From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-252.mail.qq.com (out162-62-57-252.mail.qq.com [162.62.57.252]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A08013C3CD for ; Sun, 22 Dec 2024 08:19:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.252 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734855564; cv=none; b=IRg3EDTluTJvTBkGGwodrEL4/6i0bXD/poh6FTFOHSQApIP7nzSklpZ7sXjMScNfcDQXNZSlUcfLUZALEbJO8Vht7vxbih0g2MF7On7w+jHQY571xMfDoLSoo8wKXBeJCGW4KuJUYyVo9YmeYaPYAf7Nxmw47AbFOBGlUw5NNvA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734855564; c=relaxed/simple; bh=yF8H5eRRAOXlxu64GcnTXJhZyzEj/TBExFrm4UTE4Ho=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=Rgnfm80fCMtZBY1Pjyy45MAdk81AdCZz1WNuIMHk5Te9DHY9uOUVtoTforNcVwSNhuSFSYNnLZTxlTO0r1E0o1JgyfCtslSPkHPbpJVUJNYfwE/zeSzgd4oR1RBZnvMvym2DdakbZ1+Ka9s2f4Ulej5UOnRYbnzZvo9WQxZ4WBQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=ruu/6Vr/; arc=none smtp.client-ip=162.62.57.252 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="ruu/6Vr/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1734855255; bh=xB95No6N2Rb5qFB07m4/4mCZKui3DjL9fk4jkVayjQk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ruu/6Vr/kXClyKKYnuL3FxnOr2bmPDwy74amfyBCHFWeMcJJUB8xsN1d39ZDmt37+ 5mgYE4yImwih+kgKIqbzksyGriFXtcEte0prT372ocpyelrhrK00BR5o/oaDBc0d8Q epzgIDn2NrFMTik/0d/Rei9aWR88aVlyc15C/EgA= Received: from pek-lxu-l1.wrs.com ([114.244.57.34]) by newxmesmtplogicsvrszb20-0.qq.com (NewEsmtp) with SMTP id 38C9BAAD; Sun, 22 Dec 2024 16:14:12 +0800 X-QQ-mid: xmsmtpt1734855252tbrnrhpd6 Message-ID: X-QQ-XMAILINFO: MYcyYH/A/+tCVyhrAvQdJpd/ibIY6jGfqqA9bQQe6eIYWq/1Wy+dYfWqujROXu TX0uwnG0EH0RPtF9Eus7n0m9Bvwtp3MxaV8TRTa4W0rm9kiPhD4unnA/GFuOTvtf6oQV68XBnGkL 8vm26KWUkX1w6i0ERvPFbXPWYaR5fUe0+doW5C+dNQmoUutjWym9bSS4r5vCrQ2IldeNqyCI1bKE qD63PeRQmbMUaWhoIU4LM9E2d1Z20WJjrEZ4mGFzndMuJY0mE72tF3paGeR9/FF0HIjdVEo8w6NC 0XlpxEIoKvScVS5Ef/epqnXHAa7deyWzvXWF8qCYyM/hOxX3W/pERZFQTO1l3/8EnXTqYb7OmVT9 xhS6JXgJb6AS+LfqvCEuzoNRFcUmOw9xSBWW9jNu/Xy+0vQdFq+7p0hlILKRJSQ8yXIj9Rgly8Rh iKonI8ilDNQv6COG+c+qxo4PViA1VQF5U14aNBzaU5bt6/jEYOQU6CIaXo41epKEYs5+WOfZEFN0 YdIE5o47JoTYmD56SJrStkP3dWUhuAH7AE506ZA+2P62OAenozAgmWGDx7DcjXPDk+/swNeb5r86 YZT2PZlxm8YyXRcMjGP8aRuu5gDuGlfxkOFOgmZlZJfycJlFJSfgRVMzhEba9TwVVOzuUQsftI/R 5Mhbg9ubUQ7KahfHQg0FLdphiEdM5eEkWEo6Ow2i+9uMoTgh4ZbdXo1mIkNIKyPEhrkNbEZ1wbMZ k/ZrM88yZ4WHrM2u46dNlsYFCs9KBamiCzANwp12OS9QMBOjpQfXMm/u9aMj8uRdbtGUNdcRZ3Dm jypLUJZTnRZ/rKVfRLYY4wmDUvxJqYqF8bxQ5e/7F+V0orSigo2AwZqiFo47TvOe4HxY/NB7hXVW ntPM3Hl4dTfUXQmr0wdFLQ4/QMKo6gTg== X-QQ-XMRINFO: NI4Ajvh11aEj8Xl/2s1/T8w= From: Edward Adam Davis To: syzbot+fc519d7875f2d9186c1f@syzkaller.appspotmail.com Cc: devel@lists.orangefs.org, hubcap@omnibond.com, linux-kernel@vger.kernel.org, martin@omnibond.com, syzkaller-bugs@googlegroups.com Subject: [PATCH] orangefs: fix a oob in orangefs_debug_write Date: Sun, 22 Dec 2024 16:14:13 +0800 X-OQ-MSGID: <20241222081412.1630315-2-eadavis@qq.com> X-Mailer: git-send-email 2.47.0 In-Reply-To: <6767aabc.050a0220.25abdd.0136.GAE@google.com> References: <6767aabc.050a0220.25abdd.0136.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit syzbot report a slab-out-of-bounds Read in orangefs_debug_write. [1] The string passed in from userspace is not terminated with a NULL character, which causes strlen to go out of bounds. Use kstrndup to replace kstrdup. [1] BUG: KASAN: slab-out-of-bounds in strlen+0x93/0xa0 lib/string.c:413 Read of size 1 at addr ffff88814d695800 by task syz-executor153/5822 CPU: 0 UID: 0 PID: 5822 Comm: syz-executor153 Not tainted 6.13.0-rc3-syzkaller-00026-g59dbb9d81adf #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 strlen+0x93/0xa0 lib/string.c:413 kstrdup+0x29/0xb0 mm/util.c:81 debug_string_to_mask+0x82/0x570 fs/orangefs/orangefs-debugfs.c:836 orangefs_debug_write+0x22e/0x780 fs/orangefs/orangefs-debugfs.c:423 full_proxy_write+0xfb/0x1b0 fs/debugfs/file.c:356 vfs_write+0x24c/0x1150 fs/read_write.c:677 ksys_write+0x12b/0x250 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: syzbot+fc519d7875f2d9186c1f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fc519d7875f2d9186c1f Tested-by: syzbot+fc519d7875f2d9186c1f@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis --- fs/orangefs/orangefs-debugfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..c2637c966e52 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -833,7 +833,9 @@ static void debug_string_to_mask(char *debug_string, void *mask, int type) { char *unchecked_keyword; int i; - char *strsep_fodder = kstrdup(debug_string, GFP_KERNEL); + char *strsep_fodder = kstrndup(debug_string, + ORANGEFS_MAX_DEBUG_STRING_LEN, + GFP_KERNEL); char *original_pointer; int element_count = 0; struct client_debug_mask *c_mask = NULL; -- 2.47.0