netdev - [PATCH 0/3 v2] 9p: Fix write overflow in p9_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221117091159.31533-1-guozihua@huawei.com>
Date:   Thu, 17 Nov 2022 17:11:56 +0800
From:   GUO Zihua <guozihua@...wei.com>
To:     <ericvh@...il.com>, <lucho@...kov.net>, <asmadeus@...ewreck.org>,
        <linux_oss@...debyte.com>
CC:     <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
        <pabeni@...hat.com>, <v9fs-developer@...ts.sourceforge.net>,
        <netdev@...r.kernel.org>
Subject: [PATCH 0/3 v2] 9p: Fix write overflow in p9_read_work

This patchset fixes the write overflow issue in p9_read_work. As well as
some follow up cleanups.

BUG: KASAN: slab-out-of-bounds in _copy_to_iter+0xd35/0x1190
Write of size 4043 at addr ffff888008724eb1 by task kworker/1:1/24

CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 6.1.0-rc5-00002-g1adf73218daa-dirty #223
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
Workqueue: events p9_read_work
Call Trace:
 <TASK>
 dump_stack_lvl+0x4c/0x64
 print_report+0x178/0x4b0
 kasan_report+0xae/0x130
 kasan_check_range+0x179/0x1e0
 memcpy+0x38/0x60
 _copy_to_iter+0xd35/0x1190
 copy_page_to_iter+0x1d5/0xb00
 pipe_read+0x3a1/0xd90
 __kernel_read+0x2a5/0x760
 kernel_read+0x47/0x60
 p9_read_work+0x463/0x780
 process_one_work+0x91d/0x1300
 worker_thread+0x8c/0x1210
 kthread+0x280/0x330
 ret_from_fork+0x22/0x30
 </TASK>

GUO Zihua (3):
  9p: Fix write overflow in p9_read_work
  9p: Remove redundent checks for message size against msize.
  9p: Use P9_HDRSZ for header size

 net/9p/trans_fd.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

---

v2:
  Addition log for debugging similar issues, as well as cleanups according to
  Dominique's comment.
-- 
2.17.1