Re: memory leak in bpf

On Wed, Apr 07, 2021 at 04:35:34PM -0700, Andrii Nakryiko wrote: > On Wed, Apr 7, 2021 at 4:24 PM Rustam Kovhaev wrote: > > > > On Mon, Mar 01, 2021 at 09:43:00PM +0100, Dmitry Vyukov wrote: > > > On Mon, Mar 1, 2021 at 9:39 PM Rustam Kovhaev wrote: > > > > &

Re: memory leak in bpf

On Mon, Mar 01, 2021 at 09:43:00PM +0100, Dmitry Vyukov wrote: > On Mon, Mar 1, 2021 at 9:39 PM Rustam Kovhaev wrote: > > > > On Mon, Mar 01, 2021 at 08:05:42PM +0100, Dmitry Vyukov wrote: > > > On Mon, Mar 1, 2021 at 5:21 PM Rustam Kovhaev wrote: > > > > &

Re: memory leak in bpf

On Mon, Mar 01, 2021 at 08:05:42PM +0100, Dmitry Vyukov wrote: > On Mon, Mar 1, 2021 at 5:21 PM Rustam Kovhaev wrote: > > > > On Wed, Dec 09, 2020 at 10:58:10PM -0800, syzbot wrote: > > > syzbot has found a reproducer for the following issue on: > > > > >

Re: memory leak in bpf

On Wed, Dec 09, 2020 at 10:58:10PM -0800, syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit:a68a0262 mm/madvise: remove racy mm ownership check > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=11facf1750 >

Re: [PATCH] ntfs: check for valid standard information attribute

On Mon, Feb 22, 2021 at 02:18:50PM +, Anton Altaparmakov wrote: > Rustam would you like to resubmit with an improved/extended description? sure thing, no problem! > when resubmitting with better description, please also add the > "Cc: sta...@vger.kernel.org" line together with the

[PATCH] ntfs: check for valid standard information attribute

we should check for valid STANDARD_INFORMATION attribute offset and length before trying to access it Reported-and-tested-by: syzbot+c584225dabdea2f71...@syzkaller.appspotmail.com Signed-off-by: Rustam Kovhaev Acked-by: Anton Altaparmakov Link: https://syzkaller.appspot.com/bug?extid

Re: [PATCH] ntfs: move check for valid resident attribute offset and length

On Tue, Feb 16, 2021 at 02:40:37AM +, Anton Altaparmakov wrote: > Hi Rustam, > > Thank you for the patch but it is not quite correct: > > 1) The first delta: yes that is a good idea to add this check but the error > message is incorrect. It should say "Corrupt standard information

[PATCH] ntfs: move check for valid resident attribute offset and length

...@syzkaller.appspotmail.com Signed-off-by: Rustam Kovhaev Link: https://syzkaller.appspot.com/bug?extid=c584225dabdea2f71969 --- fs/ntfs/inode.c | 15 +++ 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c index f7e4cbc26eaf..70745aea5106 100644 --- a/fs/ntfs/inode.c

[PATCH] reiserfs: add check for an invalid ih_entry_count

...@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=83b6f7cf9922cae5c4d7 Signed-off-by: Rustam Kovhaev --- fs/reiserfs/stree.c | 6 ++ 1 file changed, 6 insertions(+) diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c index 8bf88d690729..476a7ff49482 100644 --- a/fs/reiserfs/stree.c

Re: KASAN: use-after-free Read in v4l2_fh_init

On Fri, Apr 19, 2019 at 07:36:05AM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:d34f9519 usb-fuzzer: main usb gadget fuzzer driver > git tree: https://github.com/google/kasan/tree/usb-fuzzer > console output:

Re: KASAN: use-after-free Read in btrfs_scan_one_device

On Thu, Oct 01, 2020 at 03:35:46PM +0200, David Sterba wrote: > On Thu, Oct 01, 2020 at 03:08:34PM +0200, Dmitry Vyukov wrote: > > On Thu, Oct 1, 2020 at 3:05 PM Dmitry Vyukov wrote: > > > > > > On Wed, Sep 30, 2020 at 8:06 PM David Sterba wrote: > > > > > > > > On Wed, Sep 30, 2020 at

Re: [PATCH] block: switch to pr_warn() in __device_add_disk()

On Sun, Oct 11, 2020 at 04:53:22PM +0200, Hannes Reinecke wrote: > On 10/11/20 3:03 PM, Rustam Kovhaev wrote: > > syzbot triggered a warning while fuzzing with failslab fault injection > > enabled > > let's convert WARN_ON() to pr_warn() > > > > Re

[PATCH] block: switch to pr_warn() in __device_add_disk()

syzbot triggered a warning while fuzzing with failslab fault injection enabled let's convert WARN_ON() to pr_warn() Reported-and-tested-by: syzbot+f41893bb8c45cd18c...@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=f41893bb8c45cd18cf08 Signed-off-by: Rustam Kovhaev

[RESEND PATCH] KVM: use struct_size() and flex_array_size() helpers in kvm_io_bus_unregister_dev()

-by: Rustam Kovhaev Reviewed-by: Gustavo A. R. Silva --- virt/kvm/kvm_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index cf88233b819a..68edd25dcb11 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -4350,10 +4350,10

[PATCH] KVM: use struct_size() and flex_array_size() helpers in kvm_io_bus_unregister_dev()

. Silva Signed-off-by: Rustam Kovhaev --- virt/kvm/kvm_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index cf88233b819a..68edd25dcb11 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -4350,10 +4350,10 @@ void

[RESEND PATCH v2] KVM: fix memory leak in kvm_io_bus_unregister_dev()

and-tested-by: syzbot+f196caa45793d6374...@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=f196caa45793d6374707 Signed-off-by: Rustam Kovhaev Reviewed-by: Vitaly Kuznetsov --- v2: - remove redundant whitespace - remove goto statement and use if/else - add Fixes tag ---

Re: [PATCH v2] KVM: fix memory leak in kvm_io_bus_unregister_dev()

On Wed, Sep 02, 2020 at 06:34:11PM -0500, Gustavo A. R. Silva wrote: > Hi, > > On 9/2/20 17:57, Rustam Kovhaev wrote: > > when kmalloc() fails in kvm_io_bus_unregister_dev(), before removing > > the bus, we should iterate over all other devices linked to it and call > &

[PATCH v2] KVM: fix memory leak in kvm_io_bus_unregister_dev()

?extid=f196caa45793d6374707 Signed-off-by: Rustam Kovhaev Reviewed-by: Vitaly Kuznetsov --- v2: - remove redundant whitespace - remove goto statement and use if/else --- virt/kvm/kvm_main.c | 21 - 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/virt/kvm/kvm_main.c

Re: [PATCH] veth: fix memory leak in veth_newlink()

On Tue, Sep 01, 2020 at 01:01:27PM -0700, David Miller wrote: > From: Rustam Kovhaev > Date: Sun, 30 Aug 2020 06:13:36 -0700 > > > when register_netdevice(dev) fails we should check whether struct > > veth_rq has been allocated via ndo_init callback and free it, b

Re: [PATCH] KVM: fix memory leak in kvm_io_bus_unregister_dev()

On Tue, Sep 01, 2020 at 06:25:42PM +0200, Vitaly Kuznetsov wrote: > Rustam Kovhaev writes: > > > when kmalloc() fails in kvm_io_bus_unregister_dev(), before removing > > the bus, we should iterate over all other devices linked to it and call > > kvm_iodevi

Re: [PATCH] veth: fix memory leak in veth_newlink()

On Mon, Aug 31, 2020 at 09:16:32AM +0900, Toshiaki Makita wrote: > On 2020/08/30 22:13, Rustam Kovhaev wrote: > > when register_netdevice(dev) fails we should check whether struct > > veth_rq has been allocated via ndo_init callback and free it, because, > > depen

[PATCH] veth: fix memory leak in veth_newlink()

...@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=59ef240dd8f0ed7598a8 Signed-off-by: Rustam Kovhaev --- drivers/net/veth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/veth.c b/drivers/net/veth.c index a475f48d43c4..e40ca62a046a 100644 --- a/drivers/net

[PATCH] KVM: fix memory leak in kvm_io_bus_unregister_dev()

?extid=f196caa45793d6374707 Signed-off-by: Rustam Kovhaev --- virt/kvm/kvm_main.c | 7 ++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 67cd0b88a6b6..646aa7b82548 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -4332,7

[PATCH] ntfs: add check for mft record size in superblock

com Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e Signed-off-by: Rustam Kovhaev Acked-by: Anton Altaparmakov --- fs/ntfs/inode.c | 6 ++ 1 file changed, 6 insertions(+) diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c index 9bb9f0952b18..caf563981532 100644 --- a/fs/n

Re: [PATCH] ntfs: add check for mft record size in superblock

On Mon, Aug 24, 2020 at 01:44:06AM +, Anton Altaparmakov wrote: > Hi Rustam, > > Thank you for the patch but it introduces an endianness bug - you have to us > le32_to_cpu(m->bytes_allocated) both when doing the comparison and then > printing the message. > > Also, please drop the square

[PATCH] ntfs: add check for mft record size in superblock

com Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e Signed-off-by: Rustam Kovhaev --- fs/ntfs/inode.c | 6 ++ 1 file changed, 6 insertions(+) diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c index 9bb9f0952b18..6407af7c2e4f 100644 --- a/fs/ntfs/inode.c +++ b/fs/ntfs/inod

Re: [PATCH] cfg80211: switch from WARN() to pr_warn() in is_user_regdom_saved()

On Wed, Aug 19, 2020 at 10:46:34AM +0200, Johannes Berg wrote: > On Tue, 2020-08-04 at 14:05 -0700, Rustam Kovhaev wrote: > > this warning can be triggered by userspace, so it should not cause a > > panic if panic_on_warn is set > > This is incorrect, it just addresses a par

[PATCH] scripts/tags.sh: exclude tools directory from tags generation

objtool.c: No such file or directory ... let's exclude tools directory from tags generation Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely") Link: https://lore.kernel.org/lkml/20200809210056.GA1344537@thinkpad Signed-off-by: Rustam Kovhaev --- scripts/tags.sh | 8 ++-

Re: realpath "No such file or directory" warnings when building tags from KBUILD_OUTPUT directory

On Sun, Aug 09, 2020 at 09:16:27AM +0200, Greg Kroah-Hartman wrote: > On Sat, Aug 08, 2020 at 01:28:22PM -0700, Rustam Kovhaev wrote: > > running 'make ARCH=x86_64 COMPILED_SOURCE=1 cscope tags' in > > KBUILD_OUTPUT directory produces lots of "No such file or directory" &

realpath "No such file or directory" warnings when building

tags from KBUILD_OUTPUT directory Reply-To: running 'make ARCH=x86_64 COMPILED_SOURCE=1 cscope tags' in KBUILD_OUTPUT directory produces lots of "No such file or directory" warnings from realpath it seems like commit 4f491bb6ea2a greatly improved tags generation when COMPILED_SOURCE=1 is set,

Re: memory leak in do_eventfd

On Thu, Jun 04, 2020 at 09:24:02PM -0700, Eric Biggers wrote: > [+Cc kvm mailing list] > > On Wed, May 20, 2020 at 06:12:17PM -0700, syzbot wrote: > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit:5a9ffb95 Merge tag '5.7-rc5-smb3-fixes' of git://git.samba.. > > git

[PATCH] cfg80211: switch from WARN() to pr_warn() in is_user_regdom_saved()

this warning can be triggered by userspace, so it should not cause a panic if panic_on_warn is set Reported-and-tested-by: syzbot+d451401ffd00a6067...@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d451401ffd00a60677ee Signed-off-by: Rustam Kovhaev --- net/wireless

Re: KASAN: use-after-free Read in netdevice_event_work_handler

On Sun, Aug 02, 2020 at 07:22:26PM -0300, Jason Gunthorpe wrote: > On Fri, Jul 31, 2020 at 02:11:22PM -0700, Rustam Kovhaev wrote: > > > IB roce driver receives NETDEV_UNREGISTER event, calls dev_hold() and > > schedules work item to execute, and before wq gets a chance to c

[PATCH] staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()

hfa384x_create() Fixes: faaff9765664 ("staging: wlan-ng: properly check endpoint types") Reported-and-tested-by: syzbot+22794221ab96b0bab...@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=22794221ab96b0bab53a Signed-off-by: Rustam Kovhaev --- drivers/stagi

Re: KASAN: use-after-free Read in netdevice_event_work_handler

On Fri, Jul 31, 2020 at 02:11:22PM -0700, Rustam Kovhaev wrote: > On Thu, Jul 09, 2020 at 04:54:19PM -0700, syzbot wrote: > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit:0bddd227 Documentation: update for gcc 4.9 require

Re: KASAN: use-after-free Read in netdevice_event_work_handler

On Thu, Jul 09, 2020 at 04:54:19PM -0700, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit:0bddd227 Documentation: update for gcc 4.9 requirement > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=1418afb710 > kernel

[PATCH] usb: hso: check for return value in hso_serial_common_create()

in case of an error tty_register_device_attr() returns ERR_PTR(), add IS_ERR() check Reported-and-tested-by: syzbot+67b2bd0e34f952d03...@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=67b2bd0e34f952d0321e Signed-off-by: Rustam Kovhaev --- drivers/net/usb/hso.c | 5

[PATCH] staging: wlan-ng: properly check endpoint types

-by: Rustam Kovhaev --- drivers/staging/wlan-ng/prism2usb.c | 16 +++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c index 4689b2170e4f..456603fd26c0 100644 --- a/drivers/staging/wlan-ng

Re: [PATCH] staging: wlan-ng: properly check endpoint types

On Sun, Jul 19, 2020 at 11:23:38AM +0200, Greg KH wrote: > On Sat, Jul 18, 2020 at 08:58:36AM -0700, Rustam Kovhaev wrote: > > As syzkaller detected, wlan-ng driver submits bulk urb without checking > > that the endpoint type is actually bulk, add usb_urb_ep_type_check() &g

[PATCH] staging: wlan-ng: properly check endpoint types

-by: Rustam Kovhaev --- drivers/staging/wlan-ng/hfa384x_usb.c | 14 ++ 1 file changed, 14 insertions(+) diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c index fa1bf8b069fd..7cde60ea68a2 100644 --- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b

[PATCH] staging: rtl8712: handle firmware load failure

?extid=80899a8a8efe8968cde7 Signed-off-by: Rustam Kovhaev --- drivers/staging/rtl8712/hal_init.c | 3 ++- drivers/staging/rtl8712/usb_intf.c | 11 --- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c