Messages in this thread Patch in this message | | | From | Xin Long <> | Date | Wed, 20 Mar 2019 02:03:03 +0800 | Subject | Re: kernel panic: corrupted stack end in wb_workfn |
| |
On Mon, Mar 18, 2019 at 4:49 AM syzbot <syzbot+ec1b7575afef85a0e5ca@syzkaller.appspotmail.com> wrote: > > syzbot has bisected this bug to: > > commit c981f254cc82f50f8cb864ce6432097b23195b9c > Author: Al Viro <viro@zeniv.linux.org.uk> > Date: Sun Jan 7 18:19:09 2018 +0000 > > sctp: use vmemdup_user() rather than badly open-coding memdup_user() 'addrs_size' is passed from users, we actually used GFP_USER to put some more restrictions on it in this commit:
commit cacc06215271104b40773c99547c506095db6ad4 Author: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Date: Mon Nov 30 14:32:54 2015 -0200
sctp: use GFP_USER for user-controlled kmalloc
However, vmemdup_user() will 'ignore' this flag when going to vmalloc_*(), So we probably should fix it by using memdup_user() to avoid that open-coding part instead:
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index ea95cd4..e5bcade 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -999,7 +999,7 @@ static int sctp_setsockopt_bindx(struct sock *sk, if (unlikely(addrs_size <= 0)) return -EINVAL;
- kaddrs = vmemdup_user(addrs, addrs_size); + kaddrs = memdup_user(addrs, addrs_size);
> > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=137bcecf200000 > start commit: c981f254 sctp: use vmemdup_user() rather than badly open-c.. > git tree: upstream > final crash: https://syzkaller.appspot.com/x/report.txt?x=10fbcecf200000 > console output: https://syzkaller.appspot.com/x/log.txt?x=177bcecf200000 > kernel config: https://syzkaller.appspot.com/x/.config?x=5e7dc790609552d7 > dashboard link: https://syzkaller.appspot.com/bug?extid=ec1b7575afef85a0e5ca > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a9a84b400000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17199bb3400000 > > Reported-by: syzbot+ec1b7575afef85a0e5ca@syzkaller.appspotmail.com > Fixes: c981f254 ("sctp: use vmemdup_user() rather than badly open-coding > memdup_user()")
| |