mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/fs/ntfs3
History
Ye Bin 329fc4d3f7 fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' 
[ Upstream commit db2a3cc6a3 ]

Syzbot found the following issue:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000016
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af56000
[0000000000000016] pgd=08000001090da003, p4d=08000001090da003, pud=08000001090ce003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3036 Comm: syz-executor206 Not tainted 6.0.0-rc6-syzkaller-17739-g16c9f284e746 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : is_rec_inuse fs/ntfs3/ntfs.h:313 [inline]
pc : ni_write_inode+0xac/0x798 fs/ntfs3/frecord.c:3232
lr : ni_write_inode+0xa0/0x798 fs/ntfs3/frecord.c:3226
sp : ffff8000126c3800
x29: ffff8000126c3860 x28: 0000000000000000 x27: ffff0000c8b02000
x26: ffff0000c7502320 x25: ffff0000c7502288 x24: 0000000000000000
x23: ffff80000cbec91c x22: ffff0000c8b03000 x21: ffff0000c8b02000
x20: 0000000000000001 x19: ffff0000c75024d8 x18: 00000000000000c0
x17: ffff80000dd1b198 x16: ffff80000db59158 x15: ffff0000c4b6b500
x14: 00000000000000b8 x13: 0000000000000000 x12: ffff0000c4b6b500
x11: ff80800008be1b60 x10: 0000000000000000 x9 : ffff0000c4b6b500
x8 : 0000000000000000 x7 : ffff800008be1b50 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
 is_rec_inuse fs/ntfs3/ntfs.h:313 [inline]
 ni_write_inode+0xac/0x798 fs/ntfs3/frecord.c:3232
 ntfs_evict_inode+0x54/0x84 fs/ntfs3/inode.c:1744
 evict+0xec/0x334 fs/inode.c:665
 iput_final fs/inode.c:1748 [inline]
 iput+0x2c4/0x324 fs/inode.c:1774
 ntfs_new_inode+0x7c/0xe0 fs/ntfs3/fsntfs.c:1660
 ntfs_create_inode+0x20c/0xe78 fs/ntfs3/inode.c:1278
 ntfs_create+0x54/0x74 fs/ntfs3/namei.c:100
 lookup_open fs/namei.c:3413 [inline]
 open_last_lookups fs/namei.c:3481 [inline]
 path_openat+0x804/0x11c4 fs/namei.c:3688
 do_filp_open+0xdc/0x1b8 fs/namei.c:3718
 do_sys_openat2+0xb8/0x22c fs/open.c:1311
 do_sys_open fs/open.c:1327 [inline]
 __do_sys_openat fs/open.c:1343 [inline]
 __se_sys_openat fs/open.c:1338 [inline]
 __arm64_sys_openat+0xb0/0xe0 fs/open.c:1338
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190
Code: 97dafee4 340001b4 f9401328 2a1f03e0 (79402d14)
---[ end trace 0000000000000000 ]---

Above issue may happens as follows:
ntfs_new_inode
  mi_init
    mi->mrec = kmalloc(sbi->record_size, GFP_NOFS); -->failed to allocate memory
      if (!mi->mrec)
        return -ENOMEM;
iput
  iput_final
    evict
      ntfs_evict_inode
        ni_write_inode
	  is_rec_inuse(ni->mi.mrec)-> As 'ni->mi.mrec' is NULL trigger NULL-ptr-deref

To solve above issue if new inode failed make inode bad before call 'iput()' in
'ntfs_new_inode()'.

Reported-by: syzbot+f45957555ed4a808cc7a@syzkaller.appspotmail.com
Signed-off-by: Ye Bin <yebin10@huawei.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2024-03-06 14:45:06 +00:00
..
lib fs/ntfs3: Add missing header and guards to lib/ headers 2021-09-13 19:41:44 +03:00
Kconfig
…
Makefile
…
attrib.c fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() 2024-03-01 13:26:29 +01:00
attrlist.c fs/ntfs3: Disable ATTR_LIST_ENTRY size check 2024-03-01 13:26:29 +01:00
bitfunc.c fs/ntfs3: Remove a useless shadowing variable 2021-09-23 19:05:46 +03:00
bitmap.c fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN) 2023-11-08 14:10:58 +01:00
debug.h fs/ntfs3. Add forward declarations for structs to debug.h 2021-09-13 19:41:43 +03:00
dir.c fs/ntfs3: Improve ntfs_dir_count 2024-03-01 13:26:28 +01:00
file.c fs/ntfs3: Update inode->i_size after success write into compressed file 2024-03-01 13:26:29 +01:00
frecord.c fs/ntfs3: Fix NULL dereference in ni_write_inode 2024-03-06 14:45:06 +00:00
fslog.c fs/ntfs3: Correct function is_rst_area_valid 2024-03-01 13:26:29 +01:00
fsntfs.c fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' 2024-03-06 14:45:06 +00:00
index.c fs/ntfs3: Add length check in indx_get_root 2024-03-06 14:45:05 +00:00
inode.c fs/ntfs3: Print warning while fixing hard links count 2024-03-01 13:26:28 +01:00
lznt.c fs/ntfs3: Remove tabs before spaces from comment 2021-09-16 17:01:36 +03:00
namei.c fs/ntfs3: Refactoring of various minor issues 2023-05-17 11:53:51 +02:00
ntfs.h fs/ntfs3: Disable ATTR_LIST_ENTRY size check 2024-03-01 13:26:29 +01:00
ntfs_fs.h fs/ntfs3: Prevent generic message "attempt to access beyond end of device" 2024-03-01 13:26:29 +01:00
record.c fs/ntfs3: Enhance the attribute size check 2024-03-01 13:26:39 +01:00
run.c fs/ntfs3: Check fields while reading 2023-07-23 13:49:27 +02:00
super.c fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN) 2023-11-08 14:10:58 +01:00
upcase.c fs/ntfs3: Change right headers to upcase.c 2021-09-13 19:41:45 +03:00
xattr.c fs/ntfs3: Fix oob in ntfs_listxattr 2024-03-01 13:26:29 +01:00