lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <tencent_451BB425FBBAC7BB5833E59EA31B4D4B0708@qq.com>
Date: Wed, 30 Oct 2024 21:30:29 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+ec07f6f5ce62b858579f@...kaller.appspotmail.com
Cc: amir73il@...il.com,
	linux-kernel@...r.kernel.org,
	linux-unionfs@...r.kernel.org,
	miklos@...redi.hu,
	syzkaller-bugs@...glegroups.com
Subject: [PATCH] overlayfs: retry when getting the dentry fid fails due to lack of memory

Syzbot report a WARNING in ovl_encode_real_fh.
When the memory is insufficient, the allocation of fh fails, which causes
the failure to obtain the dentry fid, and finally causes the dentry encoding
to fail.
Retry is used to avoid the failure of fh allocation caused by temporary
insufficient memory.

Reported-and-tested-by: syzbot+ec07f6f5ce62b858579f@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ec07f6f5ce62b858579f
Signed-off-by: Edward Adam Davis <eadavis@...com>
---
 fs/overlayfs/copy_up.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 2ed6ad641a20..1e027a3cf084 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -423,15 +423,22 @@ struct ovl_fh *ovl_encode_real_fh(struct ovl_fs *ofs, struct dentry *real,
 	int fh_type, dwords;
 	int buflen = MAX_HANDLE_SZ;
 	uuid_t *uuid = &real->d_sb->s_uuid;
-	int err;
+	int err, rtt = 0;
 
 	/* Make sure the real fid stays 32bit aligned */
 	BUILD_BUG_ON(OVL_FH_FID_OFFSET % 4);
 	BUILD_BUG_ON(MAX_HANDLE_SZ + OVL_FH_FID_OFFSET > 255);
 
+retry:
 	fh = kzalloc(buflen + OVL_FH_FID_OFFSET, GFP_KERNEL);
-	if (!fh)
+	if (!fh) {
+		if (!rtt) {
+			cond_resched();
+			rtt++;
+			goto retry;
+		}
 		return ERR_PTR(-ENOMEM);
+	}
 
 	/*
 	 * We encode a non-connectable file handle for non-dir, because we
-- 
2.43.0


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ