netdev - Re: [syzbot] KASAN: slab-out-of-bounds Write in copy_verifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 06 Feb 2023 12:31:17 -0800
From:   syzbot <syzbot+59af7bf76d795311da8c@...kaller.appspotmail.com>
To:     andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
        daniel@...earbox.net, davem@...emloft.net, haoluo@...gle.com,
        hawk@...nel.org, john.fastabend@...il.com, jolsa@...nel.org,
        keescook@...omium.org, kpsingh@...nel.org, kuba@...nel.org,
        linux-kernel@...r.kernel.org, llvm@...ts.linux.dev,
        martin.lau@...ux.dev, nathan@...nel.org, ndesaulniers@...gle.com,
        netdev@...r.kernel.org, sdf@...gle.com, song@...nel.org,
        syzkaller-bugs@...glegroups.com, trix@...hat.com, v4bel@...ori.io,
        yhs@...com
Subject: Re: [syzbot] KASAN: slab-out-of-bounds Write in copy_verifier_state

syzbot suspects this issue was fixed by commit:

commit 45435d8da71f9f3e6860e6e6ea9667b6ec17ec64
Author: Kees Cook <keescook@...omium.org>
Date:   Fri Dec 23 18:28:44 2022 +0000

    bpf: Always use maximal size for copy_array()

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=14c62f23480000
start commit:   041fae9c105a Merge tag 'f2fs-for-6.2-rc1' of git://git.ker..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=e2f3d9d232a3cac5
dashboard link: https://syzkaller.appspot.com/bug?extid=59af7bf76d795311da8c
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1650d477880000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1305f993880000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: bpf: Always use maximal size for copy_array()

For information about bisection process see: https://goo.gl/tpsmEJ#bisection