Forum | Documentation | Website | Blog

Skip to content
Snippets Groups Projects
  • Jerome Marchand's avatar
    assoc_array: don't call compare_object() on a node · 8d4a2ec1
    Jerome Marchand authored
    Changes since V1: fixed the description and added KASan warning.
    
    In assoc_array_insert_into_terminal_node(), we call the
    compare_object() method on all non-empty slots, even when they're
    not leaves, passing a pointer to an unexpected structure to
    compare_object(). Currently it causes an out-of-bound read access
    in keyring_compare_object detected by KASan (see below). The issue
    is easily reproduced with keyutils testsuite.
    Only call compare_object() when the slot is a leave.
    
    KASan warning:
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838
    Read of size 8 by task keyctl/1655
    =============================================================================
    BUG kmalloc-192 (Not tainted): kasan: bad access detected
    -----------------------------------------------------------------------------
    
    Disabling lock debugging due to kernel taint
    INFO: Allocated i...
    8d4a2ec1