From: Eric Biggers <ebiggers@kernel.org>
To: Alexander Potapenko <glider@google.com>
Cc: Jaegeuk Kim <jaegeuk@kernel.org>,
stable@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net
Subject: Re: [f2fs-dev] [PATCH] f2fs: fix information leak in f2fs_move_inline_dirents()
Date: Mon, 23 Jan 2023 18:19:20 +0000 [thread overview]
Message-ID: <Y87PqGgw1uJVlnrP@gmail.com> (raw)
In-Reply-To: <CAG_fn=VNjkRMozdcQUSMTHvMQ26SG45oisxamJbEVrg2m41ngg@mail.gmail.com>
On Mon, Jan 23, 2023 at 09:58:22AM +0100, Alexander Potapenko wrote:
> On Mon, Jan 23, 2023 at 8:05 AM Eric Biggers <ebiggers@kernel.org> wrote:
> >
> > From: Eric Biggers <ebiggers@google.com>
> >
> > When converting an inline directory to a regular one, f2fs is leaking
> > uninitialized memory to disk because it doesn't initialize the entire
> > directory block. Fix this by zero-initializing the block.
> >
> > This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded
> > initializing when converting inline dentry"), which didn't consider the
> > security implications of leaking uninitialized memory to disk.
> >
> > This was found by running xfstest generic/435 on a KMSAN-enabled kernel.
>
> Out of curiosity, did you add any extra annotations to detect uninit
> writes to the disk?
No. This is the report I got:
[ 145.280969] =====================================================
[ 145.285368] BUG: KMSAN: uninit-value in virtqueue_add+0x1ba5/0x6ac0
[ 145.289123] virtqueue_add+0x1ba5/0x6ac0
[ 145.291539] virtqueue_add_sgs+0x2ae/0x2c0
[ 145.294036] virtio_queue_rqs+0xa59/0x1270
[ 145.296566] blk_mq_flush_plug_list+0x34a/0x9e0
[ 145.299389] __blk_flush_plug+0x6b5/0x760
[ 145.301801] blk_finish_plug+0x92/0xd0
[ 145.304084] __f2fs_write_data_pages+0x3953/0x4140
[ 145.307011] f2fs_write_data_pages+0xf1/0x120
[ 145.309665] do_writepages+0x45c/0x980
[ 145.312017] filemap_fdatawrite+0x1d2/0x260
[ 145.314533] f2fs_sync_dirty_inodes+0x3a3/0xa40
[ 145.317272] f2fs_write_checkpoint+0xecc/0x2890
[ 145.320013] __checkpoint_and_complete_reqs+0x12e/0x660
[ 145.323126] issue_checkpoint_thread+0x10a/0x420
[ 145.325900] kthread+0x35c/0x490
[ 145.327995] ret_from_fork+0x1f/0x30
[ 145.330208]
[ 145.331242] Uninit was created at:
[ 145.333399] __alloc_pages+0x6f9/0xc90
[ 145.335716] alloc_pages+0x8aa/0xa20
[ 145.337921] folio_alloc+0x34/0x40
[ 145.340069] __filemap_get_folio+0xa9f/0x11a0
[ 145.342719] pagecache_get_page+0x5b/0x1b0
[ 145.345209] grab_cache_page_write_begin+0xa5/0xc0
[ 145.348096] do_convert_inline_dir+0x8dc/0x3680
[ 145.350812] f2fs_add_inline_entry+0x76a/0x11a0
[ 145.353532] f2fs_do_add_link+0x59b/0x970
[ 145.356009] f2fs_create+0x5b6/0x8c0
[ 145.358213] path_openat+0x25a5/0x46e0
[ 145.360547] do_filp_open+0x2ab/0x700
[ 145.362785] do_sys_openat2+0x20e/0x780
[ 145.365138] __x64_sys_openat+0x259/0x360
[ 145.367562] do_syscall_64+0x41/0x90
[ 145.369819] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 145.372895]
[ 145.373900] Bytes 2043-2050 of 4096 are uninitialized
[ 145.376857] Memory access of size 4096 starts at ffff888076818000
[ 145.380391]
[ 145.381429] CPU: 1 PID: 1907 Comm: f2fs_ckpt-254:3 Not tainted 6.2.0-rc5-next-20230123 #1
[ 145.386152] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
[ 145.392541] =====================================================
[ 145.396096] Disabling lock debugging due to kernel taint
[ 145.399241] =====================================================
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next prev parent reply other threads:[~2023-01-23 18:19 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-23 7:04 [f2fs-dev] [PATCH] f2fs: fix information leak in f2fs_move_inline_dirents() Eric Biggers
2023-01-23 8:58 ` Alexander Potapenko via Linux-f2fs-devel
2023-01-23 18:19 ` Eric Biggers [this message]
2023-01-25 10:10 ` Alexander Potapenko via Linux-f2fs-devel
2023-01-29 9:57 ` Chao Yu
2023-01-30 23:00 ` patchwork-bot+f2fs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y87PqGgw1uJVlnrP@gmail.com \
--to=ebiggers@kernel.org \
--cc=glider@google.com \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).