| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20251223092932.0a804e046fc2e5de236ced69@linux-foundation.org>
Date: Tue, 23 Dec 2025 09:29:32 -0800
From: Andrew Morton <akpm@...ux-foundation.org>
To: Jinchao Wang <wangjinchao600@...il.com>
Cc: Song Liu <song@...nel.org>, Jiri Olsa <jolsa@...nel.org>, Alexei
Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau
<martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>, Yonghong Song
<yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, KP
Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>, Hao Luo
<haoluo@...gle.com>, linux-kernel@...r.kernel.org, bpf@...r.kernel.org,
syzbot+e008db2ac01e282550ee@...kaller.appspotmail.com, Axel Rasmussen
<axelrasmussen@...gle.com>, David Hildenbrand (Red Hat) <david@...nel.org>,
Johannes Weiner <hannes@...xchg.org>, Lorenzo Stoakes
<lorenzo.stoakes@...cle.com>, Michal Hocko <mhocko@...nel.org>, Qi Zheng
<zhengqi.arch@...edance.com>, Shakeel Butt <shakeel.butt@...ux.dev>, Wei Xu
<weixugc@...gle.com>, Yuanchu Xie <yuanchu@...gle.com>, Andrii Nakryiko
<andrii@...nel.org>, Eduard Zingerman <eddyz87@...il.com>, Omar Sandoval
<osandov@...com>, Deepanshu Kartikey <kartikey406@...il.com>, Alexei
Starovoitov <ast@...nel.org>, Daniel Borkman <daniel@...earbox.net>, Hao
Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>, John Fastabend
<john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>, Martin KaFai Lau
<martin.lau@...ux.dev>, Song Liu <song@...nel.org>, Stanislav Fomichev
<sdf@...ichev.me>, Yonghong Song <yonghong.song@...ux.dev>
Subject: Re: [PATCH] buildid: validate page-backed file before parsing build
ID
On Tue, 23 Dec 2025 18:32:07 +0800 Jinchao Wang <wangjinchao600@...il.com> wrote:
> __build_id_parse() only works on page-backed storage. Its helper paths
> eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs
> that do not map a regular file or lack valid address_space operations.
>
> Reported-by: syzbot+e008db2ac01e282550ee@...kaller.appspotmail.com
> Signed-off-by: Jinchao Wang <wangjinchao600@...il.com>
>
> ...
>
> --- a/lib/buildid.c
> +++ b/lib/buildid.c
> @@ -280,7 +280,10 @@ static int __build_id_parse(struct vm_area_struct *vma, unsigned char *build_id,
> int ret;
>
> /* only works for page backed storage */
> - if (!vma->vm_file)
> + if (!vma->vm_file ||
> + !S_ISREG(file_inode(vma->vm_file)->i_mode) ||
> + !vma->vm_file->f_mapping->a_ops ||
> + !vma->vm_file->f_mapping->a_ops->read_folio)
> return -EINVAL;
>
> freader_init_from_file(&r, buf, sizeof(buf), vma->vm_file, may_fault);
Thanks. Seems this one needs additional paperwork.
I added the below:
Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API")
Tested-by: <syzbot+e008db2ac01e282550ee@...kaller.appspotmail.com>
Link: https://lkml.kernel.org/r/694a67ab.050a0220.19928e.001c.GAE@google.com
Closes: https://lkml.kernel.org/r/693540fe.a70a0220.38f243.004c.GAE@google.com
Cc: <stable@...r.kernel.org>
and a large number of cc's which I scraped together from various
emails.
Could people please eyeball all of this and verify that everything is
good?
From: Jinchao Wang <wangjinchao600@...il.com>
Subject: buildid: validate page-backed file before parsing build ID
Date: Tue, 23 Dec 2025 18:32:07 +0800
__build_id_parse() only works on page-backed storage. Its helper paths
eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs
that do not map a regular file or lack valid address_space operations.
Link: https://lkml.kernel.org/r/20251223103214.2412446-1-wangjinchao600@gmail.com
Fixes: ad41251c290d ("lib/buildid: implement sleepable build_id_parse() API")
Signed-off-by: Jinchao Wang <wangjinchao600@...il.com>
Reported-by: <syzbot+e008db2ac01e282550ee@...kaller.appspotmail.com>
Tested-by: <syzbot+e008db2ac01e282550ee@...kaller.appspotmail.com>
Link: https://lkml.kernel.org/r/694a67ab.050a0220.19928e.001c.GAE@google.com
Closes: https://lkml.kernel.org/r/693540fe.a70a0220.38f243.004c.GAE@google.com
Cc: Axel Rasmussen <axelrasmussen@...gle.com>
Cc: David Hildenbrand (Red Hat) <david@...nel.org>
Cc: Johannes Weiner <hannes@...xchg.org>
Cc: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
Cc: Michal Hocko <mhocko@...nel.org>
Cc: Qi Zheng <zhengqi.arch@...edance.com>
Cc: Shakeel Butt <shakeel.butt@...ux.dev>
Cc: Wei Xu <weixugc@...gle.com>
Cc: Yuanchu Xie <yuanchu@...gle.com>
Cc: Andrii Nakryiko <andrii@...nel.org>
Cc: Eduard Zingerman <eddyz87@...il.com>
Cc: Omar Sandoval <osandov@...com>
Cc: Deepanshu Kartikey <kartikey406@...il.com>
Cc: Alexei Starovoitov <ast@...nel.org>
Cc: Daniel Borkman <daniel@...earbox.net>
Cc: Hao Luo <haoluo@...gle.com>
Cc: Jiri Olsa <jolsa@...nel.org>
Cc: John Fastabend <john.fastabend@...il.com>
Cc: KP Singh <kpsingh@...nel.org>
Cc: Martin KaFai Lau <martin.lau@...ux.dev>
Cc: Song Liu <song@...nel.org>
Cc: Stanislav Fomichev <sdf@...ichev.me>
Cc: Yonghong Song <yonghong.song@...ux.dev>
Cc: <stable@...r.kernel.org>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---
lib/buildid.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/lib/buildid.c~buildid-validate-page-backed-file-before-parsing-build-id
+++ a/lib/buildid.c
@@ -288,7 +288,10 @@ static int __build_id_parse(struct vm_ar
int ret;
/* only works for page backed storage */
- if (!vma->vm_file)
+ if (!vma->vm_file ||
+ !S_ISREG(file_inode(vma->vm_file)->i_mode) ||
+ !vma->vm_file->f_mapping->a_ops ||
+ !vma->vm_file->f_mapping->a_ops->read_folio)
return -EINVAL;
freader_init_from_file(&r, buf, sizeof(buf), vma->vm_file, may_fault);
_
Powered by blists - more mailing lists