-linux-4-14	2020/03/21 13:23	linux-4.14.y	01364dad1d45	aa6c6a55	.config	log	report
ci2-linux-4-14	2020/02/28 11:28	linux-4.14.y	98db2bf27b9e	c88c7b75	.config	log	report
ci2-linux-4-14	2020/02/20 21:06	linux-4.14.y	98db2bf27b9e	81230308	.config	log	report
ci2-linux-4-14	2020/01/18 13:57	linux-4.14.y	c1141b3aab36	3de7aabb	.config	log	report
ci2-linux-4-14	2020/01/15 00:40	linux-4.14.y	c04fc6fa5c96	fa12bd3c	.config	log	report
ci2-linux-4-14	2020/01/13 22:22	linux-4.14.y	6d0c334a400d	99565c1a	.config	log	report
ci2-linux-4-14	2019/12/18 07:22	linux-4.14.y	bfb9e5c03076	64ca0a37	.config	log	report
ci2-linux-4-14	2019/12/13 16:38	linux-4.14.y	a844dc4c5442	2a752b7c	.config	log	report