Received-SPF: pass (google.com: domain of linux-kernel+bounces-133468-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <48fe7b01-8cc4-477b-8f74-a5d662a76bfb@embeddedor.com>
Date: Fri, 5 Apr 2024 12:21:31 -0600
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [syzbot] [mm?] [hardening?] BUG: bad usercopy in do_handle_open
To: Andrew Morton <akpm@linux-foundation.org>,
 syzbot <syzbot+4372e026c95b0e36d0ee@syzkaller.appspotmail.com>
Cc: gustavoars@kernel.org, keescook@chromium.org,
 linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
 linux-mm@kvack.org, syzkaller-bugs@googlegroups.com,
 Aneesh Kumar <aneesh.kumar@kernel.org>
References: <000000000000b8974d06155cf3a2@google.com>
 <20240405110940.e787791b7d53aff7f216a168@linux-foundation.org>
Content-Language: en-US
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
In-Reply-To: <20240405110940.e787791b7d53aff7f216a168@linux-foundation.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit


>> usercopy: Kernel memory overwrite attempt detected to SLUB object 'kmalloc-16' (offset 8, size 9)!
> 
> We tried to copy 9 bytes into the f_handle[] array.
> 
> But from my reading of the reproducer, f_handle.handle_bytes was set to 1.
> 
> Aneesh, any thoughts on this?

This was previously reported:

https://lore.kernel.org/linux-nfs/tencent_A7845DD769577306D813742365E976E3A205@qq.com/

and it's fixed in linux-next already:

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=02426828cde24cd5b6cf5f30467cea085118f657

--
Gustavo