Buildresult: linus/axs101_defconfig/arcompact built on Oct 19 2018, 03:25

kisskb

Revisions | Branches | Compilers | Configs | Build Results | Build Failures |

Status:	OK
Date/Time:	Oct 19 2018, 03:25
Duration:	0:00:57.597004
Builder:	ka3
Revision:	fscache: Fix out of bound read in long cookie keys (`fa520c47eaa15b9baa8ad66ac18da4a31679693b)`
Target:	linus/axs101_defconfig/arcompact
Branch:	linus
Compiler:	arcompact (arc-buildroot-linux-uclibc-gcc (Buildroot 2015.08.1) 4.8.4)
Config:	axs101_defconfig (download)
Log:	Download original Possible warnings (3) include/linux/kernel.h:845:29: warning: comparison of distinct pointer types lacks a cast [enabled by default] arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value] net/ipv4/tcp_input.c:4319:49: warning: array subscript is above array bounds [-Warray-bounds] Full Log # git rev-parse -q --verify fa520c47eaa15b9baa8ad66ac18da4a31679693b^{commit} fa520c47eaa15b9baa8ad66ac18da4a31679693b already have revision, skipping fetch # git checkout -q -f -B kisskb fa520c47eaa15b9baa8ad66ac18da4a31679693b # git clean -qxdf # < git log -1 # commit fa520c47eaa15b9baa8ad66ac18da4a31679693b # Author: Eric Sandeen <sandeen@redhat.com> # Date: Wed Oct 17 15:23:59 2018 +0100 # # fscache: Fix out of bound read in long cookie keys # # fscache_set_key() can incur an out-of-bounds read, reported by KASAN: # # BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x5b3/0x680 [fscache] # Read of size 4 at addr ffff88084ff056d4 by task mount.nfs/32615 # # and also reported by syzbot at https://lkml.org/lkml/2018/7/8/236 # # BUG: KASAN: slab-out-of-bounds in fscache_set_key fs/fscache/cookie.c:120 [inline] # BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x7a9/0x880 fs/fscache/cookie.c:171 # Read of size 4 at addr ffff8801d3cc8bb4 by task syz-executor907/4466 # # This happens for any index_key_len which is not divisible by 4 and is # larger than the size of the inline key, because the code allocates exactly # index_key_len for the key buffer, but the hashing loop is stepping through # it 4 bytes (u32) at a time in the buf[] array. # # Fix this by calculating how many u32 buffers we'll need by using # DIV_ROUND_UP, and then using kcalloc() to allocate a precleared allocation # buffer to hold the index_key, then using that same count as the hashing # index limit. # # Fixes: ec0328e46d6e ("fscache: Maintain a catalogue of allocated cookies") # Reported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com # Signed-off-by: Eric Sandeen <sandeen@redhat.com> # Cc: stable <stable@vger.kernel.org> # Signed-off-by: David Howells <dhowells@redhat.com> # Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> # < /opt/cross/kisskb/arcompact-buildroot-2015.08.1/bin/arc-buildroot-linux-uclibc-gcc --version # < git log --format=%s --max-count=1 fa520c47eaa15b9baa8ad66ac18da4a31679693b # < make -s -j 80 ARCH=arc O=/kisskb/build/linus_axs101_defconfig_arcompact CROSS_COMPILE=/opt/cross/kisskb/arcompact-buildroot-2015.08.1/bin/arc-buildroot-linux-uclibc- axs101_defconfig # Added to kconfig CONFIG_INITRAMFS_SOURCE="" # yes \n \| make -s -j 80 ARCH=arc O=/kisskb/build/linus_axs101_defconfig_arcompact CROSS_COMPILE=/opt/cross/kisskb/arcompact-buildroot-2015.08.1/bin/arc-buildroot-linux-uclibc- oldconfig yes: standard output: Broken pipe # make -s -j 80 ARCH=arc O=/kisskb/build/linus_axs101_defconfig_arcompact CROSS_COMPILE=/opt/cross/kisskb/arcompact-buildroot-2015.08.1/bin/arc-buildroot-linux-uclibc- In file included from /kisskb/src/include/asm-generic/bug.h:18:0, from /kisskb/src/arch/arc/include/asm/bug.h:32, from /kisskb/src/include/linux/bug.h:5, from /kisskb/src/include/linux/mmdebug.h:5, from /kisskb/src/include/linux/gfp.h:5, from /kisskb/src/include/linux/slab.h:15, from /kisskb/src/mm/nobootmem.c:14: /kisskb/src/mm/nobootmem.c: In function '__free_pages_memory': /kisskb/src/include/linux/kernel.h:845:29: warning: comparison of distinct pointer types lacks a cast [enabled by default] (!!(sizeof((typeof(x) )1 == (typeof(y) )1))) ^ /kisskb/src/include/linux/kernel.h:859:4: note: in expansion of macro '__typecheck' (__typecheck(x, y) && __no_side_effects(x, y)) ^ /kisskb/src/include/linux/kernel.h:869:24: note: in expansion of macro '__safe_cmp' __builtin_choose_expr(__safe_cmp(x, y), \ ^ /kisskb/src/include/linux/kernel.h:878:19: note: in expansion of macro '__careful_cmp' #define min(x, y) __careful_cmp(x, y, <) ^ /kisskb/src/mm/nobootmem.c:104:11: note: in expansion of macro 'min' order = min(MAX_ORDER - 1UL, __ffs(start)); ^ In file included from /kisskb/src/arch/arc/include/asm/atomic.h:16:0, from /kisskb/src/include/linux/atomic.h:7, from /kisskb/src/include/asm-generic/bitops/lock.h:5, from /kisskb/src/arch/arc/include/asm/bitops.h:429, from /kisskb/src/include/linux/bitops.h:19, from /kisskb/src/include/linux/kernel.h:11, from /kisskb/src/include/linux/list.h:9, from /kisskb/src/include/linux/module.h:9, from /kisskb/src/net/core/filter.c:24: /kisskb/src/net/core/filter.c: In function 'bpf_clear_redirect_map': /kisskb/src/arch/arc/include/asm/cmpxchg.h:95:29: warning: value computed is not used [-Wunused-value] #define cmpxchg(ptr, o, n) ((typeof(*(ptr)))__cmpxchg((ptr), \ ^ /kisskb/src/net/core/filter.c:3268:4: note: in expansion of macro 'cmpxchg' cmpxchg(&ri->map, map, NULL); ^ /kisskb/src/net/ipv4/tcp_input.c: In function 'tcp_data_queue': /kisskb/src/net/ipv4/tcp_input.c:4319:49: warning: array subscript is above array bounds [-Warray-bounds] tp->selective_acks[i-1] = tp->selective_acks[i]; ^ Completed OK # rm -rf /kisskb/build/linus_axs101_defconfig_arcompact # Build took: 0:00:57.597004

© Michael Ellerman 2006-2018.