From: Salvatore Bonaccorso <carnil@debian.org>
To: David Rientjes <rientjes@google.com>
Cc: Daniel Axtens <dja@axtens.net>,
linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk,
ajd@linux.ibm.com, mpe@ellerman.id.au,
syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com,
syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com,
syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com,
syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com,
Guenter Roeck <linux@roeck-us.net>
Subject: Re: [PATCH v2] relay: handle alloc_percpu returning NULL in relay_open
Date: Thu, 21 May 2020 17:25:14 +0200 [thread overview]
Message-ID: <20200521152514.GA2868125@eldamar.local> (raw)
In-Reply-To: <alpine.DEB.2.21.1912201100400.68407@chino.kir.corp.google.com>
Hi,
On Fri, Dec 20, 2019 at 11:00:56AM -0800, David Rientjes wrote:
> On Thu, 19 Dec 2019, Daniel Axtens wrote:
>
> > alloc_percpu() may return NULL, which means chan->buf may be set to
> > NULL. In that case, when we do *per_cpu_ptr(chan->buf, ...), we
> > dereference an invalid pointer:
> >
> > BUG: Unable to handle kernel data access at 0x7dae0000
> > Faulting instruction address: 0xc0000000003f3fec
> > ...
> > NIP [c0000000003f3fec] relay_open+0x29c/0x600
> > LR [c0000000003f3fc0] relay_open+0x270/0x600
> > Call Trace:
> > [c000000054353a70] [c0000000003f3fb4] relay_open+0x264/0x600 (unreliable)
> > [c000000054353b00] [c000000000451764] __blk_trace_setup+0x254/0x600
> > [c000000054353bb0] [c000000000451b78] blk_trace_setup+0x68/0xa0
> > [c000000054353c10] [c0000000010da77c] sg_ioctl+0x7bc/0x2e80
> > [c000000054353cd0] [c000000000758cbc] do_vfs_ioctl+0x13c/0x1300
> > [c000000054353d90] [c000000000759f14] ksys_ioctl+0x94/0x130
> > [c000000054353de0] [c000000000759ff8] sys_ioctl+0x48/0xb0
> > [c000000054353e20] [c00000000000bcd0] system_call+0x5c/0x68
> >
> > Check if alloc_percpu returns NULL.
> >
> > This was found by syzkaller both on x86 and powerpc, and the reproducer
> > it found on powerpc is capable of hitting the issue as an unprivileged
> > user.
> >
> > Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers")
> > Reported-by: syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com
> > Reported-by: syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com
> > Reported-by: syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com
> > Reported-by: syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com
> > Cc: Akash Goel <akash.goel@intel.com>
> > Cc: Andrew Donnellan <ajd@linux.ibm.com> # syzkaller-ppc64
> > Reviewed-by: Michael Ellerman <mpe@ellerman.id.au>
> > Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
> > Cc: stable@vger.kernel.org # v4.10+
> > Signed-off-by: Daniel Axtens <dja@axtens.net>
>
> Acked-by: David Rientjes <rientjes@google.com>
It looks this one was never applied (which relates to CVE-2019-19462,
as pointed by Guenter in 20191223163610.GA32267@roeck-us.net).
Whas this lost or are there any issues pending?
Regards,
Salvatore
next prev parent reply other threads:[~2020-05-21 15:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-19 12:12 [PATCH v2] relay: handle alloc_percpu returning NULL in relay_open Daniel Axtens
2019-12-20 19:00 ` David Rientjes
2020-05-21 15:25 ` Salvatore Bonaccorso [this message]
2020-05-25 1:52 ` Daniel Axtens
2020-05-26 3:25 ` Michael Ellerman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200521152514.GA2868125@eldamar.local \
--to=carnil@debian.org \
--cc=ajd@linux.ibm.com \
--cc=dja@axtens.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=mpe@ellerman.id.au \
--cc=rientjes@google.com \
--cc=syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com \
--cc=syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com \
--cc=syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com \
--cc=syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.