linux-kernel - Re: WARNING: bad usercopy in put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 7 Feb 2018 14:55:23 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     syzbot <syzbot+c4dcac91687a29cbae15@...kaller.appspotmail.com>,
        keun-o.park@...kmatter.ae, Laura Abbott <labbott@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux-MM <linux-mm@...ck.org>,
        Mark Rutland <mark.rutland@....com>,
        Ingo Molnar <mingo@...nel.org>, syzkaller-bugs@...glegroups.com
Subject: Re: WARNING: bad usercopy in put_cmsg

On Tue, Feb 6, 2018 at 8:16 PM, Kees Cook <keescook@...omium.org> wrote:
> On Wed, Feb 7, 2018 at 4:33 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>> On Tue, Feb 6, 2018 at 6:31 PM, syzbot
>> <syzbot+c4dcac91687a29cbae15@...kaller.appspotmail.com> wrote:
>>> Hello,
>>>
>>> syzbot hit the following crash on upstream commit
>>> e237f98a9c134c3d600353f21e07db915516875b (Mon Feb 5 21:35:56 2018 +0000)
>>> Merge tag 'xfs-4.16-merge-5' of
>>> git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
>>>
>>> So far this crash happened 8 times on net-next, upstream.
>>> C reproducer is attached.
>>> syzkaller reproducer is attached.
>>> Raw console output is attached.
>>> compiler: gcc (GCC) 7.1.1 20170620
>>> .config is attached.
>>
>> #syz dup: WARNING in usercopy_warn
>>
>> Let's make that one the main copy, since Kees is already looking at it.
>
> This one has a more descriptive subject, can we dup towards this one?
> Whatever the case, yup, still working on it.

Humm, I see that there is currently no way to just "undup" a bug. It's
possible to remark it as invalid, or fix with commits, but not
possible to just undup and get into "open" state. I've filed
https://github.com/google/syzkaller/issues/520 for this. Meanwhile,
please add either Reported-by: tag from the other bug, or from both.