From: "Serge E. Hallyn" <serge@hallyn.com>
To: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: syzbot <syzbot+9369930ca44f29e60e2d@syzkaller.appspotmail.com>,
"Serge E. Hallyn" <serge@hallyn.com>,
"Eric W. Biederman" <ebiederm@xmission.com>,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk
Subject: Re: KASAN: null-ptr-deref Read in xattr_getsecurity
Date: Tue, 10 Apr 2018 09:45:36 -0500 [thread overview]
Message-ID: <20180410144536.GA13386@mail.hallyn.com> (raw)
In-Reply-To: <9d192497-8b1e-ca8d-0ed8-b3324ee1e361@I-love.SAKURA.ne.jp>
On Tue, Apr 10, 2018 at 07:13:23PM +0900, Tetsuo Handa wrote:
> syzbot is reporting NULL pointer dereference at xattr_getsecurity() [1],
> for cap_inode_getsecurity() is returning sizeof(struct vfs_cap_data) when
> memory allocation failed. Return -ENOMEM if memory allocation failed.
>
> [1] https://syzkaller.appspot.com/bug?id=a55ba438506fe68649a5f50d2d82d56b365e0107
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Fixes: 8db6c34f1dbc8e06 ("Introduce v3 namespaced file capabilities")
> Reported-by: syzbot <syzbot+9369930ca44f29e60e2d@syzkaller.appspotmail.com>
> Cc: stable <stable@vger.kernel.org> # 4.14+
> Cc: Serge E. Hallyn <serge@hallyn.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
thanks!
-serge
> Cc: Eric W. Biederman <ebiederm@xmission.com>
> ---
> security/commoncap.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 48620c9..1ce701f 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
> magic |= VFS_CAP_FLAGS_EFFECTIVE;
> memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
> cap->magic_etc = cpu_to_le32(magic);
> + } else {
> + size = -ENOMEM;
> }
> }
> kfree(tmpbuf);
> --
> 1.8.3.1
prev parent reply other threads:[~2018-04-10 14:45 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-10 8:36 KASAN: null-ptr-deref Read in xattr_getsecurity syzbot
2018-04-10 10:13 ` Tetsuo Handa
2018-04-10 14:42 ` Eric W. Biederman
2018-04-10 14:48 ` Serge E. Hallyn
2018-04-10 21:00 ` Tetsuo Handa
2018-04-25 11:01 ` Tetsuo Handa
2018-04-10 23:20 ` James Morris
2018-04-10 14:45 ` Serge E. Hallyn [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180410144536.GA13386@mail.hallyn.com \
--to=serge@hallyn.com \
--cc=ebiederm@xmission.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=syzbot+9369930ca44f29e60e2d@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).