* [PATCH v2] udf: fix uninit-value use in udf_get_fileshortad [not found] <20240925071355.t4w3thcfvfpou7gu@quack3> @ 2024-09-25 7:46 ` Gianfranco Trad 2024-10-02 12:29 ` Jan Kara 0 siblings, 1 reply; 3+ messages in thread From: Gianfranco Trad @ 2024-09-25 7:46 UTC (permalink / raw) To: jack; +Cc: linux-kernel, skhan, syzbot+8901c4560b7ab5c2f9df, Gianfranco Trad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000 Reported-by: syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df Tested-by: syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com Suggested-by: Jan Kara <jack@suse.com> Signed-off-by: Gianfranco Trad <gianf.trad@gmail.com> --- Notes: changes in v2: - use check_add_overflow helper to check for overflow. link to v1: https://lore.kernel.org/all/20240919195227.412583-1-gianf.trad@gmail.com/T/ fs/udf/inode.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 4726a4d014b6..811a035b600f 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2215,9 +2215,10 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, if (!epos->offset) epos->offset = sizeof(struct allocExtDesc); ptr = epos->bh->b_data + epos->offset; - alen = sizeof(struct allocExtDesc) + - le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> - lengthAllocDescs); + if (check_add_overflow(sizeof(struct allocExtDesc), + le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data) + ->lengthAllocDescs), &alen)) + return -1; } switch (iinfo->i_alloc_type) { -- 2.43.0 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] udf: fix uninit-value use in udf_get_fileshortad 2024-09-25 7:46 ` [PATCH v2] udf: fix uninit-value use in udf_get_fileshortad Gianfranco Trad @ 2024-10-02 12:29 ` Jan Kara 2024-10-03 20:04 ` Gianfranco Trad 0 siblings, 1 reply; 3+ messages in thread From: Jan Kara @ 2024-10-02 12:29 UTC (permalink / raw) To: Gianfranco Trad; +Cc: jack, linux-kernel, skhan, syzbot+8901c4560b7ab5c2f9df On Wed 25-09-24 09:46:15, Gianfranco Trad wrote: > Check for overflow when computing alen in udf_current_aext to mitigate > later uninit-value use in udf_get_fileshortad KMSAN bug[1]. > After applying the patch reproducer did not trigger any issue[2]. > > [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df > [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000 > > Reported-by: syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df > Tested-by: syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com > Suggested-by: Jan Kara <jack@suse.com> > Signed-off-by: Gianfranco Trad <gianf.trad@gmail.com> Thanks. I've added the patch to my tree. Honza > --- > > Notes: > changes in v2: > - use check_add_overflow helper to check for overflow. > > link to v1: https://lore.kernel.org/all/20240919195227.412583-1-gianf.trad@gmail.com/T/ > > fs/udf/inode.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/fs/udf/inode.c b/fs/udf/inode.c > index 4726a4d014b6..811a035b600f 100644 > --- a/fs/udf/inode.c > +++ b/fs/udf/inode.c > @@ -2215,9 +2215,10 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, > if (!epos->offset) > epos->offset = sizeof(struct allocExtDesc); > ptr = epos->bh->b_data + epos->offset; > - alen = sizeof(struct allocExtDesc) + > - le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> > - lengthAllocDescs); > + if (check_add_overflow(sizeof(struct allocExtDesc), > + le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data) > + ->lengthAllocDescs), &alen)) > + return -1; > } > > switch (iinfo->i_alloc_type) { > -- > 2.43.0 > -- Jan Kara <jack@suse.com> SUSE Labs, CR ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] udf: fix uninit-value use in udf_get_fileshortad 2024-10-02 12:29 ` Jan Kara @ 2024-10-03 20:04 ` Gianfranco Trad 0 siblings, 0 replies; 3+ messages in thread From: Gianfranco Trad @ 2024-10-03 20:04 UTC (permalink / raw) To: Jan Kara; +Cc: jack, linux-kernel, skhan On 02/10/24 14:29, Jan Kara wrote: > On Wed 25-09-24 09:46:15, Gianfranco Trad wrote: >> Check for overflow when computing alen in udf_current_aext to mitigate >> later uninit-value use in udf_get_fileshortad KMSAN bug[1]. >> After applying the patch reproducer did not trigger any issue[2]. >> >> [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df >> [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000 >> >> Reported-by: syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com >> Closes: https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df >> Tested-by: syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com >> Suggested-by: Jan Kara <jack@suse.com> >> Signed-off-by: Gianfranco Trad <gianf.trad@gmail.com> > > Thanks. I've added the patch to my tree. > > Honza > Thanks Jan. This was one of my first patches to the kernel. I will definitely remember it. Wish you a nice day :) -- Gian >> --- >> >> Notes: >> changes in v2: >> - use check_add_overflow helper to check for overflow. >> >> link to v1: https://lore.kernel.org/all/20240919195227.412583-1-gianf.trad@gmail.com/T/ >> >> fs/udf/inode.c | 7 ++++--- >> 1 file changed, 4 insertions(+), 3 deletions(-) >> >> diff --git a/fs/udf/inode.c b/fs/udf/inode.c >> index 4726a4d014b6..811a035b600f 100644 >> --- a/fs/udf/inode.c >> +++ b/fs/udf/inode.c >> @@ -2215,9 +2215,10 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, >> if (!epos->offset) >> epos->offset = sizeof(struct allocExtDesc); >> ptr = epos->bh->b_data + epos->offset; >> - alen = sizeof(struct allocExtDesc) + >> - le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> >> - lengthAllocDescs); >> + if (check_add_overflow(sizeof(struct allocExtDesc), >> + le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data) >> + ->lengthAllocDescs), &alen)) >> + return -1; >> } >> >> switch (iinfo->i_alloc_type) { >> -- >> 2.43.0 >> ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-10-03 20:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20240925071355.t4w3thcfvfpou7gu@quack3>
2024-09-25 7:46 ` [PATCH v2] udf: fix uninit-value use in udf_get_fileshortad Gianfranco Trad
2024-10-02 12:29 ` Jan Kara
2024-10-03 20:04 ` Gianfranco Trad
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox