Re: WARNING in ex_handler_uaccess

2020-09-22 Thread Al Viro
On Mon, Sep 21, 2020 at 12:22:19PM +0200, Rasmus Villemoes wrote: > So, not sure how the above got triggered, but I notice there might be an > edge case in check_zeroed_user(): > > from -= align; > size += align; > > if (!user_read_access_begin(from, size)) > retu

RE: WARNING in ex_handler_uaccess

2020-09-21 Thread David Laight
From: Rasmus Villemoes > Sent: 21 September 2020 11:22 > On 19/09/2020 02.17, Al Viro wrote: > > On Fri, Sep 18, 2020 at 05:07:43PM -0700, Andy Lutomirski wrote: > >> On Fri, Sep 18, 2020 at 4:55 PM Al Viro wrote: > >>> > >>> On Fri, Sep 18, 2020 at 04:31:33PM -0700, Andy Lutomirski wrote: > >>>

Re: WARNING in ex_handler_uaccess

2020-09-21 Thread Rasmus Villemoes
On 19/09/2020 02.17, Al Viro wrote: > On Fri, Sep 18, 2020 at 05:07:43PM -0700, Andy Lutomirski wrote: >> On Fri, Sep 18, 2020 at 4:55 PM Al Viro wrote: >>> >>> On Fri, Sep 18, 2020 at 04:31:33PM -0700, Andy Lutomirski wrote: >>> check_zeroed_user() looks buggy. It does: if

RE: WARNING in ex_handler_uaccess

2020-09-19 Thread David Laight
From: Al Viro > Sent: 19 September 2020 01:17 > > On Fri, Sep 18, 2020 at 05:07:43PM -0700, Andy Lutomirski wrote: > > On Fri, Sep 18, 2020 at 4:55 PM Al Viro wrote: > > > > > > On Fri, Sep 18, 2020 at 04:31:33PM -0700, Andy Lutomirski wrote: > > > > > > > check_zeroed_user() looks buggy. It doe

Re: WARNING in ex_handler_uaccess

2020-09-18 Thread Al Viro
On Fri, Sep 18, 2020 at 05:07:43PM -0700, Andy Lutomirski wrote: > On Fri, Sep 18, 2020 at 4:55 PM Al Viro wrote: > > > > On Fri, Sep 18, 2020 at 04:31:33PM -0700, Andy Lutomirski wrote: > > > > > check_zeroed_user() looks buggy. It does: > > > > > >if (!user_access_begin(from, size)) > >

Re: WARNING in ex_handler_uaccess

2020-09-18 Thread Andy Lutomirski
On Fri, Sep 18, 2020 at 4:55 PM Al Viro wrote: > > On Fri, Sep 18, 2020 at 04:31:33PM -0700, Andy Lutomirski wrote: > > > check_zeroed_user() looks buggy. It does: > > > >if (!user_access_begin(from, size)) > >return -EFAULT; > > > >unsafe_get_user(val, (unsigned l

Re: WARNING in ex_handler_uaccess

2020-09-18 Thread Al Viro
On Fri, Sep 18, 2020 at 04:31:33PM -0700, Andy Lutomirski wrote: > check_zeroed_user() looks buggy. It does: > >if (!user_access_begin(from, size)) >return -EFAULT; > >unsafe_get_user(val, (unsigned long __user *) from, err_fault); > > This is wrong if size < si

Re: WARNING in ex_handler_uaccess

2020-09-18 Thread Andy Lutomirski
On Fri, Sep 18, 2020 at 2:01 PM syzbot wrote: > > Hello, > > syzbot found the following issue on: > > HEAD commit:10b82d51 Merge branch 'for-5.9-fixes' of git://git.kernel... > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=13fb6b0790 > kernel config: