From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-239.mail.qq.com (out203-205-221-239.mail.qq.com [203.205.221.239]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6BCE42DEA94 for ; Wed, 7 Jan 2026 08:49:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.239 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767775751; cv=none; b=PPZALUcIbTWZjeRadS448gd5MicLYGj1FZK2pOn+dlEschowF4IrhST236q0UlG1mMLDQVNfN0iI5YPUr3SHnzvXkY9Saf7rWDNXTAor67BQvA9MtJ48xlVjNRQTJVjzOvLgm59Hd+MlrQhDLxABszqjrK+n5DdXHFAJ04augjQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767775751; c=relaxed/simple; bh=DmcRFnqs9JXNDrAxPz/FsllUTJNkJ89MrcBYwr89huQ=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=riN4HzL7XHC7Vkjbl7wfGA6H+orth+voeyZVWi5I50oF/8dARV/rnYfOeA1iDyl2/qxz3fIIaIpecKr0MDD9wBHgTInVDHh80MvLytMqNqmjRYhV6gOpCwFa0sesj9KxpcEASdyS2xTpXE8AV5BbV7yxBrjNoFQGsN3rBXpxuvE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=Ta+QZKrR; arc=none smtp.client-ip=203.205.221.239 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="Ta+QZKrR" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1767775738; bh=7YiNAAYVnE6piFRsCxy7OD6dzQ9vIBERzHo4fbUVhNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Ta+QZKrRNJPKi+d3bdRsO5eKES/Q9mWo9QWKDsA4jO/h7zbKobaS61CVBC/lvLYM7 Yfz5Hlqd5kAuLiwevAwNT5Op6BNtx/e6zqSgJu2iwGFClapKM/c7BdlbHIIuIRNQTA UskVE4EmAnVKQpbROwtP7596Wk2kjNhvYd30ivWk= Received: from lxu-ped-host.. ([114.244.57.24]) by newxmesmtplogicsvrszb43-0.qq.com (NewEsmtp) with SMTP id BEE0ACDA; Wed, 07 Jan 2026 16:47:46 +0800 X-QQ-mid: xmsmtpt1767775666tqk0oyciz Message-ID: X-QQ-XMAILINFO: MRXuj24L2Pnq4+4W9uaRzVGe7z6NyAGkjFWRAYtrFqHIcXkmKgqgHdz1Lc4AiA +vVnuYkkqFUj5FMeE/65R+gkQAzokL0yQNF2XxyZCuNd9Hr/lIJcUmBA6FvvuXC9NLr0Nn11x0x1 o/E1Cqshi00L6fNlhVP9Uy0LHlWmYnWPKqzmVlavbFLdWaJMFUGrPa+lADqitrm5QN3ISdoLqSOu 5ay7kihM2rVPAGHCoylHWL3++Lji496Z7Ux92lfy7h50Z9yTfJR6/5d9VoHR2lFBDArdZagoVQc0 hdFo7IOE2xuwFQbaXnqtJSKmrK32nM+L2xZyfZTxciVI/GJb2nkr+yCdOAArJslrnUFuEgbyiuxk 90U4uapdGUhxNDD3Ky6QTbp4DbColiPdKNzMSbCksYrwKbJsM0sGti8qWJXiGyoumDE4wZVU0Vf1 0VfduFBKuIXnsbyhnfKy/380Q1KLrJdqY2Job3CpCAf9aeQ90oJgGzOK7WYR6XnAblqMy1Rs5dda h6frevGMvUO+JV2HMzny4yVNo6jZR5GDUTNwK27bZ4Y6WX+TG58/s7krJZVQmW/LJqXt1hbOTKUJ gwlRYT3Uox1FCQcEl0wOtEWnXb4oYVaJk4x6PORTDVhVaYDfqeFLmhnFDLU/RFhj7qgqLblKUtUg zRrqPho5IEtpFnqhdhd8ExsIBQIMXnyQpBBEUR2c93FNBi/Aa9nW60tQiGLzOlJHpwIFxXaXlt4G nDw2cRnRRyqpL2WvgyNm2w44Ou0dq35cdUXcikEyRAK5F/ke8qFla9LmXOz0v9n15sekMfH4Kaez Ae4woBtcNRXolsnana08RzkUZF5FBsBDRwho41yJp/cmqRBsQcblLl6rsPcuZENqPOb/ZDeqCbef D9rlFij58jBi1xli3BZHh7/PIgD6AMGzPuh5tckeL19iWs5isqlTfe7tHpOrNFwfPkKegY57qWTP /3vkwnuieF144zmLTQUZvPLEjogK3ojQFNn2EV6i65g7UN7Ypsbg== X-QQ-XMRINFO: OWPUhxQsoeAVwkVaQIEGSKwwgKCxK/fD5g== From: Edward Adam Davis To: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr Date: Wed, 7 Jan 2026 16:47:46 +0800 X-OQ-MSGID: <20260107084745.469659-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <695bc686.050a0220.1c677c.032f.GAE@google.com> References: <695bc686.050a0220.1c677c.032f.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index db72b96f9c8c..88da2d0e634c 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -827,7 +827,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args, char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX"; fmt_end = strnchr(fmt, fmt_size, 0); - if (!fmt_end) + if (!fmt_end || fmt_end == fmt) return -EINVAL; fmt_size = fmt_end - fmt;