On 2 September 2026 13:21:36 BST, Mimi Zohar <[email protected]> wrote: >On Thu, 2026-08-27 at 17:43 +0000, Bradley Morgan wrote: >> dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the >> buffer. validate_hash_algo() passes the result straight to >> integrity_audit_msg() without checking. ERR_PTR is not NULL, so >> integrity_audit_message() sees a valid pointer and calls strlen() on >> it, which faults: >> >> BUG: unable to handle page fault for address: ffffffffffffffdc >> RIP: 0010:strlen+0x30/0xa0 >> Call Trace: >> audit_log_untrustedstring+0x19/0x30 >> integrity_audit_message+0x366/0x4f0 >> ima_inode_setxattr+0x512/0x5f0 >> >> Check for IS_ERR() and use NULL instead, which makes the audit message >> skip the name= field instead of crashing. >> >> Fixes: 4f2946aa0c45 ("IMA: introduce a new policy option >func=SETXATTR_CHECK") >> Cc: [email protected] >> Reported-by: [email protected] >> Link: >https://lore.kernel.org/all/[email protected]/ >> Signed-off-by: Bradley Morgan <[email protected]> > >Thanks, Bradley. The patch is now queued in next-integrity.
Cheers, +CC Paul, the syzbot issue should now be fixed > >Mimi --- Thanks! https://lore.kernel.org/all/[email protected]/
