From: Al Viro <viro@zeniv.linux.org.uk>
To: syzbot <syzbot+c23efa0cc68e79d551fc@syzkaller.appspotmail.com>
Cc: axboe@kernel.dk, ceph-devel@vger.kernel.org,
darrick.wong@oracle.com, dhowells@redhat.com,
dongsheng.yang@easystack.cn, gregkh@linuxfoundation.org,
idryomov@gmail.com, kstewart@linuxfoundation.org,
linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-xfs@vger.kernel.org,
sage@redhat.com, syzkaller-bugs@googlegroups.com,
tglx@linutronix.de
Subject: Re: KASAN: slab-out-of-bounds Read in suffix_kstrtoint
Date: Fri, 7 Feb 2020 05:07:06 +0000 [thread overview]
Message-ID: <20200207050706.GC23230@ZenIV.linux.org.uk> (raw)
In-Reply-To: <000000000000860811059df44228@google.com>
On Thu, Feb 06, 2020 at 07:48:17PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: a0c61bf1 Add linux-next specific files for 20200206
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13925e6ee00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=7d320d6d9afdaecd
> dashboard link: https://syzkaller.appspot.com/bug?extid=c23efa0cc68e79d551fc
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1725bad9e00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15ac3c5ee00000
>
> The bug was bisected to:
>
> commit 61dff92158775e70c0183f4f52c3a5a071dbc24b
> Author: Al Viro <viro@zeniv.linux.org.uk>
> Date: Tue Dec 17 19:15:04 2019 +0000
>
> Pass consistent param->type to fs_parse()
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11fa020de00000
> final crash: https://syzkaller.appspot.com/x/report.txt?x=13fa020de00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=15fa020de00000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+c23efa0cc68e79d551fc@syzkaller.appspotmail.com
> Fixes: 61dff9215877 ("Pass consistent param->type to fs_parse()")
Argh... OK, I see what's going on.
commit 296713d91a7df022b0edf20d55f83554b4f95ba1
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Fri Feb 7 00:02:11 2020 -0500
do not accept empty strings for fsparam_string()
Reported-by: syzbot+c23efa0cc68e79d551fc@syzkaller.appspotmail.com
Fixes: 61dff9215877 ("Pass consistent param->type to fs_parse()")
diff --git a/fs/fs_parser.c b/fs/fs_parser.c
index fdc047b804b2..7e6fb43f9541 100644
--- a/fs/fs_parser.c
+++ b/fs/fs_parser.c
@@ -256,7 +256,7 @@ EXPORT_SYMBOL(fs_param_is_enum);
int fs_param_is_string(struct p_log *log, const struct fs_parameter_spec *p,
struct fs_parameter *param, struct fs_parse_result *result)
{
- if (param->type != fs_value_is_string)
+ if (param->type != fs_value_is_string || !*param->string)
return fs_param_bad_value(log, param);
return 0;
}
prev parent reply other threads:[~2020-02-07 5:07 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-07 3:48 KASAN: slab-out-of-bounds Read in suffix_kstrtoint syzbot
2020-02-07 5:07 ` Al Viro [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200207050706.GC23230@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=axboe@kernel.dk \
--cc=ceph-devel@vger.kernel.org \
--cc=darrick.wong@oracle.com \
--cc=dhowells@redhat.com \
--cc=dongsheng.yang@easystack.cn \
--cc=gregkh@linuxfoundation.org \
--cc=idryomov@gmail.com \
--cc=kstewart@linuxfoundation.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=sage@redhat.com \
--cc=syzbot+c23efa0cc68e79d551fc@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.