lkml.org 
[lkml]   [2019]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] relay: handle alloc_percpu returning NULL in relay_open
Date
Daniel Axtens <dja@axtens.net> writes:
> --
>
> There's a syz reproducer on the powerpc syzbot that eventually hits
> the bug, but it can take up to an hour or so before it keels over on a
> kernel with all the syzkaller debugging on, and even longer on a
> production kernel. I have been able to reproduce it once on a stock
> Ubuntu 5.0 ppc64le kernel.
>
> I will ask MITRE for a CVE - while only the process doing the syscall
> gets killed, it gets killed while holding the relay_channels_mutex,
> so it blocks all future relay activity.

CVE-2019-19462 has been assigned.

Regards,
Daniel


> ---
> kernel/relay.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/relay.c b/kernel/relay.c
> index ade14fb7ce2e..a376cc6b54ec 100644
> --- a/kernel/relay.c
> +++ b/kernel/relay.c
> @@ -580,7 +580,13 @@ struct rchan *relay_open(const char *base_filename,
> if (!chan)
> return NULL;
>
> - chan->buf = alloc_percpu(struct rchan_buf *);
> + chan->buf = alloc_percpu_gfp(struct rchan_buf *,
> + GFP_KERNEL | __GFP_NOWARN);
> + if (!chan->buf) {
> + kfree(chan);
> + return NULL;
> + }
> +
> chan->version = RELAYFS_CHANNEL_VERSION;
> chan->n_subbufs = n_subbufs;
> chan->subbuf_size = subbuf_size;
> --
> 2.20.1

\
 
 \ /
  Last update: 2019-11-30 07:05    [W:0.066 / U:7.396 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site