lkml.org 
[lkml]   [2024]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [syzbot] [mm?] [hardening?] BUG: bad usercopy in do_handle_open
From

>> usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-16' (offset 8, size 9)!
>
> We tried to copy 9 bytes into the f_handle[] array.
>
> But from my reading of the reproducer, f_handle.handle_bytes was set to 1.
>
> Aneesh, any thoughts on this?

This was previously reported:

https://lore.kernel.org/linux-nfs/tencent_A7845DD769577306D813742365E976E3A205@qq.com/

and it's fixed in linux-next already:

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=02426828cde24cd5b6cf5f30467cea085118f657

--
Gustavo

\
 
 \ /
  Last update: 2024-05-27 16:26    [W:0.029 / U:0.232 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site