linux-kernel - Re: [syzbot] [mm?] [hardening?] BUG: bad usercopy in do_handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <48fe7b01-8cc4-477b-8f74-a5d662a76bfb@embeddedor.com>
Date: Fri, 5 Apr 2024 12:21:31 -0600
From: "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To: Andrew Morton <akpm@...ux-foundation.org>,
 syzbot <syzbot+4372e026c95b0e36d0ee@...kaller.appspotmail.com>
Cc: gustavoars@...nel.org, keescook@...omium.org,
 linux-hardening@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-mm@...ck.org, syzkaller-bugs@...glegroups.com,
 Aneesh Kumar <aneesh.kumar@...nel.org>
Subject: Re: [syzbot] [mm?] [hardening?] BUG: bad usercopy in do_handle_open

>> usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-16' (offset 8, size 9)!
> 
> We tried to copy 9 bytes into the f_handle[] array.
> 
> But from my reading of the reproducer, f_handle.handle_bytes was set to 1.
> 
> Aneesh, any thoughts on this?

This was previously reported:

https://lore.kernel.org/linux-nfs/tencent_A7845DD769577306D813742365E976E3A205@qq.com/

and it's fixed in linux-next already:

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=02426828cde24cd5b6cf5f30467cea085118f657

--
Gustavo