A list of HFS+ kernel module bugs found in 4.18

A list of HFS+ kernel module bugs found in 4.18

[Wen Xu]

Hi all,

Here are a list of bugs found in HFS+ filesystem by fuzzing. You can get the image and POC that cause kernel panic 
in the following links:

200299    Kernel panic because mount() hfsplus image does not always return correct value
https://bugzilla.kernel.org/show_bug.cgi?id=200299

200297	Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem
https://bugzilla.kernel.org/show_bug.cgi?id=200297

200295	BUG() in hfsplus_create_attributes_file() when calling setxattr()
https://bugzilla.kernel.org/show_bug.cgi?id=200295

200293	Out-of-bound access in hfsplus_bnode_read()
https://bugzilla.kernel.org/show_bug.cgi?id=200293

200291	Kernel panic when invoking setxattr() on a hfs+ image
https://bugzilla.kernel.org/show_bug.cgi?id=200291

200289	Kernel panic when calling setxattr() on a corrupted hfs+ image
https://bugzilla.kernel.org/show_bug.cgi?id=200289

200287	Out-of-bound access in hfsplus_bnode_copy() when calling setxattr() on a corrupted hfs+ image
https://bugzilla.kernel.org/show_bug.cgi?id=200287

200285	Out-of-bound access in hfsplus_bmap_alloc() when calling setxattr() on a corrupted hfs+ image
https://bugzilla.kernel.org/show_bug.cgi?id=200285

I would like to provide any further help to analyze the crashes and fix the bugs. I am also willing to test the patches.

Thanks,
Wen

Re: A list of HFS+ kernel module bugs found in 4.18

[Ernesto A. Fernández]

Hi, thanks for the reports:

On Tue, Jul 10, 2018 at 08:12:35PM +0000, Xu, Wen wrote:
> Hi Ernesto,
> 
> I reported the following bugs weeks before but did not get and respond. I saw you commit patches for HFS+, so could you 
> please take a look on these issue?
> 
> Here are a list of bugs found in HFS+ filesystem by fuzzing. You can get the image and POC that cause kernel panic 
> in the following links:
> 
> 200299    Kernel panic because mount() hfsplus image does not always return correct value
> https://bugzilla.kernel.org/show_bug.cgi?id=200299

This was also found by syzbot a couple of months ago. It's already fixed
in the -mm tree if you want to test it.

> 200297	Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem
> https://bugzilla.kernel.org/show_bug.cgi?id=200297
> 
> 200293	Out-of-bound access in hfsplus_bnode_read()
> https://bugzilla.kernel.org/show_bug.cgi?id=200293

I'll try to fix these two and get back to you. It may take a couple of days.

> 200295	BUG() in hfsplus_create_attributes_file() when calling setxattr()
> https://bugzilla.kernel.org/show_bug.cgi?id=200295
> 
> 200291	Kernel panic when invoking setxattr() on a hfs+ image
> https://bugzilla.kernel.org/show_bug.cgi?id=200291
> 
> 200289	Kernel panic when calling setxattr() on a corrupted hfs+ image
> https://bugzilla.kernel.org/show_bug.cgi?id=200289
> 
> 200287	Out-of-bound access in hfsplus_bnode_copy() when calling setxattr() on a corrupted hfs+ image
> https://bugzilla.kernel.org/show_bug.cgi?id=200287
> 
> 200285	Out-of-bound access in hfsplus_bmap_alloc() when calling setxattr() on a corrupted hfs+ image
> https://bugzilla.kernel.org/show_bug.cgi?id=200285

The xattr implementation is a mess. I found many bugs myself just by
attempting to use it. I will take a look, but I can't promise to be able
to help. If it was up to me I would much rather get rid of xattr support
entirely, although I suppose somebody might be using it.

Ernest
 
> I would like to provide any further help to analyze the crashes and fix the bugs. I am also willing to test the patches.
> 
> Thanks,
> Wen

Re: A list of HFS+ kernel module bugs found in 4.18

[Xu, Wen]

Hi Ernesto,

I checked the patch for 
200297	Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem
https://bugzilla.kernel.org/show_bug.cgi?id=200297

Is 

200293	Out-of-bound access in hfsplus_bnode_read()
https://bugzilla.kernel.org/show_bug.cgi?id=200293

Also handled with any patch?

Thanks,
Wen

> On Jul 10, 2018, at 6:33 PM, Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com> wrote:
> 
> Hi, thanks for the reports:
> 
> On Tue, Jul 10, 2018 at 08:12:35PM +0000, Xu, Wen wrote:
>> Hi Ernesto,
>> 
>> I reported the following bugs weeks before but did not get and respond. I saw you commit patches for HFS+, so could you 
>> please take a look on these issue?
>> 
>> Here are a list of bugs found in HFS+ filesystem by fuzzing. You can get the image and POC that cause kernel panic 
>> in the following links:
>> 
>> 200299    Kernel panic because mount() hfsplus image does not always return correct value
>> https://bugzilla.kernel.org/show_bug.cgi?id=200299
> 
> This was also found by syzbot a couple of months ago. It's already fixed
> in the -mm tree if you want to test it.
> 
>> 200297	Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem
>> https://bugzilla.kernel.org/show_bug.cgi?id=200297
>> 
>> 200293	Out-of-bound access in hfsplus_bnode_read()
>> https://bugzilla.kernel.org/show_bug.cgi?id=200293
> 
> I'll try to fix these two and get back to you. It may take a couple of days.
> 
>> 200295	BUG() in hfsplus_create_attributes_file() when calling setxattr()
>> https://bugzilla.kernel.org/show_bug.cgi?id=200295
>> 
>> 200291	Kernel panic when invoking setxattr() on a hfs+ image
>> https://bugzilla.kernel.org/show_bug.cgi?id=200291
>> 
>> 200289	Kernel panic when calling setxattr() on a corrupted hfs+ image
>> https://bugzilla.kernel.org/show_bug.cgi?id=200289
>> 
>> 200287	Out-of-bound access in hfsplus_bnode_copy() when calling setxattr() on a corrupted hfs+ image
>> https://bugzilla.kernel.org/show_bug.cgi?id=200287
>> 
>> 200285	Out-of-bound access in hfsplus_bmap_alloc() when calling setxattr() on a corrupted hfs+ image
>> https://bugzilla.kernel.org/show_bug.cgi?id=200285
> 
> The xattr implementation is a mess. I found many bugs myself just by
> attempting to use it. I will take a look, but I can't promise to be able
> to help. If it was up to me I would much rather get rid of xattr support
> entirely, although I suppose somebody might be using it.
> 
> Ernest
> 
>> I would like to provide any further help to analyze the crashes and fix the bugs. I am also willing to test the patches.
>> 
>> Thanks,
>> Wen

Re: A list of HFS+ kernel module bugs found in 4.18

[Ernesto A. Fernández]

On Sun, Jul 22, 2018 at 03:24:00PM +0000, Xu, Wen wrote:
> Hi Ernesto,
> 
> I checked the patch for 
> 200297	Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem
> https://bugzilla.kernel.org/show_bug.cgi?id=200297
> 
> Is 
> 
> 200293	Out-of-bound access in hfsplus_bnode_read()
> https://bugzilla.kernel.org/show_bug.cgi?id=200293
> 
> Also handled with any patch?

Not yet, I'm afraid. As it turns out, that is also a bug in the xattr
implementation. Fixing those will most likely require a big rewrite.

Thanks,
Ernest

> 
> Thanks,
> Wen
> 
> > On Jul 10, 2018, at 6:33 PM, Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com> wrote:
> > 
> > Hi, thanks for the reports:
> > 
> > On Tue, Jul 10, 2018 at 08:12:35PM +0000, Xu, Wen wrote:
> >> Hi Ernesto,
> >> 
> >> I reported the following bugs weeks before but did not get and respond. I saw you commit patches for HFS+, so could you 
> >> please take a look on these issue?
> >> 
> >> Here are a list of bugs found in HFS+ filesystem by fuzzing. You can get the image and POC that cause kernel panic 
> >> in the following links:
> >> 
> >> 200299    Kernel panic because mount() hfsplus image does not always return correct value
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200299
> > 
> > This was also found by syzbot a couple of months ago. It's already fixed
> > in the -mm tree if you want to test it.
> > 
> >> 200297	Kernel panic in hfsplus_lookup() when open a file in a corrupted hfs+ filesystem
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200297
> >> 
> >> 200293	Out-of-bound access in hfsplus_bnode_read()
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200293
> > 
> > I'll try to fix these two and get back to you. It may take a couple of days.
> > 
> >> 200295	BUG() in hfsplus_create_attributes_file() when calling setxattr()
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200295
> >> 
> >> 200291	Kernel panic when invoking setxattr() on a hfs+ image
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200291
> >> 
> >> 200289	Kernel panic when calling setxattr() on a corrupted hfs+ image
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200289
> >> 
> >> 200287	Out-of-bound access in hfsplus_bnode_copy() when calling setxattr() on a corrupted hfs+ image
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200287
> >> 
> >> 200285	Out-of-bound access in hfsplus_bmap_alloc() when calling setxattr() on a corrupted hfs+ image
> >> https://bugzilla.kernel.org/show_bug.cgi?id=200285
> > 
> > The xattr implementation is a mess. I found many bugs myself just by
> > attempting to use it. I will take a look, but I can't promise to be able
> > to help. If it was up to me I would much rather get rid of xattr support
> > entirely, although I suppose somebody might be using it.
> > 
> > Ernest
> > 
> >> I would like to provide any further help to analyze the crashes and fix the bugs. I am also willing to test the patches.
> >> 
> >> Thanks,
> >> Wen
>