From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8195AC4332F for ; Mon, 12 Dec 2022 03:31:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231180AbiLLDbk (ORCPT ); Sun, 11 Dec 2022 22:31:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33750 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230506AbiLLDb1 (ORCPT ); Sun, 11 Dec 2022 22:31:27 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4645EDE8F for ; Sun, 11 Dec 2022 19:31:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D81BC60ED1 for ; Mon, 12 Dec 2022 03:31:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E425C433F0; Mon, 12 Dec 2022 03:31:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1670815878; bh=Lw2vInf7T7/PvZJ6V8WRZgJonNSktXgxIk+nN7rtGCU=; h=Date:To:From:Subject:From; b=n/x45SXT6RSlrMDTn9UFn3WBB1+dklLtSy60TtIAGxShT1yJF6pBZha8MJ+J/prQc iY5qdVWj0TERnzOmBZ/Hnucfypz0yeH5wY1I1gO2INp+khqf4Rgne4yGu4ANKp5Peq +5n8ZByYZNpEOKv/uFWeqAQmE84ROvMM8lwa6Jvs= Date: Sun, 11 Dec 2022 19:31:17 -0800 To: mm-commits@vger.kernel.org, syzbot+dc3b1cf9111ab5fe98e7@syzkaller.appspotmail.com, slava@dubeyko.com, zhangpeng362@huawei.com, akpm@linux-foundation.org From: Andrew Morton Subject: [merged mm-nonmm-stable] hfs-fix-oob-write-in-hfs_asc2mac.patch removed from -mm tree Message-Id: <20221212033118.3E425C433F0@smtp.kernel.org> Precedence: bulk Reply-To: linux-kernel@vger.kernel.org List-ID: X-Mailing-List: mm-commits@vger.kernel.org The quilt patch titled Subject: hfs: Fix OOB Write in hfs_asc2mac has been removed from the -mm tree. Its filename was hfs-fix-oob-write-in-hfs_asc2mac.patch This patch was dropped because it was merged into the mm-nonmm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: ZhangPeng Subject: hfs: Fix OOB Write in hfs_asc2mac Date: Fri, 2 Dec 2022 03:00:38 +0000 Syzbot reported a OOB Write bug: loop0: detected capacity change from 0 to 64 ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 Write of size 1 at addr ffff88801848314e by task syz-executor391/3632 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28 hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 If in->len is much larger than HFS_NAMELEN(31) which is the maximum length of an HFS filename, a OOB write could occur in hfs_asc2mac(). In that case, when the dst reaches the boundary, the srclen is still greater than 0, which causes a OOB write. Fix this by adding a check on dstlen in while() before writing to dst address. Link: https://lkml.kernel.org/r/20221202030038.1391945-1-zhangpeng362@huawei.com Fixes: 328b92278650 ("[PATCH] hfs: NLS support") Signed-off-by: ZhangPeng Reviewed-by: Viacheslav Dubeyko Reported-by: Signed-off-by: Andrew Morton --- fs/hfs/trans.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/hfs/trans.c~hfs-fix-oob-write-in-hfs_asc2mac +++ a/fs/hfs/trans.c @@ -109,7 +109,7 @@ void hfs_asc2mac(struct super_block *sb, if (nls_io) { wchar_t ch; - while (srclen > 0) { + while (srclen > 0 && dstlen > 0) { size = nls_io->char2uni(src, srclen, &ch); if (size < 0) { ch = '?'; _ Patches currently in -mm which might be from zhangpeng362@huawei.com are