Messages in this thread | | | Date | Wed, 3 Apr 2024 06:59:24 -0600 | Subject | Re: [PATCH next] fs: fix oob in do_handle_open | From | "Gustavo A. R. Silva" <> |
| |
On 03/04/24 02:48, Jeff Layton wrote: > On Wed, 2024-04-03 at 14:54 +0800, Edward Adam Davis wrote: >> [Syzbot reported] >> BUG: KASAN: slab-out-of-bounds in instrument_copy_from_user_before include/linux/instrumented.h:129 [inline] >> BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x7b/0xe0 lib/usercopy.c:22 >> Write of size 48 at addr ffff88802b8cbc88 by task syz-executor333/5090 >> >> CPU: 0 PID: 5090 Comm: syz-executor333 Not tainted 6.9.0-rc2-next-20240402-syzkaller #0 >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 >> Call Trace: >> <TASK> >> __dump_stack lib/dump_stack.c:88 [inline] >> dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 >> print_address_description mm/kasan/report.c:377 [inline] >> print_report+0x169/0x550 mm/kasan/report.c:488 >> kasan_report+0x143/0x180 mm/kasan/report.c:601 >> kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 >> instrument_copy_from_user_before include/linux/instrumented.h:129 [inline] >> _copy_from_user+0x7b/0xe0 lib/usercopy.c:22 >> copy_from_user include/linux/uaccess.h:183 [inline] >> handle_to_path fs/fhandle.c:203 [inline] >> do_handle_open+0x204/0x660 fs/fhandle.c:226 >> do_syscall_64+0xfb/0x240 >> entry_SYSCALL_64_after_hwframe+0x72/0x7a >> [Fix] >> When copying data to f_handle, the length of the copied data should not include >> the length of "struct file_handle". >> >> Reported-by: syzbot+4139435cb1b34cf759c2@syzkaller.appspotmail.com >> Signed-off-by: Edward Adam Davis <eadavis@qq.com> >> --- >> fs/fhandle.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/fs/fhandle.c b/fs/fhandle.c >> index 53ed54711cd2..8a7f86c2139a 100644 >> --- a/fs/fhandle.c >> +++ b/fs/fhandle.c >> @@ -202,7 +202,7 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, >> *handle = f_handle; >> if (copy_from_user(&handle->f_handle, >> &ufh->f_handle, >> - struct_size(ufh, f_handle, f_handle.handle_bytes))) { >> + f_handle.handle_bytes)) { >> retval = -EFAULT; >> goto out_handle; >> } > > cc'ing Gustavo, since it looks like his patch in -next is what broke > this. >
Oh, sorry about that folks. That looks pretty much like a copy/paste error.
The fix is correct.
Thanks, Edward! -- Gustavo
| |