[BUG] drivers/misc: out-of-bounds in qp_memcpy_to_queue_iter()

[BUG] drivers/misc: out-of-bounds in qp_memcpy_to_queue_iter()

[co]

We found a bug reachable in:

    path    drivers/misc/vmw_vmci
    crash   out-of-bounds in qp_memcpy_to_queue_iter()
    commit  bd5f485f3f02 ("Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: co+9d44b184bc8f410d@bugs.sh

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/9d44b184bc8f410d/patch.diff
        report.md   https://bugs.sh/b/9d44b184bc8f410d/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@bugs.sh

== Environment =========================================================
    Reproduced on  bd5f485f3f02 ("Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc")
    VM setup       https://bugs.sh/b/9d44b184bc8f410d/run.sh
    config         https://bugs.sh/b/9d44b184bc8f410d/config.gz
    poc            https://bugs.sh/b/9d44b184bc8f410d/repro.c

== Sanitizer Report ====================================================
BUG: KASAN: slab-out-of-bounds in qp_memcpy_to_queue_iter.isra.0 (drivers/misc/vmw_vmci/vmci_queue_pair.c:348)
Read of size 8 at addr ffff888013c2c568 by task exploit/145
CPU: 0 UID: 0 PID: 145 Comm: exploit Not tainted 7.2.0+ #9 PREEMPTLAZY
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
qp_memcpy_to_queue_iter.isra.0 (drivers/misc/vmw_vmci/vmci_queue_pair.c:348)
vmci_qpair_enquev (drivers/misc/vmw_vmci/vmci_queue_pair.c:2573 drivers/misc/vmw_vmci/vmci_queue_pair.c:3049 drivers/misc/vmw_vmci/vmci_queue_pair.c:3036)
vmci_transport_stream_enqueue (net/vmw_vsock/vmci_transport.c:1866)
vsock_connectible_sendmsg (net/vmw_vsock/af_vsock.c:2305)
__sys_sendto (net/socket.c:800 (discriminator 1) net/socket.c:815 (discriminator 1) net/socket.c:2277 (discriminator 1))
__x64_sys_sendto (net/socket.c:2284 net/socket.c:2280 net/socket.c:2280)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@bugs.sh

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup

Re: [BUG] drivers/misc: out-of-bounds in qp_memcpy_to_queue_iter()

[Greg Kroah-Hartman]

On Thu, Aug 27, 2026 at 12:42:26PM +0000, co wrote:
> We found a bug reachable in:
> 
>     path    drivers/misc/vmw_vmci
>     crash   out-of-bounds in qp_memcpy_to_queue_iter()
>     commit  bd5f485f3f02 ("Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
> 
> Reported-by: co+9d44b184bc8f410d@bugs.sh
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
> 
>         patch.diff  https://bugs.sh/b/9d44b184bc8f410d/patch.diff
>         report.md   https://bugs.sh/b/9d44b184bc8f410d/report.md

Same here, please do not just send us random links, but rather patches
that you have verified work.

greg k-h