linux-kernel - Re: [syzbot] [netfs?] KASAN: slab-out-of-bounds Read in iov_iter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2705414.1747435079@warthog.procyon.org.uk>
Date: Fri, 16 May 2025 23:37:59 +0100
From: David Howells <dhowells@...hat.com>
To: syzbot <syzbot+25b83a6f2c702075fcbc@...kaller.appspotmail.com>
Cc: dhowells@...hat.com, linux-fsdevel@...r.kernel.org,
    linux-kernel@...r.kernel.org, netfs@...ts.linux.dev,
    pc@...guebit.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [netfs?] KASAN: slab-out-of-bounds Read in iov_iter_revert

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.15-rc6

commit 4f771b49180c404f518c686cdff749ff81f3cc77
Author: David Howells <dhowells@...hat.com>
Date:   Fri May 16 23:35:25 2025 +0100

    netfs: Fix oops in write-retry from mis-resetting the subreq iterator

diff --git a/fs/netfs/write_retry.c b/fs/netfs/write_retry.c
index f75e0e8c02cf..9d1d8a8bab72 100644
--- a/fs/netfs/write_retry.c
+++ b/fs/netfs/write_retry.c
@@ -39,9 +39,10 @@ static void netfs_retry_write_stream(struct netfs_io_request *wreq,
 			if (test_bit(NETFS_SREQ_FAILED, &subreq->flags))
 				break;
 			if (__test_and_clear_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
-				struct iov_iter source = subreq->io_iter;
+				struct iov_iter source;
 
-				iov_iter_revert(&source, subreq->len - source.count);
+				netfs_reset_iter(subreq);
+				source = subreq->io_iter;
 				netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
 				netfs_reissue_write(stream, subreq, &source);
 			}