From: Krzysztof Kozlowski <krzk@kernel.org>
To: Kees Cook <keescook@chromium.org>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>,
Sven Schnelle <svens@linux.ibm.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Christoph Hellwig <hch@infradead.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Linux-Next Mailing List <linux-next@vger.kernel.org>,
"viro@zeniv.linux.org.uk" <viro@zeniv.linux.org.uk>
Subject: Re: autofs crash with latest linux-next
Date: Thu, 15 Oct 2020 21:58:37 +0200 [thread overview]
Message-ID: <CAJKOXPd6nDi6x+iZ8jke-7qFb=DDjnStkQS9=0PfTZExA7i6jQ@mail.gmail.com> (raw)
In-Reply-To: <202010151226.7382E03@keescook>
On Thu, 15 Oct 2020 at 21:28, Kees Cook <keescook@chromium.org> wrote:
>
> On Wed, Oct 14, 2020 at 09:15:47AM +0200, Krzysztof Kozlowski wrote:
> > I hit this since few days as well. Although the bisect points to the
> > merge, the issue looks like a result of mentioned commit 4d03e3cc5982
> > ("fs: don't allow kernel reads and writes without iter ops").
> >
> > The __kernel_read() last argument 'pos' can be NULL and it is
> > dereferenced here (added by the commit):
> >
> > 525 ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos)
> > ...
> > 547 kiocb.ki_pos = *pos;
> > 548 iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len);
> >
> >
> > The __kernel_read() is called with NULL in fs/autofs/waitq.c:
> >
> > 45 static int autofs_write(struct autofs_sb_info *sbi,
> > 46 struct file *file, const void *addr, int bytes)
> >
> > ...
> > 54 mutex_lock(&sbi->pipe_mutex);
> > 55 while (bytes) {
> > 56 wr = __kernel_write(file, data, bytes, NULL);
>
> I think the thread here is the same thing, but you've found it in
> autofs...
> https://lore.kernel.org/lkml/CAHk-=wgj=mKeN-EfV5tKwJNeHPLG0dybq+R5ZyGuc4WeUnqcmA@mail.gmail.com/
Indeed it looks the same. Thanks for the pointer.
Best regards,
Krzysztof
next prev parent reply other threads:[~2020-10-15 19:58 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <yt9d1ri3nakg.fsf@linux.ibm.com>
2020-10-13 7:20 ` autofs crash with latest linux-next Christian Borntraeger
2020-10-14 7:15 ` Krzysztof Kozlowski
2020-10-15 19:28 ` Kees Cook
2020-10-15 19:58 ` Krzysztof Kozlowski [this message]
2020-10-16 5:44 ` Sven Schnelle
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJKOXPd6nDi6x+iZ8jke-7qFb=DDjnStkQS9=0PfTZExA7i6jQ@mail.gmail.com' \
--to=krzk@kernel.org \
--cc=borntraeger@de.ibm.com \
--cc=hch@infradead.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=svens@linux.ibm.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).