linux-kernel - Re: [syzbot ci] Re: rust: zpool: add API for C and Rust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250923215929.GA1122379@cmpxchg.org>
Date: Tue, 23 Sep 2025 17:59:29 -0400
From: Johannes Weiner <hannes@...xchg.org>
To: syzbot ci <syzbot+cica6a1c285444b25f@...kaller.appspotmail.com>
Cc: a.hindborg@...nel.org, akpm@...ux-foundation.org, alex.gaynor@...il.com,
	aliceryhl@...gle.com, bjorn3_gh@...tonmail.com,
	boqun.feng@...il.com, chengming.zhou@...ux.dev, dakr@...nel.org,
	david@...hat.com, gary@...yguo.net, gregkh@...uxfoundation.org,
	liam.howlett@...cle.com, linux-kernel@...r.kernel.org,
	linux-mm@...ck.org, lorenzo.stoakes@...cle.com, lossin@...nel.org,
	mhocko@...e.com, minchan@...nel.org, nphamcs@...il.com,
	ojeda@...nel.org, rppt@...nel.org, rust-for-linux@...r.kernel.org,
	senozhatsky@...omium.org, surenb@...gle.com, tmgross@...ch.edu,
	vbabka@...e.cz, vitaly.wool@...sulko.se, yosry.ahmed@...ux.dev,
	syzbot@...ts.linux.dev, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot ci] Re: rust: zpool: add API for C and Rust

On Tue, Sep 23, 2025 at 09:50:10AM -0700, syzbot ci wrote:
> syzbot ci has tested the following series
> 
> [v6] rust: zpool: add API for C and Rust
> https://lore.kernel.org/all/20250923102547.2545992-1-vitaly.wool@konsulko.se
> * [PATCH v6 1/2] mm: reinstate zpool as a thin API
> * [PATCH v6 2/2] rust: zpool: add abstraction for zpool drivers
> 
> and found the following issues:
> * BUG: unable to handle kernel NULL pointer dereference in zswap_store
> * KASAN: slab-out-of-bounds Read in zpool_get_total_pages
> * KASAN: slab-out-of-bounds Read in zswap_store
> * KASAN: slab-use-after-free Read in zpool_get_total_pages
> * KASAN: use-after-free Read in zpool_get_total_pages
> 
> Full report is available here:
> https://ci.syzbot.org/series/e8b22352-ae56-4d7c-9113-75573acf2b64
> 
> ***
> 
> BUG: unable to handle kernel NULL pointer dereference in zswap_store

struct zpool {
	void *pool;
};

struct zpool *zpool_create_pool(const char *name) \
{ \
	return (struct zpool *) prefix ## _create_pool(name); \
} \

u64 zpool_get_total_pages(struct zpool *zpool) \
{ \
	return prefix ## _get_total_pages(zpool->pool); \
}

You create the zpool by simply casting the backend pool, but then you
deref it twice as if it were an actual container for the backend pool.

I'm guessing you didn't test this even superficially?

This also still proposes an API with no in-kernel user.

NAK