From: Al Viro <viro@zeniv.linux.org.uk>
To: Edward Adam Davis <eadavis@qq.com>
Cc: syzbot+fc519d7875f2d9186c1f@syzkaller.appspotmail.com,
devel@lists.orangefs.org, hubcap@omnibond.com,
linux-kernel@vger.kernel.org, martin@omnibond.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [PATCH] orangefs: fix a oob in orangefs_debug_write
Date: Sun, 22 Dec 2024 10:35:22 +0000 [thread overview]
Message-ID: <20241222103522.GE1977892@ZenIV> (raw)
In-Reply-To: <tencent_10DB52C0066E89812EDE2ECC0CB0E7EE4606@qq.com>
On Sun, Dec 22, 2024 at 04:14:13PM +0800, Edward Adam Davis wrote:
> syzbot report a slab-out-of-bounds Read in orangefs_debug_write. [1]
>
> The string passed in from userspace is not terminated with a NULL character,
> which causes strlen to go out of bounds.
>
> Use kstrndup to replace kstrdup.
Better to replace
if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) {
silly = count;
count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1;
}
with
if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) {
silly = count;
count = ORANGEFS_MAX_DEBUG_STRING_LEN;
}
instead, so that we wouldn't have to deal with lack of NUL anywhere.
next prev parent reply other threads:[~2024-12-22 10:35 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-22 5:59 [syzbot] [orangefs?] KASAN: slab-out-of-bounds Read in orangefs_debug_write syzbot
2024-12-22 7:45 ` Edward Adam Davis
2024-12-22 8:08 ` syzbot
2024-12-22 8:14 ` [PATCH] orangefs: fix a oob " Edward Adam Davis
2024-12-22 10:35 ` Al Viro [this message]
2024-12-22 13:59 ` Edward Adam Davis
2024-12-22 14:16 ` [PATCH V2] " Edward Adam Davis
2025-01-01 0:10 ` [PATCH] " Mike Marshall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241222103522.GE1977892@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=devel@lists.orangefs.org \
--cc=eadavis@qq.com \
--cc=hubcap@omnibond.com \
--cc=linux-kernel@vger.kernel.org \
--cc=martin@omnibond.com \
--cc=syzbot+fc519d7875f2d9186c1f@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox