From: Greg KH <gregkh@linuxfoundation.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Soumya Negi <soumya.negi97@gmail.com>,
syzbot+9d567e08d3970bfd8271@syzkaller.appspotmail.com,
syzkaller-bugs@googlegroups.com,
Xiaolong Huang <butterflyhuangxx@gmail.com>,
stable@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: Test patch for KASAN: global-out-of-bounds Read in detach_capi_ctr
Date: Mon, 4 Jul 2022 13:54:17 +0200 [thread overview]
Message-ID: <YsLU6XL1HBnQR79P@kroah.com> (raw)
In-Reply-To: <20220704112619.GZ16517@kadam>
On Mon, Jul 04, 2022 at 02:26:19PM +0300, Dan Carpenter wrote:
>
> On Fri, Jul 01, 2022 at 06:08:29AM -0700, Soumya Negi wrote:
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
> > 3f8a27f9e27bd78604c0709224cec0ec85a8b106
> >
> > --
> > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/CAHH-VXdqp0ZGKyJWE76zdyKwhv104JRA8ujUY5NoYO47HC9XWQ%40mail.gmail.com.
>
> > From 3aa5aaffef64a5574cbdb3f5c985bc25b612140c Mon Sep 17 00:00:00 2001
> > From: Soumya Negi <soumya.negi97@gmail.com>
> > Date: Fri, 1 Jul 2022 04:52:17 -0700
> > Subject: [PATCH] isdn: capi: Add check for controller count in
> > detach_capi_ctr()
> >
> > Fixes Syzbot bug:
> > https://syzkaller.appspot.com/bug?id=14f4820fbd379105a71fdee357b0759b90587a4e
> >
> > This patch checks whether any ISDN devices are registered before unregistering
> > a CAPI controller(device). Without the check, the controller struct capi_str
> > results in out-of-bounds access bugs to other CAPI data strucures in
> > detach_capri_ctr() as seen in the bug report.
> >
>
> This bug was already fixed by commit 1f3e2e97c003 ("isdn: cpai: check
> ctr->cnr to avoid array index out of bound").
>
> It just needs to be backported. Unfortunately there was no Fixes tag so
> it wasn't picked up. Also I'm not sure how backports work in netdev.
That commit has already been backported quite a while ago and is in the
following releases:
4.4.290 4.9.288 4.14.253 4.19.214 5.4.156 5.10.76 5.14.15 5.15
thanks,
greg k-h
next prev parent reply other threads:[~2022-07-04 11:54 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAHH-VXdqp0ZGKyJWE76zdyKwhv104JRA8ujUY5NoYO47HC9XWQ@mail.gmail.com>
2022-07-04 11:26 ` Test patch for KASAN: global-out-of-bounds Read in detach_capi_ctr Dan Carpenter
2022-07-04 11:54 ` Greg KH [this message]
2022-07-05 4:04 ` Soumya Negi
2022-07-05 4:45 ` Greg KH
2022-07-05 4:59 ` Soumya Negi
2022-07-05 5:07 ` butt3rflyh4ck
2022-07-05 5:18 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YsLU6XL1HBnQR79P@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=butterflyhuangxx@gmail.com \
--cc=dan.carpenter@oracle.com \
--cc=netdev@vger.kernel.org \
--cc=soumya.negi97@gmail.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+9d567e08d3970bfd8271@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).