linux-ext4 - Re: mainline-5.5.0-rc1: do_mount_root+0x6c/0x10d

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20191216105338.GA163642@light.dominikbrodowski.net>
Date:   Mon, 16 Dec 2019 11:53:38 +0100
From:   Dominik Brodowski <linux@...inikbrodowski.net>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     Naresh Kamboju <naresh.kamboju@...aro.org>,
        kvm list <kvm@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        David Howells <dhowells@...hat.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        linux-ext4 <linux-ext4@...r.kernel.org>,
        lkft-triage@...ts.linaro.org, Paolo Bonzini <pbonzini@...hat.com>,
        Marc Zyngier <maz@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: mainline-5.5.0-rc1: do_mount_root+0x6c/0x10d - kernel crash
 while mounting rootfs

On Mon, Dec 16, 2019 at 11:22:04AM +0100, Arnd Bergmann wrote:
> On Mon, Dec 16, 2019 at 10:15 AM Naresh Kamboju
> <naresh.kamboju@...aro.org> wrote:
> >
> > The following kernel crash reported on qemu_x86_64 boot running
> > 5.5.0-rc1 mainline kernel.
> 
> I looked for too long at v5.5-rc1 completely puzzled by how you got to this
> object code before realizing that this is a git snapshot between -rc1 and -rc2.
> 
> The code in question was changed by a recent series from Dominik Brodowski,
> the main difference being commit cccaa5e33525 ("init: use do_mount() instead
> of ksys_mount()").
> 
> It looks like the NULL-check in ksys_mount()/copy_mount_options() is missing
> from the new mount_block_root, so it passes a NULL pointer into strncpy().
> 
> Something like this should fix it (not tested):

This equivalent patch by Linus already got some testing:

https://lore.kernel.org/lkml/CAHk-=wh8VLe3AEKhz=1bzSO=1fv4EM71EhufxuC=Gp=+bLhXoA@mail.gmail.com/

Thanks,
	Dominik