linux-kernel - Re: [syzbot] [exfat?] kernel BUG in iov_iter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 17 Jan 2024 23:15:19 +0900
From: Namjae Jeon <linkinjeon@...nel.org>
To: syzbot <syzbot+fd404f6b03a58e8bc403@...kaller.appspotmail.com>
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	sj1557.seo@...sung.com, syzkaller-bugs@...glegroups.com, 
	"Yuezhang.Mo" <Yuezhang.Mo@...y.com>
Subject: Re: [syzbot] [exfat?] kernel BUG in iov_iter_revert

2024-01-17 1:19 GMT+09:00, syzbot
<syzbot+fd404f6b03a58e8bc403@...kaller.appspotmail.com>:
> Hello,
Hi,
>
> syzbot found the following issue on:
>
> HEAD commit:    052d534373b7 Merge tag 'exfat-for-6.8-rc1' of
> git://git.ke..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=108ca8b3e80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=7c8840a4a09eab8
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=fd404f6b03a58e8bc403
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for
> Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1558210be80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14d39debe80000

Thanks for your report!
Can you test if this change fix this issue ?

diff --git a/fs/exfat/inode.c b/fs/exfat/inode.c
index 522edcbb2ce4..65ac7b67c2da 100644
--- a/fs/exfat/inode.c
+++ b/fs/exfat/inode.c
@@ -501,7 +501,7 @@ static ssize_t exfat_direct_IO(struct kiocb *iocb,
struct iov_iter *iter)
 	struct inode *inode = mapping->host;
 	struct exfat_inode_info *ei = EXFAT_I(inode);
 	loff_t pos = iocb->ki_pos;
-	loff_t size = iocb->ki_pos + iov_iter_count(iter);
+	loff_t size = pos + iov_iter_count(iter);
 	int rw = iov_iter_rw(iter);
 	ssize_t ret;

@@ -525,11 +525,9 @@ static ssize_t exfat_direct_IO(struct kiocb
*iocb, struct iov_iter *iter)
 	 */
 	ret = blockdev_direct_IO(iocb, inode, iter, exfat_get_block);
 	if (ret < 0) {
-		if (rw == WRITE)
+		if (rw == WRITE && ret != -EIOCBQUEUED)
 			exfat_write_failed(mapping, size);
-
-		if (ret != -EIOCBQUEUED)
-			return ret;
+		return ret;
 	} else
 		size = pos + ret;

-- 
2.25.1