From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Edward Lo <loyuantsung@gmail.com>,
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 6.4 27/40] fs/ntfs3: Enhance sanity check while generating attr_list
Date: Sun, 23 Jul 2023 21:31:27 -0400 [thread overview]
Message-ID: <20230724013140.2327815-27-sashal@kernel.org> (raw)
In-Reply-To: <20230724013140.2327815-1-sashal@kernel.org>
From: Edward Lo <loyuantsung@gmail.com>
[ Upstream commit fdec309c7672cbee4dc0229ee4cbb33c948a1bdd ]
ni_create_attr_list uses WARN_ON to catch error cases while generating
attribute list, which only prints out stack trace and may not be enough.
This repalces them with more proper error handling flow.
[ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e
[ 59.673268] #PF: supervisor read access in kernel mode
[ 59.678354] #PF: error_code(0x0000) - not-present page
[ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0
[ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI
[ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4
[ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860
[ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8
[ 59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282
[ 59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe
[ 59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0
[ 59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9
[ 59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180
[ 59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050
[ 59.768323] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
[ 59.776027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0
[ 59.787607] Call Trace:
[ 59.790271] <TASK>
[ 59.792488] ? __pfx_ni_create_attr_list+0x10/0x10
[ 59.797235] ? kernel_text_address+0xd3/0xe0
[ 59.800856] ? unwind_get_return_address+0x3e/0x60
[ 59.805101] ? __kasan_check_write+0x18/0x20
[ 59.809296] ? preempt_count_sub+0x1c/0xd0
[ 59.813421] ni_ins_attr_ext+0x52c/0x5c0
[ 59.817034] ? __pfx_ni_ins_attr_ext+0x10/0x10
[ 59.821926] ? __vfs_setxattr+0x121/0x170
[ 59.825718] ? __vfs_setxattr_noperm+0x97/0x300
[ 59.829562] ? __vfs_setxattr_locked+0x145/0x170
[ 59.833987] ? vfs_setxattr+0x137/0x2a0
[ 59.836732] ? do_setxattr+0xce/0x150
[ 59.839807] ? setxattr+0x126/0x140
[ 59.842353] ? path_setxattr+0x164/0x180
[ 59.845275] ? __x64_sys_setxattr+0x71/0x90
[ 59.848838] ? do_syscall_64+0x3f/0x90
[ 59.851898] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 59.857046] ? stack_depot_save+0x17/0x20
[ 59.860299] ni_insert_attr+0x1ba/0x420
[ 59.863104] ? __pfx_ni_insert_attr+0x10/0x10
[ 59.867069] ? preempt_count_sub+0x1c/0xd0
[ 59.869897] ? _raw_spin_unlock_irqrestore+0x2b/0x50
[ 59.874088] ? __create_object+0x3ae/0x5d0
[ 59.877865] ni_insert_resident+0xc4/0x1c0
[ 59.881430] ? __pfx_ni_insert_resident+0x10/0x10
[ 59.886355] ? kasan_save_alloc_info+0x1f/0x30
[ 59.891117] ? __kasan_kmalloc+0x8b/0xa0
[ 59.894383] ntfs_set_ea+0x90d/0xbf0
[ 59.897703] ? __pfx_ntfs_set_ea+0x10/0x10
[ 59.901011] ? kernel_text_address+0xd3/0xe0
[ 59.905308] ? __kernel_text_address+0x16/0x50
[ 59.909811] ? unwind_get_return_address+0x3e/0x60
[ 59.914898] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 59.920250] ? arch_stack_walk+0xa2/0x100
[ 59.924560] ? filter_irq_stacks+0x27/0x80
[ 59.928722] ntfs_setxattr+0x405/0x440
[ 59.932512] ? __pfx_ntfs_setxattr+0x10/0x10
[ 59.936634] ? kvmalloc_node+0x2d/0x120
[ 59.940378] ? kasan_save_stack+0x41/0x60
[ 59.943870] ? kasan_save_stack+0x2a/0x60
[ 59.947719] ? kasan_set_track+0x29/0x40
[ 59.951417] ? kasan_save_alloc_info+0x1f/0x30
[ 59.955733] ? __kasan_kmalloc+0x8b/0xa0
[ 59.959598] ? __kmalloc_node+0x68/0x150
[ 59.963163] ? kvmalloc_node+0x2d/0x120
[ 59.966490] ? vmemdup_user+0x2b/0xa0
[ 59.969060] __vfs_setxattr+0x121/0x170
[ 59.972456] ? __pfx___vfs_setxattr+0x10/0x10
[ 59.976008] __vfs_setxattr_noperm+0x97/0x300
[ 59.981562] __vfs_setxattr_locked+0x145/0x170
[ 59.986100] vfs_setxattr+0x137/0x2a0
[ 59.989964] ? __pfx_vfs_setxattr+0x10/0x10
[ 59.993616] ? __kasan_check_write+0x18/0x20
[ 59.997425] do_setxattr+0xce/0x150
[ 60.000304] setxattr+0x126/0x140
[ 60.002967] ? __pfx_setxattr+0x10/0x10
[ 60.006471] ? __virt_addr_valid+0xcb/0x140
[ 60.010461] ? __call_rcu_common.constprop.0+0x1c7/0x330
[ 60.016037] ? debug_smp_processor_id+0x1b/0x30
[ 60.021008] ? kasan_quarantine_put+0x5b/0x190
[ 60.025545] ? putname+0x84/0xa0
[ 60.027910] ? __kasan_slab_free+0x11e/0x1b0
[ 60.031483] ? putname+0x84/0xa0
[ 60.033986] ? preempt_count_sub+0x1c/0xd0
[ 60.036876] ? __mnt_want_write+0xae/0x100
[ 60.040738] ? mnt_want_write+0x8f/0x150
[ 60.044317] path_setxattr+0x164/0x180
[ 60.048096] ? __pfx_path_setxattr+0x10/0x10
[ 60.052096] ? strncpy_from_user+0x175/0x1c0
[ 60.056482] ? debug_smp_processor_id+0x1b/0x30
[ 60.059848] ? fpregs_assert_state_consistent+0x6b/0x80
[ 60.064557] __x64_sys_setxattr+0x71/0x90
[ 60.068892] do_syscall_64+0x3f/0x90
[ 60.072868] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 60.077523] RIP: 0033:0x7feaa86e4469
[ 60.080915] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088
[ 60.097353] RSP: 002b:00007ffdbd8311e8 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc
[ 60.103386] RAX: ffffffffffffffda RBX: 9461c5e290baac00 RCX: 00007feaa86e4469
[ 60.110322] RDX: 00007ffdbd831fe0 RSI: 00007ffdbd831305 RDI: 00007ffdbd831263
[ 60.116808] RBP: 00007ffdbd836180 R08: 0000000000000001 R09: 00007ffdbd836268
[ 60.123879] R10: 000000000000007d R11: 0000000000000286 R12: 0000000000400500
[ 60.130540] R13: 00007ffdbd836260 R14: 0000000000000000 R15: 0000000000000000
[ 60.136553] </TASK>
[ 60.138818] Modules linked in:
[ 60.141839] CR2: 000000000000000e
[ 60.144831] ---[ end trace 0000000000000000 ]---
[ 60.149058] RIP: 0010:ni_create_attr_list+0x505/0x860
[ 60.153975] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8
[ 60.172443] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282
[ 60.176246] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe
[ 60.182752] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0
[ 60.189949] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9
[ 60.196950] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180
[ 60.203671] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050
[ 60.209595] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
[ 60.216299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 60.222276] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0
Signed-off-by: Edward Lo <loyuantsung@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/frecord.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 2bfcf1a989c95..50214b77c6a35 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -874,6 +874,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
if (err)
goto out1;
+ err = -EINVAL;
/* Call mi_remove_attr() in reverse order to keep pointers 'arr_move' valid. */
while (to_free > 0) {
struct ATTRIB *b = arr_move[--nb];
@@ -882,7 +883,8 @@ int ni_create_attr_list(struct ntfs_inode *ni)
attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off),
b->name_len, asize, name_off);
- WARN_ON(!attr);
+ if (!attr)
+ goto out1;
mi_get_ref(mi, &le_b[nb]->ref);
le_b[nb]->id = attr->id;
@@ -892,17 +894,20 @@ int ni_create_attr_list(struct ntfs_inode *ni)
attr->id = le_b[nb]->id;
/* Remove from primary record. */
- WARN_ON(!mi_remove_attr(NULL, &ni->mi, b));
+ if (!mi_remove_attr(NULL, &ni->mi, b))
+ goto out1;
if (to_free <= asize)
break;
to_free -= asize;
- WARN_ON(!nb);
+ if (!nb)
+ goto out1;
}
attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0,
lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT);
- WARN_ON(!attr);
+ if (!attr)
+ goto out1;
attr->non_res = 0;
attr->flags = 0;
@@ -922,9 +927,10 @@ int ni_create_attr_list(struct ntfs_inode *ni)
kfree(ni->attr_list.le);
ni->attr_list.le = NULL;
ni->attr_list.size = 0;
+ return err;
out:
- return err;
+ return 0;
}
/*
--
2.39.2
next prev parent reply other threads:[~2023-07-24 1:39 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-24 1:31 [PATCH AUTOSEL 6.4 01/40] serial: stm32: Ignore return value of uart_remove_one_port() in .remove() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 02/40] led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 03/40] media: v4l2-mem2mem: add lock to protect parameter num_rdy Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 04/40] media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250 Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 05/40] usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 06/40] usb: gadget: uvc: queue empty isoc requests if no video buffer is available Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 07/40] media: platform: mediatek: vpu: fix NULL ptr dereference Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 08/40] thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 09/40] xhci: Don't require a valid get_quirks() function pointer during xhci setup Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 10/40] xhci: get rid of XHCI_PLAT quirk that used to prevent MSI setup Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 11/40] usb: chipidea: imx: don't request QoS for imx8ulp Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 12/40] usb: cdns2: Device side header file for CDNS2 driver Sasha Levin
2023-07-24 4:09 ` Greg Kroah-Hartman
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 13/40] usb: chipidea: imx: turn off vbus comparator when suspend Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 14/40] usb: chipidea: imx: add missing USB PHY DPDM wakeup setting Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 15/40] gfs2: Fix possible data races in gfs2_show_options() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 16/40] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 17/40] thunderbolt: Add Intel Barlow Ridge PCI ID Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 18/40] thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 19/40] firewire: net: fix use after free in fwnet_finish_incoming_packet() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 20/40] watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 21/40] Bluetooth: L2CAP: Fix use-after-free Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 22/40] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 23/40] Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 24/40] ceph: try to dump the msgs when decoding fails Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 25/40] drm/amdgpu: Fix potential fence use-after-free v2 Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 26/40] f2fs: fix to do sanity check on direct node in truncate_dnode() Sasha Levin
2023-07-24 1:31 ` Sasha Levin [this message]
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 28/40] fs/ntfs3: Return error for inconsistent extended attributes Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 29/40] fs: ntfs3: Fix possible null-pointer dereferences in mi_read() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 30/40] fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 31/40] fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 32/40] fs/ntfs3: Alternative boot if primary boot " Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 33/40] ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 34/40] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 35/40] ALSA: hda/realtek: Add quirk for ASUS ROG GX650P Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 36/40] ALSA: hda/realtek: Add quirk for ASUS ROG GA402X Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 37/40] ALSA: hda/realtek: Amend G634 quirk to enable rear speakers Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 38/40] ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 39/40] apparmor: fix use of strcpy in policy_unpack_test Sasha Levin
2023-07-24 1:31 ` [PATCH AUTOSEL 6.4 40/40] ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230724013140.2327815-27-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=linux-kernel@vger.kernel.org \
--cc=loyuantsung@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox