netdev - Re: [PATCH 0/3 v2] 9p: Fix write overflow in p9_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Nov 2022 14:33:28 +0100
From:   Christian Schoenebeck <linux_oss@...debyte.com>
To:     ericvh@...il.com, lucho@...kov.net, asmadeus@...ewreck.org,
        GUO Zihua <guozihua@...wei.com>
Cc:     davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        pabeni@...hat.com, v9fs-developer@...ts.sourceforge.net,
        netdev@...r.kernel.org
Subject: Re: [PATCH 0/3 v2] 9p: Fix write overflow in p9_read_work

On Thursday, November 17, 2022 10:11:56 AM CET GUO Zihua wrote:
> This patchset fixes the write overflow issue in p9_read_work. As well as
> some follow up cleanups.
> 
> BUG: KASAN: slab-out-of-bounds in _copy_to_iter+0xd35/0x1190
> Write of size 4043 at addr ffff888008724eb1 by task kworker/1:1/24
> 
> CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 6.1.0-rc5-00002-g1adf73218daa-dirty #223
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
> Workqueue: events p9_read_work
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x4c/0x64
>  print_report+0x178/0x4b0
>  kasan_report+0xae/0x130
>  kasan_check_range+0x179/0x1e0
>  memcpy+0x38/0x60
>  _copy_to_iter+0xd35/0x1190
>  copy_page_to_iter+0x1d5/0xb00
>  pipe_read+0x3a1/0xd90
>  __kernel_read+0x2a5/0x760
>  kernel_read+0x47/0x60
>  p9_read_work+0x463/0x780
>  process_one_work+0x91d/0x1300
>  worker_thread+0x8c/0x1210
>  kthread+0x280/0x330
>  ret_from_fork+0x22/0x30
>  </TASK>
> 
> GUO Zihua (3):
>   9p: Fix write overflow in p9_read_work
>   9p: Remove redundent checks for message size against msize.
>   9p: Use P9_HDRSZ for header size

For entire series:

Reviewed-by: Christian Schoenebeck <linux_oss@...debyte.com>

I agree with Dominique that patch 1 and 2 should be merged.

>  net/9p/trans_fd.c | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)
> 
> ---
> 
> v2:
>   Addition log for debugging similar issues, as well as cleanups according to
>   Dominique's comment.
>