linux-kernel - Re: [syzbot ci] Re: rust: zpool: add API for C and Rust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKEwX=P18Krj-+rXvTSCocRt+Q3o07Ghisv4nJLRCJ8tLus54Q@mail.gmail.com>
Date: Wed, 24 Sep 2025 10:38:11 -0700
From: Nhat Pham <nphamcs@...il.com>
To: Vitaly Wool <vitaly.wool@...sulko.se>
Cc: Johannes Weiner <hannes@...xchg.org>, 
	syzbot ci <syzbot+cica6a1c285444b25f@...kaller.appspotmail.com>, a.hindborg@...nel.org, 
	akpm@...ux-foundation.org, alex.gaynor@...il.com, aliceryhl@...gle.com, 
	bjorn3_gh@...tonmail.com, boqun.feng@...il.com, chengming.zhou@...ux.dev, 
	dakr@...nel.org, david@...hat.com, gary@...yguo.net, 
	gregkh@...uxfoundation.org, liam.howlett@...cle.com, 
	linux-kernel@...r.kernel.org, linux-mm@...ck.org, lorenzo.stoakes@...cle.com, 
	lossin@...nel.org, mhocko@...e.com, minchan@...nel.org, ojeda@...nel.org, 
	rppt@...nel.org, rust-for-linux@...r.kernel.org, senozhatsky@...omium.org, 
	surenb@...gle.com, tmgross@...ch.edu, vbabka@...e.cz, yosry.ahmed@...ux.dev, 
	syzbot@...ts.linux.dev, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot ci] Re: rust: zpool: add API for C and Rust

On Tue, Sep 23, 2025 at 10:46 PM Vitaly Wool <vitaly.wool@...sulko.se> wrote:
>
>
>
> On 9/23/25 23:59, Johannes Weiner wrote:
> > On Tue, Sep 23, 2025 at 09:50:10AM -0700, syzbot ci wrote:
> >> syzbot ci has tested the following series
> >>
> >> [v6] rust: zpool: add API for C and Rust
> >> https://lore.kernel.org/all/20250923102547.2545992-1-vitaly.wool@konsulko.se
> >> * [PATCH v6 1/2] mm: reinstate zpool as a thin API
> >> * [PATCH v6 2/2] rust: zpool: add abstraction for zpool drivers
> >>
> >> and found the following issues:
> >> * BUG: unable to handle kernel NULL pointer dereference in zswap_store
> >> * KASAN: slab-out-of-bounds Read in zpool_get_total_pages
> >> * KASAN: slab-out-of-bounds Read in zswap_store
> >> * KASAN: slab-use-after-free Read in zpool_get_total_pages
> >> * KASAN: use-after-free Read in zpool_get_total_pages
> >>
> >> Full report is available here:
> >> https://ci.syzbot.org/series/e8b22352-ae56-4d7c-9113-75573acf2b64
> >>
> >> ***
> >>
> >> BUG: unable to handle kernel NULL pointer dereference in zswap_store
> >
> > struct zpool {
> >       void *pool;
> > };
> >
> > struct zpool *zpool_create_pool(const char *name) \
> > { \
> >       return (struct zpool *) prefix ## _create_pool(name); \
> > } \
> >
> > u64 zpool_get_total_pages(struct zpool *zpool) \
> > { \
> >       return prefix ## _get_total_pages(zpool->pool); \
> > }
> >
> > You create the zpool by simply casting the backend pool, but then you
> > deref it twice as if it were an actual container for the backend pool.
> >
> > I'm guessing you didn't test this even superficially?
>
> LOL, no, forgot to run git commit --amend so came up with a wrong version.
>
> The Rust version is correct though.
>
> > This also still proposes an API with no in-kernel user.
>
> That's not correct, zsmalloc is the user.

A single user does not an API make.