gdb_cmd_query() answers qfThreadInfo with a thread ID and a comma for every online CPU, 9 bytes each, followed by the first page of tasks. Only the tasks are paged, KGDB_MAX_THREAD_QUERY at a time, so the CPU entries overrun remcom_out_buffer[BUFMAX] once there are enough CPUs. On x86, where BUFMAX is 1024, a typical boot hits this from 109 online CPUs (222 on arm64 and riscv), and GDB sends qfThreadInfo as soon as it connects: BUG: KASAN: global-out-of-bounds in pack_threadid+0x2a8/0x2e0 Write of size 1 at addr ffffffff86eecc20 by task swapper/0/1 ... The buggy address belongs to the variable: remcom_out_buffer+0x400/0x420 Page the CPU entries together with the tasks, so no reply holds more than KGDB_MAX_THREAD_QUERY threads. The CPUs still come first, which scripts/gdb relies on to detect KGDB. Fixes: 25fc99991383 ("kgdb: fix gdb serial thread queries") Cc: stable@vger.kernel.org Signed-off-by: Christian Aurich Zanettini Martins --- Notes: Tested in QEMU with KASAN and GDB 15.1. Unpatched, connecting GDB to a 109-CPU guest gives the report above; patched, 109, 128 and 255 CPUs return the full thread list with no report. Based on v7.4-rc1. kernel/debug/gdbstub.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/kernel/debug/gdbstub.c b/kernel/debug/gdbstub.c index fc6a7a8c1f6e..02f27e70993c 100644 --- a/kernel/debug/gdbstub.c +++ b/kernel/debug/gdbstub.c @@ -752,15 +752,20 @@ static void gdb_cmd_query(struct kgdb_state *ks) i = 0; remcom_out_buffer[0] = 'm'; ptr = remcom_out_buffer + 1; - if (remcom_in_buffer[1] == 'f') { - /* Each cpu is a shadow thread */ - for_each_online_cpu(cpu) { - ks->thr_query = 0; + if (remcom_in_buffer[1] == 'f') + ks->thr_query = 0; + + /* Each cpu is a shadow thread */ + for_each_online_cpu(cpu) { + if (i >= ks->thr_query && !finished) { int_to_threadref(thref, -cpu - 2); ptr = pack_threadid(ptr, thref); *(ptr++) = ','; - i++; + ks->thr_query++; + if (ks->thr_query % KGDB_MAX_THREAD_QUERY == 0) + finished = 1; } + i++; } for_each_process_thread(g, p) { -- 2.43.0