Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <000000000000b2585a05fdeb8379@google.com>
References: <000000000000b2585a05fdeb8379@google.com>
To:     syzbot <syzbot+6efc50cc1f8d718d6cb7@syzkaller.appspotmail.com>
Cc:     dhowells@redhat.com, davem@davemloft.net,
        herbert@gondor.apana.org.au, kuba@kernel.org,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [crypto?] KASAN: slab-out-of-bounds Read in extract_iter_to_sg
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <256754.1686844894.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Thu, 15 Jun 2023 17:01:34 +0100
Message-ID: <256755.1686844894@warthog.procyon.org.uk>
Precedence: bulk

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.g=
it main


diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 38d2265c77fd..e97abe6055a1 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4333,8 +4333,7 @@ static void *smb2_get_aead_req(struct crypto_aead *t=
fm, struct smb_rqst *rqst,
 		}
 		sgtable.orig_nents =3D sgtable.nents;
 =

-		rc =3D extract_iter_to_sg(iter, count, &sgtable,
-					num_sgs - sgtable.nents, 0);
+		rc =3D extract_iter_to_sg(iter, count, &sgtable, num_sgs, 0);
 		iov_iter_revert(iter, rc);
 		sgtable.orig_nents =3D sgtable.nents;
 	}
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index e97d7060329e..6fd20bfc01a4 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -1120,7 +1120,8 @@ static ssize_t extract_user_to_sg(struct iov_iter *i=
ter,
 	pages -=3D sg_max;
 =

 	do {
-		res =3D iov_iter_extract_pages(iter, &pages, maxsize, sg_max,
+		res =3D iov_iter_extract_pages(iter, &pages, maxsize,
+					     sg_max - sgtable->nents,
 					     extraction_flags, &off);
 		if (res < 0)
 			goto failed;
@@ -1129,7 +1130,6 @@ static ssize_t extract_user_to_sg(struct iov_iter *i=
ter,
 		maxsize -=3D len;
 		ret +=3D len;
 		npages =3D DIV_ROUND_UP(off + len, PAGE_SIZE);
-		sg_max -=3D npages;
 =

 		for (; npages > 0; npages--) {
 			struct page *page =3D *pages;
@@ -1142,7 +1142,7 @@ static ssize_t extract_user_to_sg(struct iov_iter *i=
ter,
 			len -=3D seg;
 			off =3D 0;
 		}
-	} while (maxsize > 0 && sg_max > 0);
+	} while (maxsize > 0 && sgtable->nents < sg_max);
 =

 	return ret;
 =

@@ -1183,11 +1183,10 @@ static ssize_t extract_bvec_to_sg(struct iov_iter =
*iter,
 		sg_set_page(sg, bv[i].bv_page, len, off);
 		sgtable->nents++;
 		sg++;
-		sg_max--;
 =

 		ret +=3D len;
 		maxsize -=3D len;
-		if (maxsize <=3D 0 || sg_max =3D=3D 0)
+		if (maxsize <=3D 0 || sgtable->nents >=3D sg_max)
 			break;
 		start =3D 0;
 	}
@@ -1242,14 +1241,13 @@ static ssize_t extract_kvec_to_sg(struct iov_iter =
*iter,
 			sg_set_page(sg, page, len, off);
 			sgtable->nents++;
 			sg++;
-			sg_max--;
 =

 			len -=3D seg;
 			kaddr +=3D PAGE_SIZE;
 			off =3D 0;
-		} while (len > 0 && sg_max > 0);
+		} while (len > 0 && sgtable->nents < sg_max);
 =

-		if (maxsize <=3D 0 || sg_max =3D=3D 0)
+		if (maxsize <=3D 0 || sgtable->nents >=3D sg_max)
 			break;
 		start =3D 0;
 	}
@@ -1294,11 +1292,10 @@ static ssize_t extract_xarray_to_sg(struct iov_ite=
r *iter,
 		sg_set_page(sg, folio_page(folio, 0), len, offset);
 		sgtable->nents++;
 		sg++;
-		sg_max--;
 =

 		maxsize -=3D len;
 		ret +=3D len;
-		if (maxsize <=3D 0 || sg_max =3D=3D 0)
+		if (maxsize <=3D 0 || sgtable->nents >=3D sg_max)
 			break;
 	}
 =

@@ -1318,7 +1315,8 @@ static ssize_t extract_xarray_to_sg(struct iov_iter =
*iter,
  *
  * Extract the page fragments from the given amount of the source iterato=
r and
  * add them to a scatterlist that refers to all of those bits, to a maxim=
um
- * addition of @sg_max elements.
+ * addition of @sg_max elements.  @sgtable->nents indicates how many of t=
he
+ * elements are already used.
  *
  * The pages referred to by UBUF- and IOVEC-type iterators are extracted =
and
  * pinned; BVEC-, KVEC- and XARRAY-type are extracted but aren't pinned; =
PIPE-
@@ -1343,6 +1341,11 @@ ssize_t extract_iter_to_sg(struct iov_iter *iter, s=
ize_t maxsize,
 	if (maxsize =3D=3D 0)
 		return 0;
 =

+	if (WARN_ON_ONCE(sg_max =3D=3D 0))
+		return -EIO;
+	if (WARN_ON_ONCE(sgtable->nents >=3D sg_max))
+		return -EIO;
+
 	switch (iov_iter_type(iter)) {
 	case ITER_UBUF:
 	case ITER_IOVEC: