Re: WARNING in rds_cmsg_rdma_args

[Dmitry Vyukov]

On Wed, Jan 3, 2018 at 7:55 PM, Santosh Shilimkar
 wrote:
>
> On 1/3/2018 10:51 AM, Mohamed Ghannam wrote:
>>
>> The fix  : https://patchwork.ozlabs.org/patch/854723/
>
>
> Cool. Thanks Mohamed for following it up.


Since this was submitted without the Reported-by tag, we need to tell
syzbot about the fix separately:

#syz fix: RDS: Heap OOB write in rds_message_alloc_sgs()

Re: WARNING in rds_cmsg_rdma_args

[Santosh Shilimkar]

On 1/3/2018 10:51 AM, Mohamed Ghannam wrote:
The fix  : https://patchwork.ozlabs.org/patch/854723/ 


Cool. Thanks Mohamed for following it up.

Regards,
Santosh

Re: WARNING in rds_cmsg_rdma_args

[Santosh Shilimkar]

On 1/3/2018 12:58 AM, syzbot wrote:

Hello,

syzkaller hit the following crash on 
ad036b63ee57df9ab802a4eb20cbbbec66aa4520

git://git.cmpxchg.org/linux-mmots.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See 




for information about syzkaller reproducers


IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ef175b5825285531e...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for 
details.

If you forward the report, please keep this part and the footer.

audit: type=1400 audit(1514947982.760:7): avc:  denied  { map } for  
pid=3468 comm="syzkaller284818" path="/root/syzkaller284818499" 
dev="sda1" ino=16481 
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
WARNING: CPU: 1 PID: 3468 at net/rds/rdma.c:617 
rds_cmsg_rdma_args+0xe96/0x1360 net/rds/rdma.c:617

Kernel panic - not syncing: panic_on_warn set ...


+Mohamed Ghannam, who was discussing similar issue and was going
to post fix for it. Checking args->nr_local against 0 upfront would
address this issue as well.

Regards,
Santosh