vmalloc-out-of-bounds Write in imageblit

The Crash

Initial Test

I compiled the repro and ran it

root@syzkaller:~# strace ./repro_imgblit
execve("./repro_imgblit", ["./repro_imgblit"], [/* 11 vars */]) = 0
...snip...
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
open("/dev/char/4:1", O_RDWR)           = 3
ioctl(3, TIOCLINUX, 0x20000080)         = 0
open("/dev/char/4:1", O_RDWR)           = 4
ioctl(4, KDFONTOP, 0x20000000)          = 0
exit_group(0)                           = ?
+++ exited with 0 +++

You can run in user mode by adding the unshare namespace trick, otherwise you need CAP_SYS_ADMIN.


Also you can enable execmem per program with chcon -t unconfined_execmem_exec_t ./repro https://etbe.coker.com.au/2007/10/10/execmem-and-se-linux/

What does it do?

Basically it does this

• Opens up /dev/tty1 -- openat(AT_FDCWD, "/dev/char/4:1", O_RDWR)
• Does ioctl for TIOCLINUX which sets up a selection for text in the console. manpage: https://man7.org/linux/man-pages/man4/console_ioctl.4.html - source: https://elixir.bootlin.com/linux/latest/source/drivers/tty/vt/vt.c#L3184
• I think it's subcode 2, but it's confusing because there's a second subcode by the looks of it.

From the docs:

       The action of the following ioctls depends on the first byte in
       the struct pointed to by argp, referred to here as the subcode.
       These are legal only for the superuser or the owner of the
       current terminal.
...snip...
       TIOCLINUX, subcode=2
              Set selection.  argp points to a

                  struct {
                      char  subcode;
                      short xs, ys, xe, ye;
                      short sel_mode;
                  };

              xs and ys are the starting column and row.  xe and ye are
              the ending column and row.  (Upper left corner is
              row=column=1.)  sel_mode is 0 for character-by-character
              selection, 1 for word-by-word selection, or 2 for line-by-
              line selection.  The indicated screen characters are
              highlighted and saved in the static array sel_buffer in
              devices/char/console.c.

       TIOCLINUX, subcode=3
              Paste selection.  The characters in the selection buffer
              are written to fd.

The repro:

  *(uint8_t*)0x20000080 = 2;  // subcode 2? "Set selection"
  *(uint8_t*)0x20000081 = 3;  // subcode 3? "Paste selection"
  *(uint16_t*)0x20000082 = 0; // short xs;
  *(uint16_t*)0x20000084 = 0; // short ys;
  *(uint16_t*)0x20000086 = 0; // short xe;
  *(uint16_t*)0x20000088 = 0; // short ye;
  *(uint16_t*)0x2000008a = 0; // short sel_mode; // 0 = character-by-character selection
  syscall(__NR_ioctl, r[0], 0x541c, 0x20000080ul); // TIOCLINUX

• Opens up /dev/tty1 again -- openat(AT_FDCWD, "/dev/char/4:1", O_RDWR)
• Sets up a console_font_op struct

  *(uint32_t*)0x20000000 = 0; // unsigned int op;  /* operation code KD_FONT_OP_* */
  *(uint32_t*)0x20000004 = 0; // unsigned int flags; /* KD_FONT_FLAG_* */
  *(uint32_t*)0x20000008 = 8; // unsigned int width; /* font size */
  *(uint32_t*)0x2000000c = 0x20;  // unsigned int height; /* font size */
  *(uint32_t*)0x20000010 = 0x200; // unsigned int charcount;
  *(uint64_t*)0x20000018 = 0x20000600; // unsigned char __user *data; /* font data with height fixed to 32 */

• Sets up font data in a buffer (1024 bytes)
• Does ioctl KDFONTOP - Source, the call that ends in a crash is line 474: https://elixir.bootlin.com/linux/latest/source/drivers/tty/vt/vt_ioctl.c#L467

The code it crashes on is parsing this font data. This is the code from fast_imageblit https://elixir.bootlin.com/linux/v5.16/source/drivers/video/fbdev/core/sysimgblt.c#L229

 221	for (i = image->height; i--; ) {
 222		dst = dst1;
 223		shift = 8;
 224		src = s;
 225
 226		for (j = k; j--; ) {
 227			shift -= ppw;
 228			end_mask = tab[(*src >> shift) & bit_mask];
*229			*dst++ = (end_mask & eorx) ^ bgx;
 230			if (!shift) {
 231				shift = 8;
 232				src++;
 233			}
 234		}

The loop is iterating over the height and width of the font.

In the set up for TIOCLINUX, if it's actually subcode 2 "Set selection", then the dimensions of the selection are all 0.

In the console_font_op for KDFONTOP, the font is 8x32, and it's using KD_FONT_OP_SET indicated by the 0 in "op".

The instruction it gets messed up on is movzbl (%rax,%r15,1),%edx which is out of bounds

  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 0f b6 14 38       	movzbl (%rax,%r15,1),%edx <-- trapping instruction

This is a different looking crash https://lkml.org/lkml/2021/11/19/150, it reports a write of 4 bytes

And this looks similar in terms of args, but it seems incomplete too. https://www.spinics.net/lists/linux-fbdev/msg30377.html

Also lol at this comment: https://elixir.bootlin.com/linux/v5.16/source/drivers/tty/vt/vt_ioctl.c#L326

What now?

I haven't been able to get it to actually crash. The original warning was just because the page passed to the kernel was RWX.

I'm using kernel 5.16 with the stock syzkaller kconfig, but will have to see if there's something else that influences why this crashes or not.