Messages in this thread | | | Date | Thu, 12 Mar 2020 16:34:42 +0300 | From | Dan Carpenter <> | Subject | Re: general protection fault in syscall_return_slowpath |
| |
On Sun, Mar 08, 2020 at 09:29:04AM -0700, Andy Lutomirski wrote: > On Sat, Mar 7, 2020 at 11:45 PM syzbot > <syzbot+cd66e43794b178bb5cd6@syzkaller.appspotmail.com> wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: 63623fd4 Merge tag 'for-linus' of git://git.kernel.org/pub.. > > git tree: upstream > > console output: https://syzkaller.appspot.com/x/log.txt?x=16cfeac3e00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=5d2e033af114153f > > dashboard link: https://syzkaller.appspot.com/bug?extid=cd66e43794b178bb5cd6 > > compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12a42329e00000 > > > > I bet this is due to entirely missing input validation in > con_font_copy() and/or fbcon_copy_font().
The only thing we use in con_font_copy() is op->height and we clamp it to 0-MAX_NR_CONSOLES (64).
regards, dan carpenter
| |