mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/fs/ntfs
History
ChenXiaoSong 24fdba11a5 ntfs: fix use-after-free in ntfs_ucsncmp() 
commit 38c9c22a85 upstream.

Syzkaller reported use-after-free bug as follows:

==================================================================
BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130
Read of size 2 at addr ffff8880751acee8 by task a.out/879

CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5218c8bd2c-dirty #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x1c0/0x2b0
 print_address_description.constprop.0.cold+0xd4/0x484
 print_report.cold+0x55/0x232
 kasan_report+0xbf/0xf0
 ntfs_ucsncmp+0x123/0x130
 ntfs_are_names_equal.cold+0x2b/0x41
 ntfs_attr_find+0x43b/0xb90
 ntfs_attr_lookup+0x16d/0x1e0
 ntfs_read_locked_attr_inode+0x4aa/0x2360
 ntfs_attr_iget+0x1af/0x220
 ntfs_read_locked_inode+0x246c/0x5120
 ntfs_iget+0x132/0x180
 load_system_files+0x1cc6/0x3480
 ntfs_fill_super+0xa66/0x1cf0
 mount_bdev+0x38d/0x460
 legacy_get_tree+0x10d/0x220
 vfs_get_tree+0x93/0x300
 do_new_mount+0x2da/0x6d0
 path_mount+0x496/0x19d0
 __x64_sys_mount+0x284/0x300
 do_syscall_64+0x3b/0xc0
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f3f2118d9ea
Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00
RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44
R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

The buggy address belongs to the physical page:
page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:0x555c6a81d pfn:0x751ac
memcg:ffff888101f7e180
anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201
raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                          ^
 ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

The reason is that struct ATTR_RECORD->name_offset is 6485, end address of
name string is out of bounds.

Fix this by adding sanity check on end address of attribute name string.

[akpm@linux-foundation.org: coding-style cleanups]
[chenxiaosong2@huawei.com: cleanup suggested by Hawkins Jiawei]
  Link: https://lkml.kernel.org/r/20220709064511.3304299-1-chenxiaosong2@huawei.com
Link: https://lkml.kernel.org/r/20220707105329.4020708-1-chenxiaosong2@huawei.com
Signed-off-by: ChenXiaoSong <chenxiaosong2@huawei.com>
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Cc: Anton Altaparmakov <anton@tuxera.com>
Cc: ChenXiaoSong <chenxiaosong2@huawei.com>
Cc: Yongqiang Liu <liuyongqiang13@huawei.com>
Cc: Zhang Yi <yi.zhang@huawei.com>
Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2022-08-03 12:05:16 +02:00
..
Kconfig fs: ntfs: Limit NTFS_RW to page sizes smaller than 64k 2021-11-27 14:34:41 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
aops.c ntfs: Correct mark_ntfs_record_dirty() folio conversion 2022-04-01 14:40:44 -04:00
aops.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
attrib.c ntfs: fix use-after-free in ntfs_ucsncmp() 2022-08-03 12:05:16 +02:00
attrib.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
bitmap.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
bitmap.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
collate.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
collate.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
compress.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
debug.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
debug.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
dir.c ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type 2020-08-07 11:33:21 -07:00
dir.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
endian.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
file.c gfs2: Fix mmap + page fault deadlocks 2021-11-02 12:25:03 -07:00
index.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
index.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
inode.c fs: allocate inode by using alloc_inode_sb() 2022-03-22 15:57:03 -07:00
inode.h fs: make helpers idmap mount aware 2021-01-24 14:27:20 +01:00
layout.h ntfs: layout.h: delete duplicated words 2021-02-24 13:38:26 -08:00
lcnalloc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
lcnalloc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
logfile.c fs/ntfs: remove unused varibles 2020-12-15 12:13:37 -08:00
logfile.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
malloc.h mm: remove the pgprot argument to __vmalloc 2020-06-02 10:59:11 -07:00
mft.c ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type 2020-08-07 11:33:21 -07:00
mft.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
mst.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
namei.c ntfs: remove (un)?likely() from IS_ERR() conditions 2019-09-26 10:10:44 -07:00
ntfs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
quota.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
quota.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
runlist.c ntfs: remove (un)?likely() from IS_ERR() conditions 2019-09-26 10:10:44 -07:00
runlist.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
super.c ntfs: use sb_bdev_nr_blocks 2021-10-18 14:43:23 -06:00
sysctl.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
sysctl.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
time.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
types.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
unistr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
upcase.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 97 2019-05-24 17:37:53 +02:00
usnjrnl.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
usnjrnl.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
volume.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00