From: Kees Cook <keescook@chromium.org>
To: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>,
Sven Schnelle <svens@linux.ibm.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Christoph Hellwig <hch@infradead.org>,
linux-kernel@vger.kernel.org,
Linux-Next Mailing List <linux-next@vger.kernel.org>,
"viro@zeniv.linux.org.uk" <viro@zeniv.linux.org.uk>
Subject: Re: autofs crash with latest linux-next
Date: Thu, 15 Oct 2020 12:28:14 -0700 [thread overview]
Message-ID: <202010151226.7382E03@keescook> (raw)
In-Reply-To: <20201014071547.GA2459@kozik-lap>
On Wed, Oct 14, 2020 at 09:15:47AM +0200, Krzysztof Kozlowski wrote:
> I hit this since few days as well. Although the bisect points to the
> merge, the issue looks like a result of mentioned commit 4d03e3cc5982
> ("fs: don't allow kernel reads and writes without iter ops").
>
> The __kernel_read() last argument 'pos' can be NULL and it is
> dereferenced here (added by the commit):
>
> 525 ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos)
> ...
> 547 kiocb.ki_pos = *pos;
> 548 iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len);
>
>
> The __kernel_read() is called with NULL in fs/autofs/waitq.c:
>
> 45 static int autofs_write(struct autofs_sb_info *sbi,
> 46 struct file *file, const void *addr, int bytes)
>
> ...
> 54 mutex_lock(&sbi->pipe_mutex);
> 55 while (bytes) {
> 56 wr = __kernel_write(file, data, bytes, NULL);
I think the thread here is the same thing, but you've found it in
autofs...
https://lore.kernel.org/lkml/CAHk-=wgj=mKeN-EfV5tKwJNeHPLG0dybq+R5ZyGuc4WeUnqcmA@mail.gmail.com/
--
Kees Cook
next prev parent reply other threads:[~2020-10-15 19:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <yt9d1ri3nakg.fsf@linux.ibm.com>
2020-10-13 7:20 ` autofs crash with latest linux-next Christian Borntraeger
2020-10-14 7:15 ` Krzysztof Kozlowski
2020-10-15 19:28 ` Kees Cook [this message]
2020-10-15 19:58 ` Krzysztof Kozlowski
2020-10-16 5:44 ` Sven Schnelle
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202010151226.7382E03@keescook \
--to=keescook@chromium.org \
--cc=borntraeger@de.ibm.com \
--cc=hch@infradead.org \
--cc=krzk@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=svens@linux.ibm.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).