From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Edward Lo <loyuantsung@gmail.com>,
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 6.4 28/40] fs/ntfs3: Return error for inconsistent extended attributes
Date: Sun, 23 Jul 2023 21:31:28 -0400 [thread overview]
Message-ID: <20230724013140.2327815-28-sashal@kernel.org> (raw)
In-Reply-To: <20230724013140.2327815-1-sashal@kernel.org>
From: Edward Lo <loyuantsung@gmail.com>
[ Upstream commit c9db0ff04649aa0b45f497183c957fe260f229f6 ]
ntfs_read_ea is called when we want to read extended attributes. There
are some sanity checks for the validity of the EAs. However, it fails to
return a proper error code for the inconsistent attributes, which might
lead to unpredicted memory accesses after return.
[ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0
[ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199
[ 138.931132]
[ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4
[ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[ 138.947327] Call Trace:
[ 138.949557] <TASK>
[ 138.951539] dump_stack_lvl+0x4d/0x67
[ 138.956834] print_report+0x16f/0x4a6
[ 138.960798] ? ntfs_set_ea+0x453/0xbf0
[ 138.964437] ? kasan_complete_mode_report_info+0x7d/0x200
[ 138.969793] ? ntfs_set_ea+0x453/0xbf0
[ 138.973523] kasan_report+0xb8/0x140
[ 138.976740] ? ntfs_set_ea+0x453/0xbf0
[ 138.980578] __asan_store4+0x76/0xa0
[ 138.984669] ntfs_set_ea+0x453/0xbf0
[ 138.988115] ? __pfx_ntfs_set_ea+0x10/0x10
[ 138.993390] ? kernel_text_address+0xd3/0xe0
[ 138.998270] ? __kernel_text_address+0x16/0x50
[ 139.002121] ? unwind_get_return_address+0x3e/0x60
[ 139.005659] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 139.010177] ? arch_stack_walk+0xa2/0x100
[ 139.013657] ? filter_irq_stacks+0x27/0x80
[ 139.017018] ntfs_setxattr+0x405/0x440
[ 139.022151] ? __pfx_ntfs_setxattr+0x10/0x10
[ 139.026569] ? kvmalloc_node+0x2d/0x120
[ 139.030329] ? kasan_save_stack+0x41/0x60
[ 139.033883] ? kasan_save_stack+0x2a/0x60
[ 139.037338] ? kasan_set_track+0x29/0x40
[ 139.040163] ? kasan_save_alloc_info+0x1f/0x30
[ 139.043588] ? __kasan_kmalloc+0x8b/0xa0
[ 139.047255] ? __kmalloc_node+0x68/0x150
[ 139.051264] ? kvmalloc_node+0x2d/0x120
[ 139.055301] ? vmemdup_user+0x2b/0xa0
[ 139.058584] __vfs_setxattr+0x121/0x170
[ 139.062617] ? __pfx___vfs_setxattr+0x10/0x10
[ 139.066282] __vfs_setxattr_noperm+0x97/0x300
[ 139.070061] __vfs_setxattr_locked+0x145/0x170
[ 139.073580] vfs_setxattr+0x137/0x2a0
[ 139.076641] ? __pfx_vfs_setxattr+0x10/0x10
[ 139.080223] ? __kasan_check_write+0x18/0x20
[ 139.084234] do_setxattr+0xce/0x150
[ 139.087768] setxattr+0x126/0x140
[ 139.091250] ? __pfx_setxattr+0x10/0x10
[ 139.094948] ? __virt_addr_valid+0xcb/0x140
[ 139.097838] ? __call_rcu_common.constprop.0+0x1c7/0x330
[ 139.102688] ? debug_smp_processor_id+0x1b/0x30
[ 139.105985] ? kasan_quarantine_put+0x5b/0x190
[ 139.109980] ? putname+0x84/0xa0
[ 139.113886] ? __kasan_slab_free+0x11e/0x1b0
[ 139.117961] ? putname+0x84/0xa0
[ 139.121316] ? preempt_count_sub+0x1c/0xd0
[ 139.124427] ? __mnt_want_write+0xae/0x100
[ 139.127836] ? mnt_want_write+0x8f/0x150
[ 139.130954] path_setxattr+0x164/0x180
[ 139.133998] ? __pfx_path_setxattr+0x10/0x10
[ 139.137853] ? __pfx_ksys_pwrite64+0x10/0x10
[ 139.141299] ? debug_smp_processor_id+0x1b/0x30
[ 139.145714] ? fpregs_assert_state_consistent+0x6b/0x80
[ 139.150796] __x64_sys_setxattr+0x71/0x90
[ 139.155407] do_syscall_64+0x3f/0x90
[ 139.159035] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 139.163843] RIP: 0033:0x7f108cae4469
[ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088
[ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc
[ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469
[ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6
[ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618
[ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0
[ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15: 0000000000000000
Signed-off-by: Edward Lo <loyuantsung@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/xattr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index c3de60a4543fa..c78d83f306689 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -141,6 +141,7 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea,
memset(Add2Ptr(ea_p, size), 0, add_bytes);
+ err = -EINVAL;
/* Check all attributes for consistency. */
for (off = 0; off < size; off += ea_size) {
const struct EA_FULL *ef = Add2Ptr(ea_p, off);
--
2.39.2
next prev parent reply other threads:[~2023-07-24 1:40 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-24 1:31 [PATCH AUTOSEL 6.4 01/40] serial: stm32: Ignore return value of uart_remove_one_port() in .remove() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 02/40] led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 03/40] media: v4l2-mem2mem: add lock to protect parameter num_rdy Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 04/40] media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250 Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 05/40] usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 06/40] usb: gadget: uvc: queue empty isoc requests if no video buffer is available Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 07/40] media: platform: mediatek: vpu: fix NULL ptr dereference Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 08/40] thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 09/40] xhci: Don't require a valid get_quirks() function pointer during xhci setup Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 10/40] xhci: get rid of XHCI_PLAT quirk that used to prevent MSI setup Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 11/40] usb: chipidea: imx: don't request QoS for imx8ulp Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 12/40] usb: cdns2: Device side header file for CDNS2 driver Sasha Levin
2023-07-24 4:09 ` Greg Kroah-Hartman
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 13/40] usb: chipidea: imx: turn off vbus comparator when suspend Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 14/40] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting Sasha Levin
2023-07-24 1:31 ` [Cluster-devel] [PATCH AUTOSEL 6.4 15/40] gfs2: Fix possible data races in gfs2_show_options() Sasha Levin
2023-07-24 1:31 ` Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 16/40] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 17/40] thunderbolt: Add Intel Barlow Ridge PCI ID Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 18/40] thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 19/40] firewire: net: fix use after free in fwnet_finish_incoming_packet() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 20/40] watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 21/40] Bluetooth: L2CAP: Fix use-after-free Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 22/40] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 23/40] Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 24/40] ceph: try to dump the msgs when decoding fails Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 25/40] drm/amdgpu: Fix potential fence use-after-free v2 Sasha Levin
2023-07-24 1:31 ` Sasha Levin
2023-07-24 1:31 ` [f2fs-dev] [PATCH AUTOSEL 6.4 26/40] f2fs: fix to do sanity check on direct node in truncate_dnode() Sasha Levin
2023-07-24 1:31 ` Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 27/40] fs/ntfs3: Enhance sanity check while generating attr_list Sasha Levin
2023-07-24 1:31 ` Sasha Levin [this message]
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 29/40] fs: ntfs3: Fix possible null-pointer dereferences in mi_read() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 30/40] fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 31/40] fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 32/40] fs/ntfs3: Alternative boot if primary boot " Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 33/40] ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 34/40] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 35/40] ALSA: hda/realtek: Add quirk for ASUS ROG GX650P Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 36/40] ALSA: hda/realtek: Add quirk for ASUS ROG GA402X Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 37/40] ALSA: hda/realtek: Amend G634 quirk to enable rear speakers Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 38/40] ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 39/40] apparmor: fix use of strcpy in policy_unpack_test Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 40/40] ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230724013140.2327815-28-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=linux-kernel@vger.kernel.org \
--cc=loyuantsung@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.