linux-kernel - Re: [syzbot] KASAN: slab-out-of-bounds Read in thrustmaster

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Feb 2022 11:12:03 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     Jiri Kosina <jikos@...nel.org>
Cc:     syzbot <syzbot+35eebd505e97d315d01c@...kaller.appspotmail.com>,
        alexandre.torgue@...s.st.com, benjamin.tissoires@...hat.com,
        linux-arm-kernel@...ts.infradead.org, linux-input@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        linux-stm32@...md-mailman.stormreply.com,
        mcoquelin.stm32@...il.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] KASAN: slab-out-of-bounds Read in thrustmaster_probe

Hi Jiri,

On 2/21/22 11:01, Jiri Kosina wrote:
>> Looks like missing check for malicious device. Need to check number of
>> endpoints before accessing endpoints array
>> 
>> 
>> #syz test
>> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> 
> Thanks Pavel. Could you please send the patch with proper changelog and
> SOB my way?
> 

I've already posted the patch :) You can find it here [1] (you are in CC 
of course)



[1] 
https://lore.kernel.org/all/20220220160114.26882-1-paskripkin@gmail.com/




With regards,
Pavel Skripkin