From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, ChenXiaoSong <chenxiaosong2@huawei.com>,
Hawkins Jiawei <yin31149@gmail.com>,
Anton Altaparmakov <anton@tuxera.com>,
Yongqiang Liu <liuyongqiang13@huawei.com>,
Zhang Yi <yi.zhang@huawei.com>,
Zhang Xiaoxu <zhangxiaoxu5@huawei.com>,
Andrew Morton <akpm@linux-foundation.org>
Subject: [PATCH 4.9 002/101] ntfs: fix use-after-free in ntfs_ucsncmp()
Date: Tue, 23 Aug 2022 10:02:35 +0200 [thread overview]
Message-ID: <20220823080034.685941140@linuxfoundation.org> (raw)
In-Reply-To: <20220823080034.579196046@linuxfoundation.org>
From: ChenXiaoSong <chenxiaosong2@huawei.com>
commit 38c9c22a85aeed28d0831f230136e9cf6fa2ed44 upstream.
Syzkaller reported use-after-free bug as follows:
==================================================================
BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130
Read of size 2 at addr ffff8880751acee8 by task a.out/879
CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5218c8bd2c-dirty #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x1c0/0x2b0
print_address_description.constprop.0.cold+0xd4/0x484
print_report.cold+0x55/0x232
kasan_report+0xbf/0xf0
ntfs_ucsncmp+0x123/0x130
ntfs_are_names_equal.cold+0x2b/0x41
ntfs_attr_find+0x43b/0xb90
ntfs_attr_lookup+0x16d/0x1e0
ntfs_read_locked_attr_inode+0x4aa/0x2360
ntfs_attr_iget+0x1af/0x220
ntfs_read_locked_inode+0x246c/0x5120
ntfs_iget+0x132/0x180
load_system_files+0x1cc6/0x3480
ntfs_fill_super+0xa66/0x1cf0
mount_bdev+0x38d/0x460
legacy_get_tree+0x10d/0x220
vfs_get_tree+0x93/0x300
do_new_mount+0x2da/0x6d0
path_mount+0x496/0x19d0
__x64_sys_mount+0x284/0x300
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f3f2118d9ea
Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00
RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44
R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
The buggy address belongs to the physical page:
page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:0x555c6a81d pfn:0x751ac
memcg:ffff888101f7e180
anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201
raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
The reason is that struct ATTR_RECORD->name_offset is 6485, end address of
name string is out of bounds.
Fix this by adding sanity check on end address of attribute name string.
[akpm@linux-foundation.org: coding-style cleanups]
[chenxiaosong2@huawei.com: cleanup suggested by Hawkins Jiawei]
Link: https://lkml.kernel.org/r/20220709064511.3304299-1-chenxiaosong2@huawei.com
Link: https://lkml.kernel.org/r/20220707105329.4020708-1-chenxiaosong2@huawei.com
Signed-off-by: ChenXiaoSong <chenxiaosong2@huawei.com>
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Cc: Anton Altaparmakov <anton@tuxera.com>
Cc: ChenXiaoSong <chenxiaosong2@huawei.com>
Cc: Yongqiang Liu <liuyongqiang13@huawei.com>
Cc: Zhang Yi <yi.zhang@huawei.com>
Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/attrib.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -606,8 +606,12 @@ static int ntfs_attr_find(const ATTR_TYP
a = (ATTR_RECORD*)((u8*)ctx->attr +
le32_to_cpu(ctx->attr->length));
for (;; a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) {
- if ((u8*)a < (u8*)ctx->mrec || (u8*)a > (u8*)ctx->mrec +
- le32_to_cpu(ctx->mrec->bytes_allocated))
+ u8 *mrec_end = (u8 *)ctx->mrec +
+ le32_to_cpu(ctx->mrec->bytes_allocated);
+ u8 *name_end = (u8 *)a + le16_to_cpu(a->name_offset) +
+ a->name_length * sizeof(ntfschar);
+ if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end ||
+ name_end > mrec_end)
break;
ctx->attr = a;
if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) ||
next prev parent reply other threads:[~2022-08-23 8:12 UTC|newest]
Thread overview: 108+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-23 8:02 [PATCH 4.9 000/101] 4.9.326-rc1 review Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 001/101] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put Greg Kroah-Hartman
2022-08-23 8:02 ` Greg Kroah-Hartman [this message]
2022-08-23 8:02 ` [PATCH 4.9 003/101] scsi: ufs: host: Hold reference returned by of_parse_phandle() Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 004/101] net: ping6: Fix memleak in ipv6_renew_options() Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 005/101] net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 006/101] netfilter: nf_queue: do not allow packet truncation below transport header offset Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 007/101] ARM: crypto: comment out gcc warning that breaks clang builds Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 008/101] mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 009/101] ion: Make user_ion_handle_put_nolock() a void function Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 010/101] selinux: Minor cleanups Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 011/101] proc: Pass file mode to proc_pid_make_inode Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 012/101] selinux: Clean up initialization of isec->sclass Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 013/101] selinux: Convert isec->lock into a spinlock Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 014/101] selinux: fix error initialization in inode_doinit_with_dentry() Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 015/101] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 016/101] include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 017/101] init/main: Fix double "the" in comment Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 018/101] init/main: properly align the multi-line comment Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 019/101] init: move stack canary initialization after setup_arch Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 020/101] init/main.c: extract early boot entropy from the passed cmdline Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 021/101] ACPI: video: Force backlight native for some TongFang devices Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 022/101] ACPI: video: Shortening quirk list by identifying Clevo by board_name only Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 023/101] random: only call boot_init_stack_canary() once Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 024/101] macintosh/adb: fix oob read in do_adb_query() function Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 025/101] Makefile: link with -z noexecstack --no-warn-rwx-segments Greg Kroah-Hartman
2022-08-23 8:02 ` [PATCH 4.9 026/101] x86: link vdso and boot " Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 027/101] ALSA: bcd2000: Fix a UAF bug on the error path of probing Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 028/101] add barriers to buffer_uptodate and set_buffer_uptodate Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 029/101] KVM: SVM: Dont BUG if userspace injects an interrupt with GIF=0 Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 030/101] KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 031/101] ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 032/101] ALSA: hda/cirrus - support for iMac 12,1 model Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 033/101] vfs: Check the truncate maximum size in inode_newsize_ok() Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 034/101] usbnet: Fix linkwatch use-after-free on disconnect Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 035/101] parisc: Fix device names in /proc/iomem Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 036/101] drm/nouveau: fix another off-by-one in nvbios_addr Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 037/101] bpf: fix overflow in prog accounting Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 038/101] fuse: limit nsec Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 039/101] md-raid10: fix KASAN warning Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 040/101] ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 041/101] PCI: Add defines for normal and subtractive PCI bridges Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 042/101] powerpc/fsl-pci: Fix Class Code of PCIe Root Port Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 043/101] powerpc/powernv: Avoid crashing if rng is NULL Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 044/101] MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 045/101] USB: HCD: Fix URB giveback issue in tasklet function Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 046/101] netfilter: nf_tables: fix null deref due to zeroed list head Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 047/101] scsi: zfcp: Fix missing auto port scan and thus missing target ports Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 048/101] x86/olpc: fix logical not is only applied to the left hand side Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 049/101] spmi: trace: fix stack-out-of-bound access in SPMI tracing functions Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 050/101] ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 051/101] ext4: make sure ext4_append() always allocates new block Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 052/101] ext4: fix use-after-free in ext4_xattr_set_entry Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 053/101] ext4: update s_overhead_clusters in the superblock during an on-line resize Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 054/101] ext4: fix extent status tree race in writeback error recovery path Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 055/101] ext4: correct max_inline_xattr_value_size computing Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 056/101] dm raid: fix address sanitizer warning in raid_status Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 057/101] net_sched: cls_route: remove from list when handle is 0 Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 058/101] btrfs: reject log replay if there is unsupported RO compat flag Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 059/101] tcp: fix over estimation in sk_forced_mem_schedule() Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 060/101] scsi: sg: Allow waiting for commands to complete on removed device Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 061/101] Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 062/101] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 063/101] nios2: time: Read timer in get_cycles only if initialized Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 064/101] net/9p: Initialize the iounit field during fid creation Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 065/101] net_sched: cls_route: disallow handle of 0 Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 066/101] ALSA: info: Fix llseek return value when using callback Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 067/101] rds: add missing barrier to release_refill Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 068/101] ata: libata-eh: Add missing command name Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 069/101] btrfs: fix lost error handling when looking up extended ref on log replay Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 070/101] can: ems_usb: fix clangs -Wunaligned-access warning Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 071/101] NFSv4.1: RECLAIM_COMPLETE must handle EACCES Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 072/101] SUNRPC: Reinitialise the backchannel request buffers before reuse Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 073/101] pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 074/101] pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 075/101] vsock: Fix memory leak in vsock_connect() Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 076/101] xen/xenbus: fix return type in xenbus_file_read() Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 077/101] atm: idt77252: fix use-after-free bugs caused by tst_timer Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 078/101] nios2: page fault et.al. are *not* restartable syscalls Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 079/101] nios2: dont leave NULLs in sys_call_table[] Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 080/101] nios2: traced syscall does need to check the syscall number Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 081/101] nios2: fix syscall restart checks Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 082/101] nios2: restarts apply only to the first sigframe we build Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 083/101] nios2: add force_successful_syscall_return() Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 084/101] netfilter: nf_tables: really skip inactive sets when allocating name Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 085/101] fec: Fix timer capture timing in `fec_ptp_enable_pps()` Greg Kroah-Hartman
2022-08-23 8:03 ` [PATCH 4.9 086/101] kbuild: clear LDFLAGS in the top Makefile Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 087/101] irqchip/tegra: Fix overflow implicit truncation warnings Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 088/101] usb: host: ohci-ppc-of: Fix refcount leak bug Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 089/101] gadgetfs: ep_io - wait until IRQ finishes Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 090/101] cxl: Fix a memory leak in an error handling path Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 091/101] drivers:md:fix a potential use-after-free bug Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 092/101] ext4: avoid remove directory when directory is corrupted Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 093/101] ext4: avoid resizing to a partial cluster size Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 094/101] tty: serial: Fix refcount leak bug in ucc_uart.c Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 095/101] vfio: Clear the caps->buf to NULL after free Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 096/101] mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 097/101] ALSA: core: Add async signal helpers Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 098/101] ALSA: timer: Use deferred fasync helper Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 099/101] powerpc/64: Init jump labels before parse_early_param() Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 100/101] video: fbdev: i740fb: Check the argument of i740_calc_vclk() Greg Kroah-Hartman
2022-08-23 8:04 ` [PATCH 4.9 101/101] MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Greg Kroah-Hartman
2022-08-23 9:46 ` [PATCH 4.9 000/101] 4.9.326-rc1 review Pavel Machek
2022-08-23 21:00 ` Guenter Roeck
2022-08-23 21:25 ` Guenter Roeck
2022-08-24 7:24 ` Greg Kroah-Hartman
2022-08-23 22:18 ` Shuah Khan
2022-08-24 6:13 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220823080034.685941140@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=anton@tuxera.com \
--cc=chenxiaosong2@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=liuyongqiang13@huawei.com \
--cc=stable@vger.kernel.org \
--cc=yi.zhang@huawei.com \
--cc=yin31149@gmail.com \
--cc=zhangxiaoxu5@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox