From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752601AbcBVQNo (ORCPT ); Mon, 22 Feb 2016 11:13:44 -0500 Received: from mx1.redhat.com ([209.132.183.28]:54608 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750832AbcBVQNn (ORCPT ); Mon, 22 Feb 2016 11:13:43 -0500 From: "Jerome Marchand" To: David Howells Cc: linux-kernel@vger.kernel.org Subject: [PATCH] assoc_array: don't call compare_object() on a node Date: Mon, 22 Feb 2016 17:13:40 +0100 Message-Id: <1456157620-20819-1-git-send-email-jmarchan@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In assoc_array_insert_into_terminal_node(), we call the compare_object() method on all empty slots, even when they're not leaves, passing a pointer to an unexpected structure to compare_object(). Currently it causes an out-of-bound read access in keyring_compare_object detected by KASan. The issue is easily reproduced with keyutils testsuite. Only call compare_object() when the slot is a leave. Signed-off-by: Jerome Marchand --- lib/assoc_array.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/assoc_array.c b/lib/assoc_array.c index 03dd576..59fd7c0 100644 --- a/lib/assoc_array.c +++ b/lib/assoc_array.c @@ -524,7 +524,9 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit, free_slot = i; continue; } - if (ops->compare_object(assoc_array_ptr_to_leaf(ptr), index_key)) { + if (assoc_array_ptr_is_leaf(ptr) && + ops->compare_object(assoc_array_ptr_to_leaf(ptr), + index_key)) { pr_devel("replace in slot %d\n", i); edit->leaf_p = &node->slots[i]; edit->dead_leaf = node->slots[i]; -- 2.5.0