mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
9ca9e8c857
gdb_cmd_query() decodes the hex payload of a qRcmd packet (the GDB
"monitor" command passthrough to kdb) into remcom_out_buffer and hands
it to kdb_parse(). It sizes the decode with strlen() of the payload:
int len = strlen(remcom_in_buffer + 6);
...
kgdb_hex2mem(remcom_in_buffer + 6,
remcom_out_buffer, len);
len = len / 2;
kgdb_hex2mem() takes count as the number of bytes to produce and
decodes them in place at buf, reading and writing 2 * count bytes
there. len here is the hex character count, twice the decoded size,
so the decode runs over 2 * len bytes at remcom_in_buffer + 6, off
the end of the buffer. On x86 BUFMAX is 1024, so a 256-byte monitor
command (512 hex characters) overruns remcom_in_buffer during the
in-place decode:
BUG: KASAN: global-out-of-bounds in kgdb_hex2mem+0x131/0x160
Read of size 1 at addr ffffffff8765ef05 by task sh/1
...
kgdb_hex2mem+0x131/0x160
gdb_serial_stub+0x16d4/0x3170
kgdb_cpu_enter+0xb68/0x1520
...
The buggy address belongs to the variable:
remcom_in_buffer+0x405/0x420
Halve len before the call so kgdb_hex2mem() gets the decoded byte count.
It then reads the len hex characters already in remcom_in_buffer and
writes len / 2 bytes, all inside the buffer, and remcom_out_buffer holds
the same command as before.
Fixes:
|
||
|---|---|---|
| .. | ||
| kdb | ||
| debug_core.c | ||
| debug_core.h | ||
| gdbstub.c | ||
| Makefile | ||