Received: by 2002:a25:31c3:0:0:0:0:0 with SMTP id x186csp527846ybx; Tue, 5 Nov 2019 01:15:45 -0800 (PST) X-Google-Smtp-Source: APXvYqwHzuEVqMDionOwzmIRNAvOTsIuHsbPn82kLxtMVMj2bwt5GscapFeyEpP+FlC8dlzVgYjO X-Received: by 2002:a17:906:79c9:: with SMTP id m9mr27601029ejo.297.1572945345103; Tue, 05 Nov 2019 01:15:45 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1572945345; cv=none; d=google.com; s=arc-20160816; b=cxsFB3kNLckxpcAzP1xtxkYWgGyVijSNQV76wPP7+3vJtDxCNd6/Kt4bT/pAbo4Y2y 9X1JjAy3DwI5I7v+IGT84/OMnMLw/TR3i6y5I8w8OZMMGjE6SZrtb3T/3rnr36teFlQc lHudajYB5bgX59c9edVje2qBHBtmcXdnc3oEHLIalZiK/eSw+PjPTkqs0y2O6g2Ytgg8 dUqcetZBfGu8dXpKhFGk4ZcP4p6SXaqPKLElNQDXzPa9Cpwp9Z4SWO19x+/gW8wlJjBb Ichk/u/+MbtXEGudoG7/Ju7NITi4r6YLciZ4S5grSrYhZ/OXPxuX6wtSY3q1W2OSrLSP JBiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:autocrypt:from:references:cc:to:subject; bh=8afJflpQHdlMffmxhwLm5wD2IqXhvLBuz6PQFQi/S/k=; b=EZBurYXN1oKX8wBX+HsPyzR58XeNboXpVJZhN382x2jJqqwcZh8p5igp8WTPHVn/92 dyuzHnoqrk5gULgkAaeb9bJZY4TaatrM7ncOkTdUnATrcnwEXt4h/m2W3ihTpC0fisOQ eNx7Qewom2ckgxEm2nikQo54wUV1puHtissp0fK+NPCiOotjz62b8ZzS75m3hDXHAfyE KibxsOatnIZmMpflEjyb0/FwyGScJ+moyhpKHJGIhmQIq7dPH7VbsLSxf5TiTMRL6gEm lzeFmRrrJ4Rr+ZtHVAbnxGG1NSoPE9zKWiud3DNRbZwz3VGRY8mOab/GTQXLcdkqCtMJ wLjA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n2si11089476ejz.65.2019.11.05.01.15.20; Tue, 05 Nov 2019 01:15:45 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730640AbfKEJOH (ORCPT + 99 others); Tue, 5 Nov 2019 04:14:07 -0500 Received: from mail-wr1-f45.google.com ([209.85.221.45]:35593 "EHLO mail-wr1-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730499AbfKEJOG (ORCPT ); Tue, 5 Nov 2019 04:14:06 -0500 Received: by mail-wr1-f45.google.com with SMTP id l10so20395791wrb.2 for ; Tue, 05 Nov 2019 01:14:04 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=8afJflpQHdlMffmxhwLm5wD2IqXhvLBuz6PQFQi/S/k=; b=PqSZHqUmCQe2fWR0EEOTi3wlAV5MXxhyfOjGklXIHqWtr7WvyhYV3gVn///tXSCM57 9rg7WzT3Q+WVJw6JLlrac146iRszLkMPouODdLm6Bku7fDNQ7zgp7KHkWKn0b5fdi+3G Gd5J5e1xz1cNGJvv39D33BOEHso6jUnF7xw7Mm8viMBUHwgwNbZePzyYoyV2fz1skJAt 8bi5KnOokxs+r6I8p2AY2lCFIq4CiYLTW8IppnBqGmhWD/o2KG7JTwwgZLXolPZSuwKp IYdy/Y18gw4KlFofZb3yOCCCb6mVp/PE4zXSedch466qhENNEIDrWe+YxWZmghdSryZu Mo1Q== X-Gm-Message-State: APjAAAVypgbHexI2Zv7zaWZFXCoNH7F69bc4qHj2w1ivG7bpyFrQe5tO wHY+A2S8pqF7s9+cb2l8DJI= X-Received: by 2002:adf:c105:: with SMTP id r5mr27364773wre.125.1572945244062; Tue, 05 Nov 2019 01:14:04 -0800 (PST) Received: from ?IPv6:2a0b:e7c0:0:107::49? ([2a0b:e7c0:0:107::49]) by smtp.gmail.com with ESMTPSA id l2sm18527867wrt.15.2019.11.05.01.14.02 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 05 Nov 2019 01:14:03 -0800 (PST) Subject: Re: Bug report - slab-out-of-bounds in vcs_scr_readw To: Or Cohen Cc: Nicolas Pitre , Greg KH , textshell@uchuujin.de, Daniel Vetter , sam@ravnborg.org, mpatocka@redhat.com, ghalat@redhat.com, linux-kernel@vger.kernel.org, jwilk@jwilk.net, Nadav Markus , syzkaller@googlegroups.com References: <20191104152428.GA2252441@kroah.com> From: Jiri Slaby Autocrypt: addr=jslaby@suse.com; prefer-encrypt=mutual; keydata= mQINBE6S54YBEACzzjLwDUbU5elY4GTg/NdotjA0jyyJtYI86wdKraekbNE0bC4zV+ryvH4j rrcDwGs6tFVrAHvdHeIdI07s1iIx5R/ndcHwt4fvI8CL5PzPmn5J+h0WERR5rFprRh6axhOk rSD5CwQl19fm4AJCS6A9GJtOoiLpWn2/IbogPc71jQVrupZYYx51rAaHZ0D2KYK/uhfc6neJ i0WqPlbtIlIrpvWxckucNu6ZwXjFY0f3qIRg3Vqh5QxPkojGsq9tXVFVLEkSVz6FoqCHrUTx wr+aw6qqQVgvT/McQtsI0S66uIkQjzPUrgAEtWUv76rM4ekqL9stHyvTGw0Fjsualwb0Gwdx ReTZzMgheAyoy/umIOKrSEpWouVoBt5FFSZUyjuDdlPPYyPav+hpI6ggmCTld3u2hyiHji2H cDpcLM2LMhlHBipu80s9anNeZhCANDhbC5E+NZmuwgzHBcan8WC7xsPXPaiZSIm7TKaVoOcL 9tE5aN3jQmIlrT7ZUX52Ff/hSdx/JKDP3YMNtt4B0cH6ejIjtqTd+Ge8sSttsnNM0CQUkXps w98jwz+Lxw/bKMr3NSnnFpUZaxwji3BC9vYyxKMAwNelBCHEgS/OAa3EJoTfuYOK6wT6nadm YqYjwYbZE5V/SwzMbpWu7Jwlvuwyfo5mh7w5iMfnZE+vHFwp/wARAQABtBxKaXJpIFNsYWJ5 IDxqc2xhYnlAc3VzZS5jb20+iQI4BBMBAgAiBQJOkujrAhsDBgsJCAcDAgYVCAIJCgsEFgID AQIeAQIXgAAKCRC9JbEEBrRwSc1VD/9CxnyCYkBrzTfbi/F3/tTstr3cYOuQlpmufoEjCIXx PNnBVzP7XWPaHIUpp5tcweG6HNmHgnaJScMHHyG83nNAoCEPihyZC2ANQjgyOcnzDOnW2Gzf 8v34FDQqj8CgHulD5noYBrzYRAss6K42yUxUGHOFI1Ky1602OCBRtyJrMihio0gNuC1lE4YZ juGZEU6MYO1jKn8QwGNpNKz/oBs7YboU7bxNTgKrxX61cSJuknhB+7rHOQJSXdY02Tt31R8G diot+1lO/SoB47Y0Bex7WGTXe13gZvSyJkhZa5llWI/2d/s1aq5pgrpMDpTisIpmxFx2OEkb jM95kLOs/J8bzostEoEJGDL4u8XxoLnOEjWyT82eKkAe4j7IGQlA9QQR2hCMsBdvZ/EoqTcd SqZSOto9eLQkjZLz0BmeYIL8SPkgnVAJ/FEK44NrHUGzjzdkE7a0jNvHt8ztw6S+gACVpysi QYo2OH8hZGaajtJ8mrgN2Lxg7CpQ0F6t/N1aa/+A2FwdRw5sHBqA4PH8s0Apqu66Q94YFzzu 8OWkSPLgTjtyZcez79EQt02u8xH8dikk7API/PYOY+462qqbahpRGaYdvloaw7tOQJ224pWJ 4xePwtGyj4raAeczOcBQbKKW6hSH9iz7E5XUdpJqO3iZ9psILk5XoyO53wwhsLgGcrkCDQRO kueGARAAz5wNYsv5a9z1wuEDY5dn+Aya7s1tgqN+2HVTI64F3l6Yg753hF8UzTZcVMi3gzHC ECvKGwpBBwDiJA2V2RvJ6+Jis8paMtONFdPlwPaWlbOv4nHuZfsidXkk7PVCr4/6clZggGNQ qEjTe7Hz2nnwJiKXbhmnKfYXlxftT6KdjyUkgHAs8Gdz1nQCf8NWdQ4P7TAhxhWdkAoOIhc4 OQapODd+FnBtuL4oCG0c8UzZ8bDZVNR/rYgfNX54FKdqbM84FzVewlgpGjcUc14u5Lx/jBR7 ttZv07ro88Ur9GR6o1fpqSQUF/1V+tnWtMQoDIna6p/UQjWiVicQ2Tj7TQgFr4Fq8ZDxRb10 Zbeds+t+45XlRS9uexJDCPrulJ2sFCqKWvk3/kf3PtUINDR2G4k228NKVN/aJQUGqCTeyaWf fU9RiJU+sw/RXiNrSL2q079MHTWtN9PJdNG2rPneo7l0axiKWIk7lpSaHyzBWmi2Arj/nuHf Maxpc708aCecB2p4pUhNoVMtjUhKD4+1vgqiWKI6OsEyZBRIlW2RRcysIwJ648MYejvf1dzv mVweUa4zfIQH/+G0qPKmtst4t/XLjE/JN54XnOD/TO1Fk0pmJyASbHJQ0EcecEodDHPWP6bM fQeNlm1eMa7YosnXwbTurR+nPZk+TYPndbDf1U0j8n0AEQEAAYkCHwQYAQIACQUCTpLnhgIb DAAKCRC9JbEEBrRwSTe1EACA74MWlvIhrhGWd+lxbXsB+elmL1VHn7Ovj3qfaMf/WV3BE79L 5A1IDyp0AGoxv1YjgE1qgA2ByDQBLjb0yrS1ppYqQCOSQYBPuYPVDk+IuvTpj/4rN2v3R5RW d6ozZNRBBsr4qHsnCYZWtEY2pCsOT6BE28qcbAU15ORMq0nQ/yNh3s/WBlv0XCP1gvGOGf+x UiE2YQEsGgjs8v719sguok8eADBbfmumerh/8RhPKRuTWxrXdNq/pu0n7hA6Btx7NYjBnnD8 lV8Qlb0lencEUBXNFDmdWussMAlnxjmKhZyb30m1IgjFfG30UloZzUGCyLkr/53JMovAswmC IHNtXHwb58Ikn1i2U049aFso+WtDz4BjnYBqCL1Y2F7pd8l2HmDqm2I4gubffSaRHiBbqcSB lXIjJOrd6Q66u5+1Yv32qk/nOL542syYtFDH2J5wM2AWvfjZH1tMOVvVMu5Fv7+0n3x/9shY ivRypCapDfcWBGGsbX5eaXpRfInaMTGaU7wmWO44Z5diHpmQgTLOrN9/MEtdkK6OVhAMVenI w1UnZnA+ZfaZYShi5oFTQk3vAz7/NaA5/bNHCES4PcDZw7Y/GiIh/JQR8H1JKZ99or9LjFeg HrC8YQ1nzkeDfsLtYM11oC3peHa5AiXLmCuSC9ammQ3LhkfET6N42xTu2A== Message-ID: Date: Tue, 5 Nov 2019 10:14:01 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.1.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 05. 11. 19, 10:03, Or Cohen wrote: > @Nicolas Pitre - I agree with you, "vcs_size" may return a negative > error code, so the patch is correct but as @jslaby@suse.com said it > won't fix the issue. > In my debugging session, "vcs_size" returns a positive integer ( 8000 > decimal ) and the bug still triggers. > > Maybe it's related to the following logic in "vcs_size"? ( not sure > about that.. ) > > 221 if (use_attributes(inode)) { > 222 if (use_unicode(inode)) > 223 return -EOPNOTSUPP; > 224 size = 2*size + HEADER_SIZE; > 225 } else if (use_unicode(inode)) > 226 size *= 4; > 227 return size; > > Why in the case of "use_unicode(inode)" size is multiplied by 4 and > not 2? ( as we can see in line 224 ) Because unicode uses 4 bytes. The issue is that there is no handling for unicode in vcs_write at all. (Compare with vcs_read.) thanks, -- js suse labs