* [PATCH] UBSAN: array-index-out-of-bounds in udf_process_sequence
@ 2023-10-13 19:09 Osama Muhammad
2023-10-16 9:41 ` Jan Kara
0 siblings, 1 reply; 2+ messages in thread
From: Osama Muhammad @ 2023-10-13 19:09 UTC (permalink / raw)
To: jack; +Cc: linux-kernel, Osama Muhammad, syzbot+abb7222a58e4ebc930ad
Syzkaller reported the following issue:
UBSAN: array-index-out-of-bounds in fs/udf/super.c:1365:9
index 4 is out of range for type '__le32[4]' (aka 'unsigned int[4]')
CPU: 0 PID: 6060 Comm: syz-executor319 Not tainted 6.5.0-rc6-syzkaller-00253-g9e6c269de404 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
udf_load_sparable_map fs/udf/super.c:1365 [inline]
udf_load_logicalvol fs/udf/super.c:1457 [inline]
udf_process_sequence+0x300d/0x4e70 fs/udf/super.c:1773
udf_load_sequence fs/udf/super.c:1820 [inline]
udf_check_anchor_block+0x2a6/0x550 fs/udf/super.c:1855
udf_scan_anchors fs/udf/super.c:1888 [inline]
udf_load_vrs+0x5ca/0x1100 fs/udf/super.c:1969
udf_fill_super+0x95d/0x23a0 fs/udf/super.c:2147
mount_bdev+0x276/0x3b0 fs/super.c:1391
legacy_get_tree+0xef/0x190 fs/fs_context.c:611
vfs_get_tree+0x8c/0x270 fs/super.c:1519
do_new_mount+0x28f/0xae0 fs/namespace.c:3335
do_mount fs/namespace.c:3675 [inline]
__do_sys_mount fs/namespace.c:3884 [inline]
__se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f363cae1c8a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 3e 07 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe6eac67a8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f363cae1c8a
RDX: 0000000020000100 RSI: 0000000020000340 RDI: 00007ffe6eac6800
RBP: 00007ffe6eac6840 R08: 00007ffe6eac6840 R09: 0000000000000c35
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000020000340
R13: 0000000020000100 R14: 0000000000000c3b R15: 0000000020020500
</TASK>
The issue is caused when the value of i becomes equal or more than 4 which is
the size of array. In the code the condition checks the value of
spm->numSparingTables. syzbot was able to make spm->numSparingTables
value 4 which is cauing this error. The patch adds one more condition
to check the value of i should be less than 4.
Reported-and-tested-by: syzbot+abb7222a58e4ebc930ad@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=abb7222a58e4ebc930ad
Signed-off-by: Osama Muhammad <osmtendev@gmail.com>
---
fs/udf/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 928a04d9d9e0..8c8731c3f8d9 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1361,7 +1361,7 @@ static int udf_load_sparable_map(struct super_block *sb,
return -EIO;
}
- for (i = 0; i < spm->numSparingTables; i++) {
+ for (i = 0; i < spm->numSparingTables && i < 4; i++) {
loc = le32_to_cpu(spm->locSparingTable[i]);
bh = udf_read_tagged(sb, loc, loc, &ident);
if (!bh)
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] UBSAN: array-index-out-of-bounds in udf_process_sequence
2023-10-13 19:09 [PATCH] UBSAN: array-index-out-of-bounds in udf_process_sequence Osama Muhammad
@ 2023-10-16 9:41 ` Jan Kara
0 siblings, 0 replies; 2+ messages in thread
From: Jan Kara @ 2023-10-16 9:41 UTC (permalink / raw)
To: Osama Muhammad; +Cc: jack, linux-kernel, syzbot+abb7222a58e4ebc930ad
On Sat 14-10-23 00:09:29, Osama Muhammad wrote:
> Syzkaller reported the following issue:
>
> UBSAN: array-index-out-of-bounds in fs/udf/super.c:1365:9
> index 4 is out of range for type '__le32[4]' (aka 'unsigned int[4]')
> CPU: 0 PID: 6060 Comm: syz-executor319 Not tainted 6.5.0-rc6-syzkaller-00253-g9e6c269de404 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
> ubsan_epilogue lib/ubsan.c:217 [inline]
> __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
> udf_load_sparable_map fs/udf/super.c:1365 [inline]
> udf_load_logicalvol fs/udf/super.c:1457 [inline]
> udf_process_sequence+0x300d/0x4e70 fs/udf/super.c:1773
> udf_load_sequence fs/udf/super.c:1820 [inline]
> udf_check_anchor_block+0x2a6/0x550 fs/udf/super.c:1855
> udf_scan_anchors fs/udf/super.c:1888 [inline]
> udf_load_vrs+0x5ca/0x1100 fs/udf/super.c:1969
> udf_fill_super+0x95d/0x23a0 fs/udf/super.c:2147
> mount_bdev+0x276/0x3b0 fs/super.c:1391
> legacy_get_tree+0xef/0x190 fs/fs_context.c:611
> vfs_get_tree+0x8c/0x270 fs/super.c:1519
> do_new_mount+0x28f/0xae0 fs/namespace.c:3335
> do_mount fs/namespace.c:3675 [inline]
> __do_sys_mount fs/namespace.c:3884 [inline]
> __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f363cae1c8a
> Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 3e 07 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffe6eac67a8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f363cae1c8a
> RDX: 0000000020000100 RSI: 0000000020000340 RDI: 00007ffe6eac6800
> RBP: 00007ffe6eac6840 R08: 00007ffe6eac6840 R09: 0000000000000c35
> R10: 0000000000000000 R11: 0000000000000282 R12: 0000000020000340
> R13: 0000000020000100 R14: 0000000000000c3b R15: 0000000020020500
> </TASK>
>
> The issue is caused when the value of i becomes equal or more than 4 which is
> the size of array. In the code the condition checks the value of
> spm->numSparingTables. syzbot was able to make spm->numSparingTables
> value 4 which is cauing this error. The patch adds one more condition
> to check the value of i should be less than 4.
>
> Reported-and-tested-by: syzbot+abb7222a58e4ebc930ad@syzkaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=abb7222a58e4ebc930ad
> Signed-off-by: Osama Muhammad <osmtendev@gmail.com>
But as you can see we test:
if (spm->numSparingTables > 4) {
just before the loop. So this error means that syzbot has been modifying
the filesystem image while is was in use. That is invalid syzbot program as
there is no way how we could fix all such bugs (effectively it is
equivalent to corrupting memory). So I'm not going to apply your patch,
sorry. I already have patches that forbid writing to filesystem image that
is mounted but it will take a while to get them merged...
Honza
> ---
> fs/udf/super.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/udf/super.c b/fs/udf/super.c
> index 928a04d9d9e0..8c8731c3f8d9 100644
> --- a/fs/udf/super.c
> +++ b/fs/udf/super.c
> @@ -1361,7 +1361,7 @@ static int udf_load_sparable_map(struct super_block *sb,
> return -EIO;
> }
>
> - for (i = 0; i < spm->numSparingTables; i++) {
> + for (i = 0; i < spm->numSparingTables && i < 4; i++) {
> loc = le32_to_cpu(spm->locSparingTable[i]);
> bh = udf_read_tagged(sb, loc, loc, &ident);
> if (!bh)
> --
> 2.34.1
>
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-10-16 9:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-10-13 19:09 [PATCH] UBSAN: array-index-out-of-bounds in udf_process_sequence Osama Muhammad
2023-10-16 9:41 ` Jan Kara
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox