# git rev-parse -q --verify fa520c47eaa15b9baa8ad66ac18da4a31679693b^{commit} fa520c47eaa15b9baa8ad66ac18da4a31679693b already have revision, skipping fetch # git checkout -q -f -B kisskb fa520c47eaa15b9baa8ad66ac18da4a31679693b # git clean -qxdf # < git log -1 # commit fa520c47eaa15b9baa8ad66ac18da4a31679693b # Author: Eric Sandeen # Date: Wed Oct 17 15:23:59 2018 +0100 # # fscache: Fix out of bound read in long cookie keys # # fscache_set_key() can incur an out-of-bounds read, reported by KASAN: # # BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x5b3/0x680 [fscache] # Read of size 4 at addr ffff88084ff056d4 by task mount.nfs/32615 # # and also reported by syzbot at https://lkml.org/lkml/2018/7/8/236 # # BUG: KASAN: slab-out-of-bounds in fscache_set_key fs/fscache/cookie.c:120 [inline] # BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x7a9/0x880 fs/fscache/cookie.c:171 # Read of size 4 at addr ffff8801d3cc8bb4 by task syz-executor907/4466 # # This happens for any index_key_len which is not divisible by 4 and is # larger than the size of the inline key, because the code allocates exactly # index_key_len for the key buffer, but the hashing loop is stepping through # it 4 bytes (u32) at a time in the buf[] array. # # Fix this by calculating how many u32 buffers we'll need by using # DIV_ROUND_UP, and then using kcalloc() to allocate a precleared allocation # buffer to hold the index_key, then using that same count as the hashing # index limit. # # Fixes: ec0328e46d6e ("fscache: Maintain a catalogue of allocated cookies") # Reported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com # Signed-off-by: Eric Sandeen # Cc: stable # Signed-off-by: David Howells # Signed-off-by: Greg Kroah-Hartman # < /opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux-gcc --version # < git log --format=%s --max-count=1 fa520c47eaa15b9baa8ad66ac18da4a31679693b # < make -s -j 48 ARCH=powerpc O=/kisskb/build/linus-rand_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- randconfig KCONFIG_SEED=0xADBB1B59 WARNING: unmet direct dependencies detected for ATA Depends on [n]: HAS_IOMEM [=y] && BLOCK [=n] Selected by [y]: - AKEBONO [=y] && PPC_47x [=y] WARNING: unmet direct dependencies detected for MMC_SDHCI Depends on [n]: MMC [=n] && HAS_DMA [=y] Selected by [y]: - AKEBONO [=y] && PPC_47x [=y] WARNING: unmet direct dependencies detected for MMC_SDHCI_PLTFM Depends on [n]: MMC [=n] && MMC_SDHCI [=y] Selected by [y]: - AKEBONO [=y] && PPC_47x [=y] WARNING: unmet direct dependencies detected for ATA Depends on [n]: HAS_IOMEM [=y] && BLOCK [=n] Selected by [y]: - AKEBONO [=y] && PPC_47x [=y] WARNING: unmet direct dependencies detected for MMC_SDHCI Depends on [n]: MMC [=n] && HAS_DMA [=y] Selected by [y]: - AKEBONO [=y] && PPC_47x [=y] WARNING: unmet direct dependencies detected for MMC_SDHCI_PLTFM Depends on [n]: MMC [=n] && MMC_SDHCI [=y] Selected by [y]: - AKEBONO [=y] && PPC_47x [=y] # Added to kconfig CONFIG_STANDALONE=y # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # Added to kconfig CONFIG_CPU_BIG_ENDIAN=y # Added to kconfig CONFIG_PPC64=y # Added to kconfig CONFIG_PPC_DISABLE_WERROR=y # Added to kconfig CONFIG_SECTION_MISMATCH_WARN_ONLY=y # Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y # Added to kconfig CONFIG_CC_STACKPROTECTOR_STRONG=n # Added to kconfig CONFIG_GCC_PLUGINS=n # Added to kconfig CONFIG_LD_HEAD_STUB_CATCH=y # Added to kconfig # yes \n | make -s -j 48 ARCH=powerpc O=/kisskb/build/linus-rand_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- oldconfig yes: standard output: Broken pipe # make -s -j 48 ARCH=powerpc O=/kisskb/build/linus-rand_powerpc-randconfig_powerpc CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/powerpc-linux/bin/powerpc-linux- /kisskb/src/scripts/unifdef.c: In function 'Mpass': /kisskb/src/scripts/unifdef.c:453:28: warning: 'strncpy' output truncated before terminating nul copying 4 bytes from a string of the same length [-Wstringop-truncation] static void Mpass (void) { strncpy(keyword, "if ", 4); Pelif(); } ^~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/arch/powerpc/mm/slice.c: In function 'slice_get_unmapped_area': /kisskb/src/arch/powerpc/mm/slice.c:679:1: warning: the frame size of 1040 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/arch/powerpc/mm/slice.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/fs/afs/dynroot.c: In function 'afs_dynroot_lookup': /kisskb/src/fs/afs/dynroot.c:126:6: warning: 'len' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/afs/dynroot.c:100:6: note: 'len' was declared here /kisskb/src/fs/afs/dynroot.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/kernel/printk/printk.c: In function 'devkmsg_sysctl_set_loglvl': /kisskb/src/kernel/printk/printk.c:185:16: warning: 'old' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function '_regmap_raw_write': /kisskb/src/drivers/base/regmap/regmap.c:1833:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function 'regmap_raw_read': /kisskb/src/drivers/base/regmap/regmap.c:2511:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/kernel/printk/printk.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/kernel/rcu/srcutree.c: In function 'init_srcu_struct_fields': /kisskb/src/kernel/rcu/srcutree.c:148:32: warning: 'levelspread[]' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/rcu/srcutree.c:96:6: note: 'levelspread[]' was declared here /kisskb/src/kernel/rcu/srcutree.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/dma-buf/reservation.c: In function 'reservation_object_add_shared_fence': /kisskb/src/drivers/dma-buf/reservation.c:208:2: warning: 'k' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/dma-buf/reservation.c:161:17: note: 'k' was declared here /kisskb/src/drivers/dma-buf/reservation.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/i2c/i2c-core-base.c: In function 'i2c_generic_scl_recovery': /kisskb/src/drivers/i2c/i2c-core-base.c:235:5: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/i2c/i2c-core-base.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c: In function 'amdgpu_set_pp_od_clk_voltage': /kisskb/src/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c:546:5: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/gpu/drm/amd/amdgpu/soc15.c: In function 'soc15_set_ip_blocks': /kisskb/src/drivers/gpu/drm/amd/amdgpu/soc15.c:532:3: warning: #warning "Enable CONFIG_DRM_AMD_DC for display support on SOC15." [-Wcpp] /kisskb/src/drivers/gpu/drm/amd/amdgpu/soc15.c:551:3: warning: #warning "Enable CONFIG_DRM_AMD_DC for display support on SOC15." [-Wcpp] /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c: In function 'gmc_v8_0_process_interrupt': /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1447:10: warning: missing braces around initializer [-Wmissing-braces] /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1447:10: warning: (near initialization for 'task_info.process_name') [-Wmissing-braces] /kisskb/src/drivers/isdn/hardware/eicon/diddfunc.c: In function 'connect_didd': /kisskb/src/drivers/isdn/hardware/eicon/diddfunc.c:77:1: warning: the frame size of 1136 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/drivers/isdn/hardware/eicon/diddfunc.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/gpu/drm/amd/amdgpu/soc15.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c: In function 'gmc_v9_0_process_interrupt': /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:262:10: warning: missing braces around initializer [-Wmissing-braces] /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:262:10: warning: (near initialization for 'task_info.process_name') [-Wmissing-braces] /kisskb/src/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/mfd/arizona-core.c: In function 'arizona_dev_init': /kisskb/src/drivers/mfd/arizona-core.c:1422:6: warning: 'n_subdevs' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/mfd/arizona-core.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/fs/proc/inode.c: In function 'proc_reg_open': /kisskb/src/include/linux/list.h:65:12: warning: 'pdeo' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c:341:21: note: 'pdeo' was declared here /kisskb/src/fs/proc/inode.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/isdn/hardware/eicon/divasfunc.c: In function 'connect_didd': /kisskb/src/drivers/isdn/hardware/eicon/divasfunc.c:192:1: warning: the frame size of 1136 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/drivers/isdn/hardware/eicon/divasfunc.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/isdn/hardware/eicon/diva.c: In function 'diva_driver_add_card': /kisskb/src/drivers/isdn/hardware/eicon/diva.c:173:35: warning: array subscript is above array bounds [-Warray-bounds] /kisskb/src/drivers/isdn/hardware/eicon/diva.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/isdn/hardware/eicon/capifunc.c: In function 'divacapi_connect_didd': /kisskb/src/drivers/isdn/hardware/eicon/capifunc.c:1094:1: warning: the frame size of 1136 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/drivers/isdn/hardware/eicon/capifunc.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/isdn/hardware/eicon/message.c: In function 'sig_ind': /kisskb/src/drivers/isdn/hardware/eicon/message.c:5985:1: warning: the frame size of 1088 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/drivers/isdn/hardware/eicon/message.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/net/tun.c: In function 'tun_get_user': /kisskb/src/drivers/net/tun.c:1794:30: warning: 'copylen' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c:1704:46: warning: 'linear' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/net/tun.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/net/bridge/br_netlink.c: In function 'br_afspec': /kisskb/src/net/bridge/br_netlink.c:647:7: warning: 'err' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/bridge/br_netlink.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/net/core/rtnetlink.c: In function 'rtnl_newlink': /kisskb/src/net/core/rtnetlink.c:3156:1: warning: the frame size of 1248 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/net/core/rtnetlink.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c: In function 'gk104_top_oneinit': /kisskb/src/drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c:102:1: warning: 'inst' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c:102:1: warning: 'type' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/net/mac80211/mlme.c: In function 'ieee80211_rx_mgmt_beacon': /kisskb/src/net/mac80211/mlme.c:1511:3: warning: 'pwr_level_cisco' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/mac80211/mlme.c:1468:6: note: 'pwr_level_cisco' was declared here /kisskb/src/net/mac80211/mlme.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/drivers/gpu/drm/nouveau/dispnv50/lut.c: In function 'nv50_lut_load': /kisskb/src/arch/powerpc/include/asm/io.h:176:1: warning: 'b' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/nouveau/dispnv50/lut.c:39:18: note: 'b' was declared here /kisskb/src/arch/powerpc/include/asm/io.h:176:1: warning: 'g' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/nouveau/dispnv50/lut.c:39:15: note: 'g' was declared here /kisskb/src/arch/powerpc/include/asm/io.h:176:1: warning: 'r' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/gpu/drm/nouveau/dispnv50/lut.c:39:12: note: 'r' was declared here /kisskb/src/drivers/gpu/drm/nouveau/dispnv50/lut.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] /kisskb/src/net/sched/cls_flower.c: In function 'fl_change': /kisskb/src/net/sched/cls_flower.c:1286:1: warning: the frame size of 1200 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/net/sched/cls_flower.c: At top level: cc1: warning: unrecognized command line option "-Wno-maybe-uninitialized" [enabled by default] Completed OK # rm -rf /kisskb/build/linus-rand_powerpc-randconfig_powerpc # Build took: 0:04:36.987839