Re: out-of-bounds write in the function ata_pio_sector

[Niklas Cassel <cassel@kernel.org>]

On Fri, Jan 17, 2025 at 11:42:45AM -0500, reveliofuzzing wrote:
> >
> > However, the .config you provided does not match the bzImage.
> > E.g. the e1000/e1000e driver is not built-in in your .config,
> > so I get no networking, while it is enabled in your bzImage.
> > This makes me worried that you have other changes in your .config.
> > If you still have the exact config for this bzImage, could you please add
> > it as an attachment?
> Hi, we double-checked it but found the config shared above is the one we used.
> CONFIG_E1000XXX is enabled in this config.

You are right.

For some reason it got compiled as a module when I did "make olddefconfig",
with your config as base. Sorry about the confusion!


> 
> >
> > I've been using the syz-executor binary that you attached, since the C code
> > pasted below does not compile, it seems like it has some unintended newlines.
> > Perhaps you could add it as an attachment instead?
> Here is the C program:
> https://drive.google.com/file/d/1Uvhqrn-ntEYQT2PBiQjp0xaor-32WYHO/view?usp=sharing
> Please let us know if you still can't compile it. We can take a look
> at how Syzkaller
> generates this C program and compiles it into the syz-executor binary.

Still does not compile for me.

It still appears to have some uninteded newlines.

You probably copy pasted it from an editor instead of uploading it/sending
it directly.


One example is:
line380:		if (write(1, "executing program\n", sizeof("executing
line381:	program\n") - 1)) {}

Strings in C are not allowed to span multiple lines without a backslash
immediately before the newline, or by using string concatenation.


> 
> >
> > Also, you only talk about 6.12 kernel. Out of curiosity, have you managed to
> > reproduce this bug on v6.13-rc kernels? Have you tried?
> We haven't tried it yet, but we can do that in the next few days. Will keep you
> posted.

I got an off-list email that mentioned that you could reproduce on 6.13-rc7,
thank you!

Hopefully I will have some time to try to debug this sometime this week.


Kind regards,
Niklas