From: Sven Schnelle <svens@linux•ibm.com>
To: Kees Cook <keescook@chromium•org>
Cc: Krzysztof Kozlowski <krzk@kernel•org>,
Christian Borntraeger <borntraeger@de•ibm.com>,
Linus Torvalds <torvalds@linux-foundation•org>,
Christoph Hellwig <hch@infradead•org>,
linux-kernel@vger•kernel.org,
Linux-Next Mailing List <linux-next@vger•kernel.org>,
"viro@zeniv•linux.org.uk" <viro@zeniv•linux.org.uk>
Subject: Re: autofs crash with latest linux-next
Date: Fri, 16 Oct 2020 07:44:14 +0200 [thread overview]
Message-ID: <yt9dblh2sp1t.fsf@linux.ibm.com> (raw)
In-Reply-To: <202010151226.7382E03@keescook> (Kees Cook's message of "Thu, 15 Oct 2020 12:28:14 -0700")
Kees Cook <keescook@chromium•org> writes:
> On Wed, Oct 14, 2020 at 09:15:47AM +0200, Krzysztof Kozlowski wrote:
>> I hit this since few days as well. Although the bisect points to the
>> merge, the issue looks like a result of mentioned commit 4d03e3cc5982
>> ("fs: don't allow kernel reads and writes without iter ops").
>>
>> The __kernel_read() last argument 'pos' can be NULL and it is
>> dereferenced here (added by the commit):
>>
>> 525 ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos)
>> ...
>> 547 kiocb.ki_pos = *pos;
>> 548 iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len);
>>
>>
>> The __kernel_read() is called with NULL in fs/autofs/waitq.c:
>>
>> 45 static int autofs_write(struct autofs_sb_info *sbi,
>> 46 struct file *file, const void *addr, int bytes)
>>
>> ...
>> 54 mutex_lock(&sbi->pipe_mutex);
>> 55 while (bytes) {
>> 56 wr = __kernel_write(file, data, bytes, NULL);
>
> I think the thread here is the same thing, but you've found it in
> autofs...
> https://lore.kernel.org/lkml/CAHk-=wgj=mKeN-EfV5tKwJNeHPLG0dybq+R5ZyGuc4WeUnqcmA@mail.gmail.com/
Indeed. Thanks, missed that.
Sven
prev parent reply other threads:[~2020-10-16 5:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <yt9d1ri3nakg.fsf@linux.ibm.com>
2020-10-13 7:20 ` autofs crash with latest linux-next Christian Borntraeger
2020-10-14 7:15 ` Krzysztof Kozlowski
2020-10-15 19:28 ` Kees Cook
2020-10-15 19:58 ` Krzysztof Kozlowski
2020-10-16 5:44 ` Sven Schnelle [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=yt9dblh2sp1t.fsf@linux.ibm.com \
--to=svens@linux$(echo .)ibm.com \
--cc=borntraeger@de$(echo .)ibm.com \
--cc=hch@infradead$(echo .)org \
--cc=keescook@chromium$(echo .)org \
--cc=krzk@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-next@vger$(echo .)kernel.org \
--cc=torvalds@linux-foundation$(echo .)org \
--cc=viro@zeniv$(echo .)linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox