Re: out-of-bounds write in the function ata_pio_sector

reveliofuzzing
2025-01-20T16:47:44Z

On Mon, Jan 20, 2025 at 8:54 AM Niklas Cassel <cassel@kernel.org> wrote:
>
> On Fri, Jan 17, 2025 at 11:42:45AM -0500, reveliofuzzing wrote:
> > >
> > > However, the .config you provided does not match the bzImage.
> > > E.g. the e1000/e1000e driver is not built-in in your .config,
> > > so I get no networking, while it is enabled in your bzImage.
> > > This makes me worried that you have other changes in your .config.
> > > If you still have the exact config for this bzImage, could you please add
> > > it as an attachment?
> > Hi, we double-checked it but found the config shared above is the one we used.
> > CONFIG_E1000XXX is enabled in this config.
>
> You are right.
>
> For some reason it got compiled as a module when I did "make olddefconfig",
> with your config as base. Sorry about the confusion!
>
>
> >
> > >
> > > I've been using the syz-executor binary that you attached, since the C code
> > > pasted below does not compile, it seems like it has some unintended newlines.
> > > Perhaps you could add it as an attachment instead?
> > Here is the C program:
> > https://drive.google.com/file/d/1Uvhqrn-ntEYQT2PBiQjp0xaor-32WYHO/view?usp=sharing
> > Please let us know if you still can't compile it. We can take a look
> > at how Syzkaller
> > generates this C program and compiles it into the syz-executor binary.
>
> Still does not compile for me.
>
> It still appears to have some uninteded newlines.
>
> You probably copy pasted it from an editor instead of uploading it/sending
> it directly.
>
>
> One example is:
> line380: if (write(1, "executing program\n", sizeof("executing
> line381: program\n") - 1)) {}
>
> Strings in C are not allowed to span multiple lines without a backslash
> immediately before the newline, or by using string concatenation.
Hi, we have updated the c program here:
https://drive.google.com/file/d/1Uvhqrn-ntEYQT2PBiQjp0xaor-32WYHO/view?usp=sharing

This was the command used for compiling it:
gcc -o /tmp/syz-executor -DGOOS_linux=1 -DGOARCH_amd64=1
-DHOSTGOOS_linux=1 -x c - -m64 -O2 -pthread -Wall -Werror -Wparentheses
-Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow
-Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable
-Wno-unused-command-line-argument -static-pie < ./reproducer.c

>
>
> >
> > >
> > > Also, you only talk about 6.12 kernel. Out of curiosity, have you managed to
> > > reproduce this bug on v6.13-rc kernels? Have you tried?
> > We haven't tried it yet, but we can do that in the next few days. Will keep you
> > posted.
>
> I got an off-list email that mentioned that you could reproduce on 6.13-rc7,
> thank you!
>
> Hopefully I will have some time to try to debug this sometime this week.
>
>
> Kind regards,
> Niklas