Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] smackfs: restrict bytes count in smackfs write functions
To:     Casey Schaufler <casey@schaufler-ca.com>,
        Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Cc:     jmorris@namei.org, serge@hallyn.com, andreyknvl@google.com,
        linux-security-module@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        syzbot+a71a442385a0b2815497@syzkaller.appspotmail.com,
        Michal Hocko <mhocko@suse.com>
References: <20210124143627.582115-1-snovitoll@gmail.com>
 <3f33d3a2-c84c-081f-c1c4-424e5eeeb8d2@schaufler-ca.com>
From:   Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Message-ID: <3c35f7cc-1c8d-2fa0-6bc9-bde4e96017ce@i-love.sakura.ne.jp>
Date:   Tue, 26 Jan 2021 07:42:12 +0900
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.1
MIME-Version: 1.0
In-Reply-To: <3f33d3a2-c84c-081f-c1c4-424e5eeeb8d2@schaufler-ca.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2021/01/26 3:08, Casey Schaufler wrote:
> On 1/24/2021 6:36 AM, Sabyrzhan Tasbolatov wrote:
>> syzbot found WARNINGs in several smackfs write operations where
>> bytes count is passed to memdup_user_nul which exceeds
>> GFP MAX_ORDER. Check count size if bigger SMK_LONGLABEL,
>> for smk_write_syslog if bigger than PAGE_SIZE - 1.
>>
>> Reported-by: syzbot+a71a442385a0b2815497@syzkaller.appspotmail.com
>> Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
> 
> Thank you for the patch. Unfortunately, SMK_LONGLABEL isn't
> the right value in some of these cases. 
> 

Since it uses sscanf(), I think that whitespaces must be excluded from upper limit
check. I'm proposing adding __GFP_NOWARM on the memdup_user_nul() side at
https://lkml.kernel.org/r/20210120103436.11830-1-penguin-kernel@I-love.SAKURA.ne.jp .