`kmem_cache_get()` doesn't work on android

[YurBoiRene]

After a call to kmem_cache_get() KASAN gets triggered.

[   17.379361] krwx::krwx_init 
[   17.778532] krwx::open
[   17.860631] ==================================================================
[   17.860789] BUG: KASAN: out-of-bounds in strncmp+0x48/0xa0
[   17.861013] Read of size 1 at addr ffffffffffffffff by task run_poc/169
[   17.861181] 
[   17.861401] CPU: 0 PID: 169 Comm: run_poc Tainted: G           O      5.15.153 #8
[   17.861590] Hardware name: linux,dummy-virt (DT)
[   17.861858] Call trace:
[   17.861947]  dump_backtrace+0x0/0x298
[   17.862094]  show_stack+0x18/0x24
[   17.862211]  dump_stack_lvl+0x64/0x7c
[   17.862327]  print_address_description+0x68/0x370
[   17.862464]  kasan_report+0x184/0x248
[   17.862587]  __asan_load1+0x8c/0x90
[   17.862736]  strncmp+0x48/0xa0
[   17.862858]  ioctl_kmem_get+0x180/0x214 [krwx]
[   17.863391]  krwx_ioctl+0x78/0x29c [krwx]
[   17.863556]  __arm64_sys_ioctl+0xb8/0xf0
[   17.863687]  invoke_syscall+0x54/0x168
[   17.863816]  el0_svc_common+0x100/0x148
[   17.863949]  do_el0_svc+0x38/0xc0
[   17.864077]  el0_svc+0x20/0x50
[   17.864196]  el0t_64_sync_handler+0x84/0xe4
[   17.864323]  el0t_64_sync+0x1a0/0x1a4
[   17.864503] 
[   17.864647] 
[   17.864719] Memory state around the buggy address:
[   17.864992]  fffffffffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.865140]  ffffffffffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.865255] >ffffffffffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   17.865591] Unable to handle kernel paging request at virtual address ffff800000000000
[   17.865776] Mem abort info:
[   17.865867]   ESR = 0x96000006
[   17.865981]   EC = 0x25: DABT (current EL), IL = 32 bits
[   17.866113]   SET = 0, FnV = 0
[   17.866203]   EA = 0, S1PTW = 0
[   17.866297]   FSC = 0x06: level 2 translation fault
[   17.866424] Data abort info:
[   17.866511]   ISV = 0, ISS = 0x00000006
[   17.866621]   CM = 0, WnR = 0
[   17.866768] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000004263e000
[   17.866937] [ffff800000000000] pgd=10000000bffff003, p4d=10000000bffff003, pud=10000000bfffe003, pmd=0000000000000000
[   17.867388] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
[   17.867609] Modules linked in: krwx(O)
[   17.867909] CPU: 0 PID: 169 Comm: run_poc Tainted: G           O      5.15.153 #8
[   17.868079] Hardware name: linux,dummy-virt (DT)
[   17.868219] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   17.868409] pc : __memcpy+0x24/0x260
[   17.868545] lr : kasan_metadata_fetch_row+0x20/0x2c
[   17.868689] sp : ffff80000b977b60
[   17.868794] x29: ffff80000b977b60 x28: 0000ffffffffffff x27: 0000000000000000
[   17.869058] x26: ffff80000a2e908d x25: ffff80000a348793 x24: ffffffffffffff80
[   17.869273] x23: 000000000000007f x22: 0000000000000000 x21: ffff80000a356fd0
[   17.869482] x20: ffff80000a2e3fd0 x19: ffffffffffffffff x18: 0000000000000000
[   17.869695] x17: 2030302030302030 x16: 3020303020303020 x15: 3030203030203030
[   17.869922] x14: 0000000000000001 x13: 0000000000000010 x12: 0000000000000001
[   17.870132] x11: 1ffff0000172ef73 x10: ff80800008721c5c x9 : f9e533692c982000
[   17.870364] x8 : dfff800000000000 x7 : 0000000000000000 x6 : 000000000000003a
[   17.870574] x5 : ffff80000b977b88 x4 : dfff800000000010 x3 : ffff800008721c5c
[   17.870786] x2 : 0000000000000010 x1 : dfff800000000000 x0 : ffff80000b977b78
[   17.871018] Call trace:
[   17.871110]  __memcpy+0x24/0x260
[   17.871229]  print_memory_metadata+0xa8/0x124
[   17.871356]  kasan_report+0x198/0x248
[   17.871473]  __asan_load1+0x8c/0x90
[   17.871591]  strncmp+0x48/0xa0
[   17.871707]  ioctl_kmem_get+0x180/0x214 [krwx]
[   17.871899]  krwx_ioctl+0x78/0x29c [krwx]
[   17.872049]  __arm64_sys_ioctl+0xb8/0xf0
[   17.872171]  invoke_syscall+0x54/0x168
[   17.872288]  el0_svc_common+0x100/0x148
[   17.872406]  do_el0_svc+0x38/0xc0
[   17.872516]  el0_svc+0x20/0x50
[   17.872625]  el0t_64_sync_handler+0x84/0xe4
[   17.872752]  el0t_64_sync+0x1a0/0x1a4
[   17.873002] Code: f100805f 540003c8 f100405f 540000c3 (a9401c26) 
[   17.873407] ---[ end trace 74e222a24846958d ]---
[   17.873672] Kernel panic - not syncing: Oops: Fatal exception
[   17.873952] Kernel Offset: disabled
[   17.874051] CPU features: 0x2,200011e1,00000846
[   17.874265] Memory Limit: none

[kiks7]

Can you provide the Android and kernel versions and how you are calling kmem_cache_get? It seems that it's reading from a -1 value at this strcmp line

[YurBoiRene]

android13-5.15.153_r00

I fixed it for my case by modifying as follows:

int ioctl_kmem_get(struct io_kmem_get* __user user_kmem) {
    struct io_kmem_get kmem;
    struct kmem_cache* s;
    struct list_head* head;

    if (cc_copy_from_user(&kmem, (void*) user_kmem, sizeof(struct io_kmem_get)))
        return -EFAULT;

    if (!dumb_kmem)
      return -EFAULT;

    // Cycle through all caches
    list_for_each(head, &dumb_kmem->list) {
      s = list_entry(head, struct kmem_cache, list);
      if (strncmp(kmem.name, s->name, NAME_SZ) == 0) {
        // Cache found !
        if (put_user(s, &user_kmem->result)) {
          return -EFAULT;
        } else {
            // Found our cache, leave the loop
            break;
        }
      }
    }

    return 0;
}

Break out of the loop after finding the correct cache.

[kiks7]

Nice! I have commited the patch in the new current github repository and I am going to archive this repo.

Thank you!
Alessandro