linux-kernel - Re: WARNING: kmalloc bug in krealloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <de43c821-67ef-6ed0-f40c-653a26f9ca8f@I-love.SAKURA.ne.jp>
Date:   Mon, 16 Jul 2018 16:17:42 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     v9fs-developer@...ts.sourceforge.net,
        Eric Van Hensbergen <ericvh@...il.com>,
        Ron Minnich <rminnich@...dia.gov>,
        Latchesar Ionkov <lucho@...kov.net>
Cc:     syzbot <syzbot+8574471d8734457d98aa@...kaller.appspotmail.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com, viro@...iv.linux.org.uk
Subject: Re: WARNING: kmalloc bug in krealloc

This looks like a v9fs bug. xattrwalk is returning bogus return value.

[   30.321571] v9fs_xattr_get(): name = security.capability buffer =           (null) value_len = 0
[   30.323819] >>> TXATTRWALK file_fid 1, attr_fid 2 name security.capability
[   30.326132] <<<  RXATTRWALK fid 2 size 17441174723711270912
[   30.327667] attr_size=17441174723711270912 buffer_size=0 retval=-1005569349998280704
[   30.329684] vfs_getxattr_alloc(): value=          (null) error=5570560 xattr_size=24
[   30.331610] WARNING: CPU: 2 PID: 8807 at mm/slab_common.c:1031 kmalloc_slab+0x56/0x70

-1005569349998280704 is 0xF20B800100550000, and taking lower 32bits of F20B800100550000 is
0x550000 which is 5570560, which is too large size for kmalloc().