From: Dan Carpenter <dan.carpenter@oracle.com>
To: Andy Lutomirski <luto@kernel.org>
Cc: syzbot <syzbot+cd66e43794b178bb5cd6@syzkaller.appspotmail.com>,
Borislav Petkov <bp@alien8.de>, "H. Peter Anvin" <hpa@zytor.com>,
LKML <linux-kernel@vger.kernel.org>,
Ingo Molnar <mingo@redhat.com>,
syzkaller-bugs@googlegroups.com,
Thomas Gleixner <tglx@linutronix.de>, X86 ML <x86@kernel.org>
Subject: Re: general protection fault in syscall_return_slowpath
Date: Thu, 12 Mar 2020 16:34:42 +0300 [thread overview]
Message-ID: <20200312133442.GH11561@kadam> (raw)
In-Reply-To: <CALCETrV-wMcO8eqzzQX1Jh20Zn-mEkYpQbd+cfCdcgV+AYsaKA@mail.gmail.com>
On Sun, Mar 08, 2020 at 09:29:04AM -0700, Andy Lutomirski wrote:
> On Sat, Mar 7, 2020 at 11:45 PM syzbot
> <syzbot+cd66e43794b178bb5cd6@syzkaller.appspotmail.com> wrote:
> >
> > Hello,
> >
> > syzbot found the following crash on:
> >
> > HEAD commit: 63623fd4 Merge tag 'for-linus' of git://git.kernel.org/pub..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=16cfeac3e00000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=5d2e033af114153f
> > dashboard link: https://syzkaller.appspot.com/bug?extid=cd66e43794b178bb5cd6
> > compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12a42329e00000
> >
>
> I bet this is due to entirely missing input validation in
> con_font_copy() and/or fbcon_copy_font().
The only thing we use in con_font_copy() is op->height and we clamp it
to 0-MAX_NR_CONSOLES (64).
regards,
dan carpenter
next prev parent reply other threads:[~2020-03-12 13:35 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-08 7:45 general protection fault in syscall_return_slowpath syzbot
2020-03-08 16:13 ` Andy Lutomirski
2020-03-08 16:37 ` Borislav Petkov
2020-03-08 18:26 ` Thomas Gleixner
2020-03-09 8:34 ` Dmitry Vyukov
2020-03-09 18:26 ` Eric Biggers
2020-03-10 5:41 ` Dmitry Vyukov
2020-03-09 8:42 ` Dmitry Vyukov
2020-03-08 16:29 ` Andy Lutomirski
2020-03-12 13:34 ` Dan Carpenter [this message]
2020-03-08 17:20 ` Jann Horn
2020-03-08 18:00 ` syzbot
2020-03-08 18:35 ` Jann Horn
2020-03-08 21:57 ` syzbot
2020-03-09 8:20 ` Dmitry Vyukov
2020-03-10 6:15 ` Nathan Chancellor
2020-03-10 8:10 ` Dmitry Vyukov
2020-06-14 8:03 ` Dmitry Vyukov
2020-06-15 7:57 ` Jann Horn
2020-08-15 10:18 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200312133442.GH11561@kadam \
--to=dan.carpenter@oracle.com \
--cc=bp@alien8.de \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=syzbot+cd66e43794b178bb5cd6@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).