From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 605F0C33CB2 for ; Wed, 15 Jan 2020 12:58:01 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1F3642073A for ; Wed, 15 Jan 2020 12:58:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="PFod3waq" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1F3642073A Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id B2BD68E000B; Wed, 15 Jan 2020 07:58:00 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id ADDE68E0005; Wed, 15 Jan 2020 07:58:00 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9F31E8E000B; Wed, 15 Jan 2020 07:58:00 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0041.hostedemail.com [216.40.44.41]) by kanga.kvack.org (Postfix) with ESMTP id 8F8528E0005 for ; Wed, 15 Jan 2020 07:58:00 -0500 (EST) Received: from smtpin01.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 56C84180AD81D for ; Wed, 15 Jan 2020 12:58:00 +0000 (UTC) X-FDA: 76379871120.01.war64_b9f9bec51b43 X-HE-Tag: war64_b9f9bec51b43 X-Filterd-Recvd-Size: 5580 Received: from mail-qt1-f196.google.com (mail-qt1-f196.google.com [209.85.160.196]) by imf41.hostedemail.com (Postfix) with ESMTP for ; Wed, 15 Jan 2020 12:57:59 +0000 (UTC) Received: by mail-qt1-f196.google.com with SMTP id e5so15626442qtm.6 for ; Wed, 15 Jan 2020 04:57:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XnuqtyCo79ecJMDcqIdYLzfy9F7O3a3eKV+Q3SmZ78k=; b=PFod3waqugMfHQRbo87NKarrvygRIbjaiMI3JhwZ/2oZCsaWWlGnbzJtNUUq/ak1S7 vM/Fo7dSxllwaprj6ECNwLX1W6imNrWBzR7ihtPtpKZ8Sruj2Nfc0XW6iWCtQ1+Uvtlk JI8iJYLBGJUud8Ke207loe1bfQzUUiCz9cCCsyN5MrUSGgkp7wFwxoLrM37w0IrqgIWm d+ckvHqqqVJWJ+ukdPr0Wmb3ucKREsjBgftNfoGJAca4vckWCQwAZCyPM79pDsG+EpJP BxVDXHNLZ5WK2QC177Zqv774RaS5GKE83th6Q9TdNPazW/cqueP+dea9VSULEs9pXWAO b32A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XnuqtyCo79ecJMDcqIdYLzfy9F7O3a3eKV+Q3SmZ78k=; b=UOVY5GLPB0+w7/w/i+qh8fTHmVGcJ9zb60bYXCV1wMjHHshn9U7klthyFuYiwVBOnT ZnRqzcPIuASpzF+8snqjpwQKWp/gP9iF6AqKJe3izdlqf3syKXImF58EI3+m0jnIDP9r j1fdEgp/4ev5WTP7pVPg2m+/fCx32/Ir+0Y3TF8waTGaEgHfhZV229lyLlvR3VB2H9eV 5xkdVKf1E5rA8oOJHhyh5cDkESg7Skij8h0uUZ3dxEROz266GhEb6aO3RsNETsM5Op/B 2HQIBmwB6hGwqbZGacBcDCnsuofzIoNi33LzCSgPRMaEF4qUWzk5C3+o41Bncl1fXotx jp0A== X-Gm-Message-State: APjAAAWL+a8g4jEIP6o/UIPGkujxtezOXTwomALODAIy06HUaZiIiG7p sY3PDTsCjSOeKiMvPDB+X+xo0926uXo2pM5qu2UKqQ== X-Google-Smtp-Source: APXvYqy3nhpgs6g7ApU9pKVNQYLycYgaxhat1ufBVvJXS6nM+pKjtXlT676RDuHYzS2q2HLqCT1ubDcr9bVajL5UVO0= X-Received: by 2002:ac8:24c1:: with SMTP id t1mr3316465qtt.257.1579093078944; Wed, 15 Jan 2020 04:57:58 -0800 (PST) MIME-Version: 1.0 References: <20200115055426.vdjwvry44nfug7yy@kili.mountain> In-Reply-To: From: Dmitry Vyukov Date: Wed, 15 Jan 2020 13:57:47 +0100 Message-ID: Subject: Re: [PATCH] mm/mempolicy.c: Fix out of bounds write in mpol_parse_str() To: Vlastimil Babka Cc: Dan Carpenter , Andrew Morton , Lee Schermerhorn , Linux-MM , LKML , syzbot , Andrea Arcangeli , Hugh Dickins , Michal Hocko , syzkaller-bugs , Al Viro , yang.shi@linux.alibaba.com Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Jan 15, 2020 at 1:54 PM Vlastimil Babka wrote: > > On 1/15/20 6:54 AM, Dan Carpenter wrote: > > What we are trying to do is change the '=' character to a NUL terminator > > and then at the end of the function we restore it back to an '='. The > > problem is there are two error paths where we jump to the end of the > > function before we have replaced the '=' with NUL. We end up putting > > the '=' in the wrong place (possibly one element before the start of > > the buffer). > > Bleh. > > > Reported-by: syzbot+e64a13c5369a194d67df@syzkaller.appspotmail.com > > Fixes: 095f1fc4ebf3 ("mempolicy: rework shmem mpol parsing and display") > > Signed-off-by: Dan Carpenter > > Acked-by: Vlastimil Babka > > CC stable perhaps? Can this (tmpfs mount options parsing AFAICS?) become > part of unprivileged operation in some scenarios? Yes, tmpfs can be mounted by any user inside of a user namespace. Also I suspect there are cases where an unprivileged attacker can trick some utility to mount tmpfs on their behalf and provide their own mount options. > > --- > > mm/mempolicy.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/mm/mempolicy.c b/mm/mempolicy.c > > index 067cf7d3daf5..1340c5c496b5 100644 > > --- a/mm/mempolicy.c > > +++ b/mm/mempolicy.c > > @@ -2817,6 +2817,9 @@ int mpol_parse_str(char *str, struct mempolicy **mpol) > > char *flags = strchr(str, '='); > > int err = 1, mode; > > > > + if (flags) > > + *flags++ = '\0'; /* terminate mode string */ > > + > > if (nodelist) { > > /* NUL-terminate mode or flags string */ > > *nodelist++ = '\0'; > > @@ -2827,9 +2830,6 @@ int mpol_parse_str(char *str, struct mempolicy **mpol) > > } else > > nodes_clear(nodes); > > > > - if (flags) > > - *flags++ = '\0'; /* terminate mode string */ > > - > > mode = match_string(policy_modes, MPOL_MAX, str); > > if (mode < 0) > > goto out; > > > > -- > You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. > To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/d31f6069-bda7-2cdb-b770-0c9cddac7537%40suse.cz.