linux-kernel - Re: [PATCH] x86/mm: fix overflow in __cpa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <hhay4mkthnyyvgvhu3bzohtuyxiwny7i2ewq5gftmluidhioju@kwmnvkee4yha>
Date: Mon, 6 Oct 2025 12:58:04 +0100
From: Kiryl Shutsemau <kas@...nel.org>
To: Rik van Riel <riel@...riel.com>
Cc: syzbot <syzbot+afec6555eef563c66c97@...kaller.appspotmail.com>, 
	bp@...en8.de, dave.hansen@...ux.intel.com, hpa@...or.com, 
	kevin.brodsky@....com, linux-kernel@...r.kernel.org, luto@...nel.org, mingo@...hat.com, 
	peterz@...radead.org, rppt@...nel.org, syzkaller-bugs@...glegroups.com, 
	tglx@...utronix.de, wei.liu@...nel.org, x86@...nel.org, yu-cheng.yu@...el.com
Subject: Re: [PATCH] x86/mm: fix overflow in __cpa_addr

On Sun, Oct 05, 2025 at 11:48:05PM -0400, Rik van Riel wrote:
> On Sun, 05 Oct 2025 16:30:24 -0700
> syzbot <syzbot+afec6555eef563c66c97@...kaller.appspotmail.com> wrote:
> 
> 
> > ==================================================================
> > BUG: KASAN: slab-out-of-bounds in __cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline]
> > BUG: KASAN: slab-out-of-bounds in __cpa_addr+0x1d3/0x220 arch/x86/mm/pat/set_memory.c:306
> > Read of size 8 at addr ffff88801f75e8f8 by task syz.0.17/5978
> 
> This should fix it, unless syzbot finds an unexpected new way to
> torture things.
> 
> ---8<---
> From e32cd734444d9a95bb2d1067d934f33ab66f050b Mon Sep 17 00:00:00 2001
> From: Rik van Riel <riel@...riel.com>
> Date: Sun, 5 Oct 2025 23:32:48 -0400
> Subject: [PATCH] x86/mm: fix overflow in __cpa_addr
> 
> The change to have cpa_flush() call flush_kernel_pages() introduced
> a bug where __cpa_addr() can access an address one larger than the
> largest one in the cpa->pages array.
> 
> KASAN reports the issue like this:
> 
> BUG: KASAN: slab-out-of-bounds in __cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline]
> BUG: KASAN: slab-out-of-bounds in __cpa_addr+0x1d3/0x220 arch/x86/mm/pat/set_memory.c:306
> Read of size 8 at addr ffff88801f75e8f8 by task syz.0.17/5978
> 
> This bug could cause cpa_flush() to not properly flush memory,
> which somehow never showed any symptoms in my tests, possibly
> because cpa_flush() is called so rarely, but could potentially
> cause issues for other people.
> 
> Fix the issue by directly calculating the flush end address
> from the start address.
> 
> Signed-off-by: Rik van Riel <riel@...riel.com>
> Cc: stable@...nel.org
> Reported-by: syzbot+afec6555eef563c66c97@...kaller.appspotmail.com
> Fixes: 86e6815b316e ("x86/mm: Change cpa_flush() to call flush_kernel_range() directly")

Reviewed-by: Kiryl Shutsemau <kas@...nel.org>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov