Re: [syzbot] KASAN: slab-out-of-bounds Write in copy_verifier_state

[Aleksandr Nogikh]

On Mon, Feb 6, 2023 at 9:31 PM syzbot
<syzbot+59af7bf76d795311da8c@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit 45435d8da71f9f3e6860e6e6ea9667b6ec17ec64
> Author: Kees Cook <keescook@xxxxxxxxxxxx>
> Date:   Fri Dec 23 18:28:44 2022 +0000
>
>     bpf: Always use maximal size for copy_array()
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=14c62f23480000
> start commit:   041fae9c105a Merge tag 'f2fs-for-6.2-rc1' of git://git.ker..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e2f3d9d232a3cac5
> dashboard link: https://syzkaller.appspot.com/bug?extid=59af7bf76d795311da8c
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1650d477880000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1305f993880000
>
> If the result looks correct, please mark the issue as fixed by replying with:
>
> #syz fix: bpf: Always use maximal size for copy_array()

Seems reasonable to me.

#syz fix: bpf: Always use maximal size for copy_array()

>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@xxxxxxxxxxxxxxxx.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000ce7ebf05f40de992%40google.com.