linux-kernel - Re: general protection fault in strncasecmp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 09 Oct 2020 11:04:24 +0100
From:   David Howells <dhowells@...hat.com>
To:     Hillf Danton <hdanton@...a.com>
Cc:     dhowells@...hat.com,
        syzbot <syzbot+459a5dce0b4cb70fd076@...kaller.appspotmail.com>,
        linux-afs@...ts.infradead.org, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: general protection fault in strncasecmp

Hillf Danton <hdanton@...a.com> wrote:

> +			/*
> +			 * care to detect writers because
> +			 *
> +			 * read_seqbegin_or_lock(&net->cells_lock, &seq);
> +			 *
> +			 * is unable to block 
> +			 *
> +			 * write_seqlock(&net->cells_lock);
> +			 *
> +			 */

That shouldn't be true.  The loop may make one or two passes, the first
without the lock, the second with.  The RCU read lock is supposed to be held
in both cases too (but see below).

One of the call sites, however, afs_probe_cell_name(), doesn't call
afs_lookup_cell_rcu() with the RCU read lock held - which is an error, but not
obviously the one that's biting here.

David