Re: [syzbot] [net?] KASAN: slab-out-of-bounds Read in dns_resolver_preparse

From: syzbot
Date: Thu Dec 14 2023 - 08:59:07 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: [net?] KASAN: slab-out-of-bounds Read in dns_resolver_preparse
Author: eadavis@xxxxxx

please test slab-out-of-bounds Read in dns_resolver_preparse

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 48e8992e33ab
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 10ba439968f7..f28ba8a703fe 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -83,7 +83,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
long ret;

ret = -EINVAL;
- if (plen > 1024 * 1024 - 1)
+ if (plen > 1024 * 1024 - 1 || plen < 48)
goto error;

/* draw all the data into kernel space */