From: Vlastimil Babka <vbabka@suse.cz>
To: Dan Carpenter <dan.carpenter@oracle.com>,
Andrew Morton <akpm@linux-foundation.org>,
Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
syzbot <syzbot+e64a13c5369a194d67df@syzkaller.appspotmail.com>,
aarcange@redhat.com, hughd@google.com, mhocko@suse.com,
syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk,
yang.shi@linux.alibaba.com
Subject: Re: [PATCH] mm/mempolicy.c: Fix out of bounds write in mpol_parse_str()
Date: Wed, 15 Jan 2020 13:54:34 +0100 [thread overview]
Message-ID: <d31f6069-bda7-2cdb-b770-0c9cddac7537@suse.cz> (raw)
In-Reply-To: <20200115055426.vdjwvry44nfug7yy@kili.mountain>
On 1/15/20 6:54 AM, Dan Carpenter wrote:
> What we are trying to do is change the '=' character to a NUL terminator
> and then at the end of the function we restore it back to an '='. The
> problem is there are two error paths where we jump to the end of the
> function before we have replaced the '=' with NUL. We end up putting
> the '=' in the wrong place (possibly one element before the start of
> the buffer).
Bleh.
> Reported-by: syzbot+e64a13c5369a194d67df@syzkaller.appspotmail.com
> Fixes: 095f1fc4ebf3 ("mempolicy: rework shmem mpol parsing and display")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
CC stable perhaps? Can this (tmpfs mount options parsing AFAICS?) become
part of unprivileged operation in some scenarios?
> ---
> mm/mempolicy.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 067cf7d3daf5..1340c5c496b5 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -2817,6 +2817,9 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
> char *flags = strchr(str, '=');
> int err = 1, mode;
>
> + if (flags)
> + *flags++ = '\0'; /* terminate mode string */
> +
> if (nodelist) {
> /* NUL-terminate mode or flags string */
> *nodelist++ = '\0';
> @@ -2827,9 +2830,6 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
> } else
> nodes_clear(nodes);
>
> - if (flags)
> - *flags++ = '\0'; /* terminate mode string */
> -
> mode = match_string(policy_modes, MPOL_MAX, str);
> if (mode < 0)
> goto out;
>
next prev parent reply other threads:[~2020-01-15 12:54 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-15 2:24 KASAN: slab-out-of-bounds Write in mpol_parse_str syzbot
2020-01-15 5:54 ` [PATCH] mm/mempolicy.c: Fix out of bounds write in mpol_parse_str() Dan Carpenter
2020-01-15 12:54 ` Vlastimil Babka [this message]
2020-01-15 12:57 ` Dmitry Vyukov
2020-01-15 15:03 ` Michal Hocko
2020-01-15 15:14 ` Dmitry Vyukov
2020-01-15 19:05 ` Michal Hocko
2020-01-16 5:41 ` Dmitry Vyukov
2020-01-16 7:39 ` Michal Hocko
2020-01-16 10:13 ` Dmitry Vyukov
2020-01-16 11:51 ` Michal Hocko
2020-01-16 12:41 ` Dmitry Vyukov
2020-01-16 14:05 ` Michal Hocko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d31f6069-bda7-2cdb-b770-0c9cddac7537@suse.cz \
--to=vbabka@suse.cz \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=dan.carpenter@oracle.com \
--cc=hughd@google.com \
--cc=lee.schermerhorn@hp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=syzbot+e64a13c5369a194d67df@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
--cc=yang.shi@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).