From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>,
Fengguang Wu <fengguang.wu@intel.com>,
LKML <linux-kernel@vger.kernel.org>,
Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Steven Rostedt <rostedt@goodmis.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Andrew Morton <akpm@linux-foundation.org>,
Aleksey Makarov <aleksey.makarov@linaro.org>,
Ingo Molnar <mingo@kernel.org>,
Nicolas Pitre <nicolas.pitre@linaro.org>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Alexander Potapenko <glider@google.com>
Subject: Re: [devkmsg_write] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170
Date: Tue, 7 Nov 2017 21:05:25 +0900 [thread overview]
Message-ID: <20171107120525.GB404@jagdpanzerIV> (raw)
In-Reply-To: <CACT4Y+Z_MnNzdkYL1sCjJwfzUfbje1_m1ncfLjFTggg0qNipCg@mail.gmail.com>
On (11/07/17 12:09), Dmitry Vyukov wrote:
> > On (11/07/17 17:39), Fengguang Wu wrote:
[..]
> > devkmsg_write() does
> >
> > buf = kmalloc(len+1, GFP_KERNEL);
> > ...
> > kfree(buf);
> >
> > kasan reports that this kfree() is actually happening in unpack_to_rootfs(),
> > before we do copy_from_iter_full().
>
>
> Please ignore the free stack. For slab-out-of-bound bugs the object is
> not actually freed and KASAN prints the free stack where it was freed
> before it was re-allocated as new object.
ah, ok.
> Can that len+1 overflow? Is it checked?
hm, I don't think it overflows there.
__kernel_write()
__vfs_write()
new_sync_write()
__kernel_write() makes sure that if count > MAX_RW_COUNT then
count = MAX_RW_COUNT.
-ss
next prev parent reply other threads:[~2017-11-07 12:05 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-07 9:39 [devkmsg_write] BUG: KASAN: slab-out-of-bounds in copyin+0xea/0x170 Fengguang Wu
2017-11-07 10:45 ` Sergey Senozhatsky
2017-11-07 11:09 ` Dmitry Vyukov
2017-11-07 12:05 ` Sergey Senozhatsky [this message]
2017-11-07 11:59 ` Sergey Senozhatsky
2017-11-07 12:12 ` Andrey Ryabinin
2017-11-07 12:06 ` Andrey Ryabinin
2017-11-07 12:06 ` Fengguang Wu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171107120525.GB404@jagdpanzerIV \
--to=sergey.senozhatsky.work@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=aleksey.makarov@linaro.org \
--cc=aryabinin@virtuozzo.com \
--cc=dvyukov@google.com \
--cc=fengguang.wu@intel.com \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=nicolas.pitre@linaro.org \
--cc=pmladek@suse.com \
--cc=rostedt@goodmis.org \
--cc=sergey.senozhatsky@gmail.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox