Received-SPF: pass (google.com: domain of linux-nfs+bounces-2610-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <tencent_A7845DD769577306D813742365E976E3A205@qq.com>
From: Edward Adam Davis <eadavis@qq.com>
To: syzbot+4139435cb1b34cf759c2@syzkaller.appspotmail.com
Cc: amir73il@gmail.com,
	brauner@kernel.org,
	chuck.lever@oracle.com,
	jack@suse.cz,
	jlayton@kernel.org,
	linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	linux-nfs@vger.kernel.org,
	syzkaller-bugs@googlegroups.com,
	viro@zeniv.linux.org.uk
Subject: [PATCH next] fs: fix oob in do_handle_open
Date: Wed,  3 Apr 2024 14:54:14 +0800
In-Reply-To: <000000000000f075b9061520cbbe@google.com>
References: <000000000000f075b9061520cbbe@google.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

[Syzbot reported]
BUG: KASAN: slab-out-of-bounds in instrument_copy_from_user_before include/linux/instrumented.h:129 [inline]
BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x7b/0xe0 lib/usercopy.c:22
Write of size 48 at addr ffff88802b8cbc88 by task syz-executor333/5090

CPU: 0 PID: 5090 Comm: syz-executor333 Not tainted 6.9.0-rc2-next-20240402-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_copy_from_user_before include/linux/instrumented.h:129 [inline]
 _copy_from_user+0x7b/0xe0 lib/usercopy.c:22
 copy_from_user include/linux/uaccess.h:183 [inline]
 handle_to_path fs/fhandle.c:203 [inline]
 do_handle_open+0x204/0x660 fs/fhandle.c:226
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x72/0x7a
[Fix] 
When copying data to f_handle, the length of the copied data should not include
the length of "struct file_handle".

Reported-by: syzbot+4139435cb1b34cf759c2@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/fhandle.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fhandle.c b/fs/fhandle.c
index 53ed54711cd2..8a7f86c2139a 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -202,7 +202,7 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
 	*handle = f_handle;
 	if (copy_from_user(&handle->f_handle,
 			   &ufh->f_handle,
-			   struct_size(ufh, f_handle, f_handle.handle_bytes))) {
+			   f_handle.handle_bytes)) {
 		retval = -EFAULT;
 		goto out_handle;
 	}
-- 
2.43.0