# git rev-parse -q --verify fa520c47eaa15b9baa8ad66ac18da4a31679693b^{commit}
fa520c47eaa15b9baa8ad66ac18da4a31679693b
already have revision, skipping fetch
# git checkout -q -f -B kisskb fa520c47eaa15b9baa8ad66ac18da4a31679693b
# git clean -qxdf
# < git log -1
# commit fa520c47eaa15b9baa8ad66ac18da4a31679693b
# Author: Eric Sandeen <sandeen@redhat.com>
# Date:   Wed Oct 17 15:23:59 2018 +0100
# 
#     fscache: Fix out of bound read in long cookie keys
#     
#     fscache_set_key() can incur an out-of-bounds read, reported by KASAN:
#     
#      BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x5b3/0x680 [fscache]
#      Read of size 4 at addr ffff88084ff056d4 by task mount.nfs/32615
#     
#     and also reported by syzbot at https://lkml.org/lkml/2018/7/8/236
#     
#       BUG: KASAN: slab-out-of-bounds in fscache_set_key fs/fscache/cookie.c:120 [inline]
#       BUG: KASAN: slab-out-of-bounds in fscache_alloc_cookie+0x7a9/0x880 fs/fscache/cookie.c:171
#       Read of size 4 at addr ffff8801d3cc8bb4 by task syz-executor907/4466
#     
#     This happens for any index_key_len which is not divisible by 4 and is
#     larger than the size of the inline key, because the code allocates exactly
#     index_key_len for the key buffer, but the hashing loop is stepping through
#     it 4 bytes (u32) at a time in the buf[] array.
#     
#     Fix this by calculating how many u32 buffers we'll need by using
#     DIV_ROUND_UP, and then using kcalloc() to allocate a precleared allocation
#     buffer to hold the index_key, then using that same count as the hashing
#     index limit.
#     
#     Fixes: ec0328e46d6e ("fscache: Maintain a catalogue of allocated cookies")
#     Reported-by: syzbot+a95b989b2dde8e806af8@syzkaller.appspotmail.com
#     Signed-off-by: Eric Sandeen <sandeen@redhat.com>
#     Cc: stable <stable@vger.kernel.org>
#     Signed-off-by: David Howells <dhowells@redhat.com>
#     Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
# < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux-gcc --version
# < git log --format=%s --max-count=1 fa520c47eaa15b9baa8ad66ac18da4a31679693b
# < make -s -j 80 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux-  randconfig
KCONFIG_SEED=0x9D5041F8
# Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y
# yes \n | make -s -j 80 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux-  oldconfig
yes: standard output: Broken pipe
# make -s -j 80 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux-  
/kisskb/src/scripts/unifdef.c: In function 'Mpass':
/kisskb/src/scripts/unifdef.c:453:28: warning: 'strncpy' output truncated before terminating nul copying 4 bytes from a string of the same length [-Wstringop-truncation]
 static void Mpass (void) { strncpy(keyword, "if  ", 4); Pelif(); }
                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~
/kisskb/src/lib/ubsan.c:432:1: warning: ignoring attribute 'noreturn' in declaration of a built-in function '__ubsan_handle_builtin_unreachable' because it conflicts with attribute 'const' [-Wattributes]
 {
 ^
<built-in>: note: previous declaration here
In function 'ZSTD_copyRawBlock',
    inlined from 'ZSTD_decompressContinue' at /kisskb/src/lib/zstd/decompress.c:1811:24,
    inlined from 'ZSTD_decompressStream' at /kisskb/src/lib/zstd/decompress.c:2353:5:
/kisskb/src/lib/zstd/decompress.c:416:2: warning: argument 1 null where non-null expected [-Wnonnull]
  memcpy(dst, src, srcSize);
  ^~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /kisskb/src/include/linux/string.h:20,
                 from /kisskb/src/lib/zstd/mem.h:24,
                 from /kisskb/src/lib/zstd/bitstream.h:54,
                 from /kisskb/src/lib/zstd/fse.h:228,
                 from /kisskb/src/lib/zstd/decompress.c:32:
/kisskb/src/lib/zstd/decompress.c: In function 'ZSTD_decompressStream':
/kisskb/src/arch/arm64/include/asm/string.h:38:14: note: in a call to function 'memcpy' declared here
 extern void *memcpy(void *, const void *, __kernel_size_t);
              ^~~~~~
In function 'ZSTD_setRleBlock',
    inlined from 'ZSTD_decompressContinue' at /kisskb/src/lib/zstd/decompress.c:1812:24,
    inlined from 'ZSTD_decompressStream' at /kisskb/src/lib/zstd/decompress.c:2353:5:
/kisskb/src/lib/zstd/decompress.c:426:2: warning: argument 1 null where non-null expected [-Wnonnull]
  memset(dst, *(const BYTE *)src, regenSize);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /kisskb/src/include/linux/string.h:20,
                 from /kisskb/src/lib/zstd/mem.h:24,
                 from /kisskb/src/lib/zstd/bitstream.h:54,
                 from /kisskb/src/lib/zstd/fse.h:228,
                 from /kisskb/src/lib/zstd/decompress.c:32:
/kisskb/src/lib/zstd/decompress.c: In function 'ZSTD_decompressStream':
/kisskb/src/arch/arm64/include/asm/string.h:49:14: note: in a call to function 'memset' declared here
 extern void *memset(void *, int, __kernel_size_t);
              ^~~~~~
In function 'ZSTD_copyRawBlock',
    inlined from 'ZSTD_decompressContinue' at /kisskb/src/lib/zstd/decompress.c:1811:24,
    inlined from 'ZSTD_decompressStream' at /kisskb/src/lib/zstd/decompress.c:2356:6:
/kisskb/src/lib/zstd/decompress.c:416:2: warning: argument 1 null where non-null expected [-Wnonnull]
  memcpy(dst, src, srcSize);
  ^~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /kisskb/src/include/linux/string.h:20,
                 from /kisskb/src/lib/zstd/mem.h:24,
                 from /kisskb/src/lib/zstd/bitstream.h:54,
                 from /kisskb/src/lib/zstd/fse.h:228,
                 from /kisskb/src/lib/zstd/decompress.c:32:
/kisskb/src/lib/zstd/decompress.c: In function 'ZSTD_decompressStream':
/kisskb/src/arch/arm64/include/asm/string.h:38:14: note: in a call to function 'memcpy' declared here
 extern void *memcpy(void *, const void *, __kernel_size_t);
              ^~~~~~
In function 'ZSTD_setRleBlock',
    inlined from 'ZSTD_decompressContinue' at /kisskb/src/lib/zstd/decompress.c:1812:24,
    inlined from 'ZSTD_decompressStream' at /kisskb/src/lib/zstd/decompress.c:2356:6:
/kisskb/src/lib/zstd/decompress.c:426:2: warning: argument 1 null where non-null expected [-Wnonnull]
  memset(dst, *(const BYTE *)src, regenSize);
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /kisskb/src/include/linux/string.h:20,
                 from /kisskb/src/lib/zstd/mem.h:24,
                 from /kisskb/src/lib/zstd/bitstream.h:54,
                 from /kisskb/src/lib/zstd/fse.h:228,
                 from /kisskb/src/lib/zstd/decompress.c:32:
/kisskb/src/lib/zstd/decompress.c: In function 'ZSTD_decompressStream':
/kisskb/src/arch/arm64/include/asm/string.h:49:14: note: in a call to function 'memset' declared here
 extern void *memset(void *, int, __kernel_size_t);
              ^~~~~~
Completed OK
# rm -rf /kisskb/build/linus-rand_arm64-randconfig_arm64-gcc8
# Build took: 0:08:47.792445