mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-20 01:20:54 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs/hfs
History
ZhangPeng c53ed55cb2 hfs: Fix OOB Write in hfs_asc2mac 
Syzbot reported a OOB Write bug:

loop0: detected capacity change from 0 to 64
==================================================================
BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0
fs/hfs/trans.c:133
Write of size 1 at addr ffff88801848314e by task syz-executor391/3632

Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
 print_address_description+0x74/0x340 mm/kasan/report.c:284
 print_report+0x107/0x1f0 mm/kasan/report.c:395
 kasan_report+0xcd/0x100 mm/kasan/report.c:495
 hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133
 hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28
 hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31
 lookup_open fs/namei.c:3391 [inline]
 open_last_lookups fs/namei.c:3481 [inline]
 path_openat+0x10e6/0x2df0 fs/namei.c:3710
 do_filp_open+0x264/0x4f0 fs/namei.c:3740

If in->len is much larger than HFS_NAMELEN(31) which is the maximum
length of an HFS filename, a OOB write could occur in hfs_asc2mac(). In
that case, when the dst reaches the boundary, the srclen is still
greater than 0, which causes a OOB write.
Fix this by adding a check on dstlen in while() before writing to dst
address.

Link: https://lkml.kernel.org/r/20221202030038.1391945-1-zhangpeng362@huawei.com
Fixes: 328b922786 ("[PATCH] hfs: NLS support")
Signed-off-by: ZhangPeng <zhangpeng362@huawei.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Reported-by: <syzbot+dc3b1cf9111ab5fe98e7@syzkaller.appspotmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2022-12-11 19:30:19 -08:00
..
attr.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
bfind.c hfs: add lock nesting notation to hfs_find_init 2021-07-15 10:13:49 -07:00
bitmap.c
bnode.c hfs: replace kmap() with kmap_local_page() in bnode.c 2022-09-11 21:55:08 -07:00
brec.c hfs: fix BUG on bnode parent update 2018-10-31 08:54:13 -07:00
btree.c hfs: replace kmap() with kmap_local_page() in btree.c 2022-09-11 21:55:09 -07:00
btree.h hfs: add lock nesting notation to hfs_find_init 2021-07-15 10:13:49 -07:00
catalog.c hfs: prevent btree data loss on ENOSPC 2018-10-31 08:54:13 -07:00
dir.c fs: make helpers idmap mount aware 2021-01-24 14:27:20 +01:00
extent.c hfs: Call hfs_write_begin() and generic_write_end() directly 2022-05-08 14:45:56 -04:00
hfs.h
hfs_fs.h hfs: Call hfs_write_begin() and generic_write_end() directly 2022-05-08 14:45:56 -04:00
inode.c hfs: fix OOB Read in __hfs_brec_find 2022-12-11 19:30:19 -08:00
Kconfig docs: filesystems: fix renamed references 2020-04-20 15:45:22 -06:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
mdb.c block: remove genhd.h 2022-02-02 07:49:59 -07:00
part_tbl.c
string.c get rid of 'parent' argument of ->d_compare() 2016-07-31 16:37:25 -04:00
super.c fs: allocate inode by using alloc_inode_sb() 2022-03-22 15:57:03 -07:00
sysdep.c VFS: normal filesystems (and lustre): d_inode() annotations 2015-04-15 15:06:57 -04:00
trans.c hfs: Fix OOB Write in hfs_asc2mac 2022-12-11 19:30:19 -08:00