linux-kernel - Re: [syzbot] [fuse?] KASAN: slab-out-of-bounds Write in fuse_dev_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJnrk1Y1UJ54+4kjHvfJvjh2Dp1J_vVJVGmqfh04zoRFDQy04w@mail.gmail.com>
Date: Fri, 22 Aug 2025 18:13:41 -0700
From: Joanne Koong <joannelkoong@...il.com>
To: syzbot <syzbot+2d215d165f9354b9c4ea@...kaller.appspotmail.com>
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, 
	miklos@...redi.hu, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [fuse?] KASAN: slab-out-of-bounds Write in fuse_dev_do_write

On Fri, Aug 22, 2025 at 5:55 PM syzbot
<syzbot+2d215d165f9354b9c4ea@...kaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
>
> failed to apply patch:
> checking file fs/fuse/dev.c
> patch: **** unexpected end of file in patch
>
>
>
> Tested on:
>
> commit:         cf6fc5ee Merge tag 's390-6.17-3' of git://git.kernel.o..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> kernel config:  https://syzkaller.appspot.com/x/.config?x=b7511150b112b9c3
> dashboard link: https://syzkaller.appspot.com/bug?extid=2d215d165f9354b9c4ea
> compiler:
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=116eaa34580000
>

#syz test: upstream cf6fc5eefc5bbbbff92a085039ff74cdbd065c29

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index e80cd8f2c049..e84e05de9cdb 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1893,7 +1893,7 @@ static int fuse_retrieve(struct fuse_mount *fm,
struct inode *inode,

        index = outarg->offset >> PAGE_SHIFT;

-       while (num) {
+       while (num && num_pages) {
                struct folio *folio;
                unsigned int folio_offset;
                unsigned int nr_bytes;
@@ -1914,6 +1914,7 @@ static int fuse_retrieve(struct fuse_mount *fm,
struct inode *inode,

                offset = 0;
                num -= nr_bytes;
+               num_pages -= nr_pages;
                total_len += nr_bytes;
                index += nr_pages;
        }
--
2.47.3