public inbox for [email protected]
 help / color / mirror / Atom feed
From: Pavel Begunkov <[email protected]>
To: Lee Jones <[email protected]>,
	syzbot <[email protected]>
Cc: [email protected], [email protected],
	[email protected], [email protected]
Subject: Re: [syzbot] KASAN: stack-out-of-bounds Read in iov_iter_revert
Date: Mon, 8 Nov 2021 15:29:46 +0000	[thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>

On 11/3/21 17:01, Lee Jones wrote:
> Good afternoon Pavel,
> 
>> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>>
>> Reported-and-tested-by: [email protected]
>>
>> Tested on:
>>
>> commit:         bff2c168 io_uring: don't retry with truncated iter
>> git tree:       https://github.com/isilence/linux.git truncate
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=730106bfb5bf8ace
>> dashboard link: https://syzkaller.appspot.com/bug?extid=9671693590ef5aad8953
>> compiler:       Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.1
>>
>> Note: testing is done by a robot and is best-effort only.
> 
> As you can see in the 'dashboard link' above this bug also affects
> android-5-10 which is currently based on v5.10.75.
> 
> I see that the back-port of this patch failed in v5.10.y:
> 
>    https://lore.kernel.org/stable/[email protected]/
> 
> And after solving the build-error by back-porting both:
> 
>    2112ff5ce0c11 iov_iter: track truncated size
>    89c2b3b749182 io_uring: reexpand under-reexpanded iters
> 
> I now see execution tripping the WARN() in iov_iter_revert():
> 
>    if (WARN_ON(unroll > MAX_RW_COUNT))
>        return
> 
> Am I missing any additional patches required to fix stable/v5.10.y?

Is it the same syz test? There was a couple more patches for
IORING_SETUP_IOPOLL, but strange if that's not the case.


fwiw, Jens decided to replace it with another mechanism shortly
after, so it may be a better idea to backport those. Jens,
what do you think?


commit 8fb0f47a9d7acf620d0fd97831b69da9bc5e22ed
Author: Jens Axboe <[email protected]>
Date:   Fri Sep 10 11:18:36 2021 -0600

     iov_iter: add helper to save iov_iter state

commit cd65869512ab5668a5d16f789bc4da1319c435c4
Author: Jens Axboe <[email protected]>
Date:   Fri Sep 10 11:19:14 2021 -0600

     io_uring: use iov_iter state save/restore helpers


-- 
Pavel Begunkov

  reply	other threads:[~2021-11-08 15:29 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-12 13:43 [syzbot] KASAN: stack-out-of-bounds Read in iov_iter_revert syzbot
2021-08-12 14:30 ` Pavel Begunkov
2021-08-12 20:36   ` syzbot
2021-11-03 17:01     ` Lee Jones
2021-11-08 15:29       ` Pavel Begunkov [this message]
2021-11-08 15:41         ` Jens Axboe
2021-11-09 13:33           ` Lee Jones
2021-12-15  8:06             ` Lee Jones
2021-12-15 11:16               ` Pavel Begunkov
2021-12-16 17:02                 ` Lee Jones
2022-02-22 16:48                   ` Lee Jones
2022-03-21 10:52                 ` Lee Jones
2022-05-05 14:11           ` linux-stable-5.10-y CVE-2022-1508 of io_uring module Guo Xuenan
2022-05-06  2:16             ` Jens Axboe
2022-05-06 15:57               ` Pavel Begunkov
2022-05-06 16:15                 ` Jens Axboe
2022-05-06 18:22                   ` Jens Axboe
2022-05-07  9:16                     ` Pavel Begunkov
2022-05-07 14:18                       ` Jens Axboe
2022-05-08 11:43                         ` Pavel Begunkov
2021-08-23  0:24 ` [syzbot] KASAN: stack-out-of-bounds Read in iov_iter_revert Pavel Begunkov
2021-08-23  0:44   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox