linux-kernel - Re: general protection fault in relay_open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190131115401.GA19697@kroah.com>
Date:   Thu, 31 Jan 2019 12:54:01 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:     Kees Cook <keescook@...omium.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        syzbot <syzbot+16c3a70e1e9b29346c43@...kaller.appspotmail.com>,
        Eric Biggers <ebiggers@...gle.com>,
        Souptick Joarder <jrdr.linux@...il.com>,
        LKML <linux-kernel@...r.kernel.org>,
        David Rientjes <rientjes@...gle.com>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: general protection fault in relay_open_buf

On Thu, Jan 31, 2019 at 08:29:37PM +0900, Tetsuo Handa wrote:
> On 2019/01/31 19:51, Greg KH wrote:
> > Can you test the patch below?
> 
> You can ask syzbot to test the patch. But
> 
> > @@ -461,7 +463,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
> >  		dentry = chan->cb->create_buf_file(NULL, NULL,
> >  						   S_IRUSR, buf,
> >  						   &chan->is_global);
> > -		if (WARN_ON(dentry))
> > +		if (IS_ERR_OR_NULL(dentry))
> >  			goto free_buf;
> 
> are you trying to fix a different bug together that old code was by error bailing
> out when chan->cb->create_buf_file() returned a valid "struct dentry *" ?
> I don't know what WARN_ON() due to a valid "struct dentry *" means...

I don't either, I'm guessing that's a code path that has never been
taken, or everyone just ignores it :)

Anyway, I fixed it up to be safe.  And the reproducer shows it now works
properly too.

thanks,

greg k-h