[PATCH 1/1] psi: fix underflow in psi_write

[PATCH 1/1] psi: fix underflow in psi_write

[Yun Hsiang]

There is a stack-out-of-bounds write when running syzkaller test.

psi_write will perform a underflow write if nbytes received 0.
Fix this behavior by return -EINVAL when nbytes == 0.

Here is the KASAN log.
==================================================================
BUG: KASAN: stack-out-of-bounds in psi_write.part.9+0x128/0x270
Write of size 1 at addr ffffffc0e601fb7f by task syz-executor4/25565

CPU: 7 PID: 25565 Comm: syz-executor4 Tainted: G S      W  O    4.14.141+ #1
Call trace:
[<ffffff90080969e0>] dump_backtrace+0x0/0x828
[<ffffff9008097228>] show_stack+0x20/0x30
[<ffffff9009c5a040>] dump_stack+0xd0/0x120
[<ffffff9008411818>] print_address_description+0x68/0x4d0
[<ffffff9008411fa0>] kasan_report+0x1a0/0x3e8
[<ffffff900840fd14>] __asan_store1+0x4c/0x58
[<ffffff90081b44b0>] psi_write.part.9+0x128/0x270
[<ffffff90081b4660>] psi_memory_write+0x30/0x38
[<ffffff900852a220>] proc_reg_write+0xb8/0x108
[<ffffff900843e78c>] __vfs_write+0xdc/0x2d8
[<ffffff900843ec50>] vfs_write+0xe8/0x278
[<ffffff900843f150>] SyS_write+0xd0/0x1a8

Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
---
 kernel/sched/psi.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 6e52b67..ce89894 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1199,6 +1199,9 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf,
 		return -EOPNOTSUPP;
 
 	buf_size = min(nbytes, (sizeof(buf) - 1));
+	if (buf_size == 0)
+		return -EINVAL;
+
 	if (copy_from_user(buf, user_buf, buf_size))
 		return -EFAULT;
 
-- 
1.7.9.5
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek