linux-stable/fs/ext4
Baokun Li f6b1a1cf1c ext4: fix use-after-free in ext4_ext_shift_extents
If the starting position of our insert range happens to be in the hole
between the two ext4_extent_idx, because the lblk of the ext4_extent in
the previous ext4_extent_idx is always less than the start, which leads
to the "extent" variable access across the boundary, the following UAF is
triggered:
==================================================================
BUG: KASAN: use-after-free in ext4_ext_shift_extents+0x257/0x790
Read of size 4 at addr ffff88819807a008 by task fallocate/8010
CPU: 3 PID: 8010 Comm: fallocate Tainted: G            E     5.10.0+ #492
Call Trace:
 dump_stack+0x7d/0xa3
 print_address_description.constprop.0+0x1e/0x220
 kasan_report.cold+0x67/0x7f
 ext4_ext_shift_extents+0x257/0x790
 ext4_insert_range+0x5b6/0x700
 ext4_fallocate+0x39e/0x3d0
 vfs_fallocate+0x26f/0x470
 ksys_fallocate+0x3a/0x70
 __x64_sys_fallocate+0x4f/0x60
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
==================================================================

For right shifts, we can divide them into the following situations:

1. When the first ee_block of ext4_extent_idx is greater than or equal to
   start, make right shifts directly from the first ee_block.
    1) If it is greater than start, we need to continue searching in the
       previous ext4_extent_idx.
    2) If it is equal to start, we can exit the loop (iterator=NULL).

2. When the first ee_block of ext4_extent_idx is less than start, then
   traverse from the last extent to find the first extent whose ee_block
   is less than start.
    1) If extent is still the last extent after traversal, it means that
       the last ee_block of ext4_extent_idx is less than start, that is,
       start is located in the hole between idx and (idx+1), so we can
       exit the loop directly (break) without right shifts.
    2) Otherwise, make right shifts at the corresponding position of the
       found extent, and then exit the loop (iterator=NULL).

Fixes: 331573febb ("ext4: Add support FALLOC_FL_INSERT_RANGE for fallocate")
Cc: stable@vger.kernel.org # v4.2+
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Link: https://lore.kernel.org/r/20220922120434.1294789-1-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2022-11-07 12:53:43 -05:00
..
.kunitconfig ext4: add .kunitconfig fragment to enable ext4-specific tests 2021-02-11 23:16:30 -05:00
acl.c fs/ext4: fix comments mentioning i_mutex 2022-02-03 10:57:53 -05:00
acl.h vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
balloc.c ext4: use ext4_debug() instead of jbd_debug() 2022-08-02 23:52:19 -04:00
bitmap.c
block_validity.c ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid() 2022-02-25 21:34:56 -05:00
crypto.c ext4: refactor and move ext4_ioctl_get_encryption_pwsalt() 2022-05-21 22:24:24 -04:00
dir.c ext4: fix spelling errors in comments 2022-05-11 15:19:06 -04:00
ext4.h The first two changes that involve files outside of fs/ext4: 2022-10-06 17:45:53 -07:00
ext4_extents.h ext4: fix sparse warnings 2021-08-30 23:36:50 -04:00
ext4_jbd2.c ext4: use ext4_debug() instead of jbd_debug() 2022-08-02 23:52:19 -04:00
ext4_jbd2.h fs/ext4: fix comments mentioning i_mutex 2022-02-03 10:57:53 -05:00
extents.c ext4: fix use-after-free in ext4_ext_shift_extents 2022-11-07 12:53:43 -05:00
extents_status.c ext4: factor out ext4_free_ext_path() 2022-09-30 23:46:54 -04:00
extents_status.h
fast_commit.c ext4: fix fortify warning in fs/ext4/fast_commit.c:1551 2022-11-06 01:07:59 -04:00
fast_commit.h ext4: introduce EXT4_FC_TAG_BASE_LEN helper 2022-09-30 23:46:54 -04:00
file.c The first two changes that involve files outside of fs/ext4: 2022-10-06 17:45:53 -07:00
fsmap.c treewide: Change list_sort to use const pointers 2021-04-08 16:04:22 -07:00
fsmap.h ext4: fsmap: fix the block/inode bitmap comment 2021-06-24 09:48:29 -04:00
fsync.c block: use an on-stack bio in blkdev_issue_flush 2021-01-27 09:51:48 -07:00
hash.c unicode: clean up the Kconfig symbol confusion 2022-01-20 19:57:24 -05:00
ialloc.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
indirect.c ext4: use ext4_debug() instead of jbd_debug() 2022-08-02 23:52:19 -04:00
inline.c ext4: correct max_inline_xattr_value_size computing 2022-08-02 23:52:44 -04:00
inode-test.c fs: ext4: Modify inode-test.c to use KUnit parameterized testing feature 2020-12-02 16:07:25 -07:00
inode.c The first two changes that involve files outside of fs/ext4: 2022-10-06 17:45:53 -07:00
ioctl.c Fix a number of bug fixes, including some regressions, the most 2022-11-06 10:30:29 -08:00
Kconfig ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it 2021-02-11 23:12:59 -05:00
Makefile ext4: move ext4 crypto code to its own file crypto.c 2022-05-21 22:24:24 -04:00
mballoc.c ext4: fixup possible uninitialized variable access in ext4_mb_choose_next_group_cr1() 2022-09-26 13:21:05 -04:00
mballoc.h ext4: use buckets for cr 1 block scan instead of rbtree 2022-09-21 22:12:03 -04:00
migrate.c ext4: fix warning in 'ext4_da_release_space' 2022-11-06 01:07:59 -04:00
mmp.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
move_extent.c ext4: factor out ext4_free_ext_path() 2022-09-30 23:46:54 -04:00
namei.c Fix a number of bug fixes, including some regressions, the most 2022-11-06 10:30:29 -08:00
orphan.c ext4: use ext4_debug() instead of jbd_debug() 2022-08-02 23:52:19 -04:00
page-io.c ext4: fix incorrect comment in ext4_bio_write_page() 2022-06-16 11:03:16 -04:00
readpage.c fscrypt: stop using PG_error to track error status 2022-09-06 15:15:56 -07:00
resize.c ext4: update the backup superblock's at the end of the online resize 2022-10-27 23:21:40 -04:00
super.c Fix a number of bug fixes, including some regressions, the most 2022-11-06 10:30:29 -08:00
symlink.c ext4: fix reading leftover inlined symlinks 2022-08-02 23:37:50 -04:00
sysfs.c unicode: clean up the Kconfig symbol confusion 2022-01-20 19:57:24 -05:00
truncate.h ext4: Convert to use mapping->invalidate_lock 2021-07-13 14:29:00 +02:00
verity.c - Alistair Popple has a series which addresses a race which causes page 2022-10-14 12:28:43 -07:00
xattr.c ext4: fix i_version handling in ext4 2022-09-30 23:46:52 -04:00
xattr.h ext4: remove EA inode entry from mbcache on inode eviction 2022-08-02 23:56:25 -04:00
xattr_hurd.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_security.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_trusted.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_user.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00