Ye Bin
75ac724684
ext4: fix use-after-free in ext4_search_dir ...
commit c186f0887fe7061a35cebef024550ec33ef8fbd8 upstream.
We got issue as follows:
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
==================================================================
BUG: KASAN: use-after-free in ext4_search_dir fs/ext4/namei.c:1394 [inline]
BUG: KASAN: use-after-free in search_dirblock fs/ext4/namei.c:1199 [inline]
BUG: KASAN: use-after-free in __ext4_find_entry+0xdca/0x1210 fs/ext4/namei.c:1553
Read of size 1 at addr ffff8881317c3005 by task syz-executor117/2331
CPU: 1 PID: 2331 Comm: syz-executor117 Not tainted 5.10.0+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:83 [inline]
dump_stack+0x144/0x187 lib/dump_stack.c:124
print_address_description+0x7d/0x630 mm/kasan/report.c:387
__kasan_report+0x132/0x190 mm/kasan/report.c:547
kasan_report+0x47/0x60 mm/kasan/report.c:564
ext4_search_dir fs/ext4/namei.c:1394 [inline]
search_dirblock fs/ext4/namei.c:1199 [inline]
__ext4_find_entry+0xdca/0x1210 fs/ext4/namei.c:1553
ext4_lookup_entry fs/ext4/namei.c:1622 [inline]
ext4_lookup+0xb8/0x3a0 fs/ext4/namei.c:1690
__lookup_hash+0xc5/0x190 fs/namei.c:1451
do_rmdir+0x19e/0x310 fs/namei.c:3760
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x445e59
Code: 4d c7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b c7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fff2277fac8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000400280 RCX: 0000000000445e59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000002
R10: 00007fff2277f990 R11: 0000000000000246 R12: 0000000000000000
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
The buggy address belongs to the page:
page:0000000048cd3304 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x1317c3
flags: 0x200000000000000()
raw: 0200000000000000 ffffea0004526588 ffffea0004528088 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881317c2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881317c2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881317c3000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8881317c3080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881317c3100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
ext4_search_dir:
...
de = (struct ext4_dir_entry_2 *)search_buf;
dlimit = search_buf + buf_size;
while ((char *) de < dlimit) {
...
if ((char *) de + de->name_len <= dlimit &&
ext4_match(dir, fname, de)) {
...
}
...
de_len = ext4_rec_len_from_disk(de->rec_len, dir->i_sb->s_blocksize);
if (de_len <= 0)
return -1;
offset += de_len;
de = (struct ext4_dir_entry_2 *) ((char *) de + de_len);
}
Assume:
de=0xffff8881317c2fff
dlimit=0x0xffff8881317c3000
If read 'de->name_len' which address is 0xffff8881317c3005, obviously is
out of range, then will trigger use-after-free.
To solve this issue, 'dlimit' must reserve 8 bytes, as we will read
'de->name_len' to judge if '(char *) de + de->name_len' out of range.
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220324064816.1209985-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-27 13:53:57 +02:00
2022-01-20 09:17:50 +01:00
2020-10-24 12:26:05 -07:00
2021-03-04 11:38:37 +01:00
2021-09-30 10:11:01 +02:00
2020-10-16 11:11:22 -07:00
2020-09-18 16:45:50 -04:00
2021-01-06 14:56:52 +01:00
2022-04-20 09:23:27 +02:00
2021-03-30 14:32:07 +02:00
2022-04-13 21:01:00 +02:00
2022-04-27 13:53:53 +02:00
2022-03-02 11:42:52 +01:00
2020-09-18 16:45:50 -04:00
2021-11-18 14:03:54 +01:00
2022-01-27 10:54:02 +01:00
2022-02-01 17:25:39 +01:00
2022-01-27 10:54:10 +01:00
2021-05-26 12:06:55 +02:00
2020-11-25 16:55:02 +01:00
2020-09-18 16:45:50 -04:00
2021-12-01 09:19:05 +01:00
2022-03-28 09:57:07 +02:00
2022-04-08 14:40:18 +02:00
2022-04-27 13:53:57 +02:00
2022-04-08 14:40:33 +02:00
2020-09-18 16:45:50 -04:00
2021-09-18 13:40:15 +02:00
2022-03-16 14:16:01 +01:00
2022-04-27 13:53:46 +02:00
2021-07-31 08:16:12 +02:00
2021-05-19 10:13:10 +02:00
2021-04-14 08:42:06 +02:00
2020-09-18 16:45:50 -04:00
2022-04-27 13:53:54 +02:00
2021-09-30 10:11:04 +02:00
2021-11-12 14:58:33 +01:00
2022-02-01 17:25:41 +01:00
2022-04-08 14:39:52 +02:00
2022-04-13 21:01:03 +02:00
2021-01-27 11:55:29 +01:00
2021-09-18 13:40:30 +02:00
2022-04-13 21:01:01 +02:00
2022-04-13 21:01:04 +02:00
2020-12-30 11:53:45 +01:00
2022-04-08 14:40:33 +02:00
2021-09-26 14:09:01 +02:00
2022-02-05 12:37:56 +01:00
2022-04-08 14:40:33 +02:00
2022-03-23 09:13:27 +01:00
2020-09-22 23:39:45 -04:00
2022-01-20 09:17:50 +01:00
2021-12-22 09:30:58 +01:00
2022-04-08 14:40:42 +02:00
2022-04-08 14:39:56 +02:00
2021-09-30 10:11:08 +02:00
2020-09-18 16:45:50 -04:00
2022-02-23 12:00:59 +01:00
2020-10-16 11:11:22 -07:00
2021-08-12 13:22:19 +02:00
2020-10-24 12:26:05 -07:00
2021-05-19 10:13:10 +02:00
2020-10-02 12:02:30 +02:00
2020-09-18 16:45:50 -04:00
2022-03-02 11:42:54 +01:00
2022-04-13 21:00:53 +02:00
2022-02-01 17:25:39 +01:00
2020-10-24 12:26:05 -07:00
2020-09-10 14:03:31 -07:00
2021-10-17 10:43:33 +02:00
2021-10-06 15:55:46 +02:00
2022-01-11 15:25:01 +01:00
2021-12-22 09:30:57 +01:00
2021-12-14 11:32:40 +01:00
2022-04-08 14:40:44 +02:00
2022-04-08 14:40:45 +02:00
2020-08-24 08:49:13 +10:00
2021-03-17 17:06:35 +01:00
2021-06-03 09:00:45 +02:00
2020-10-18 09:27:09 -07:00
2022-04-08 14:40:45 +02:00
2020-10-14 14:54:45 -07:00
2021-07-14 16:56:13 +02:00
2020-07-29 16:14:27 +02:00
2021-04-14 08:41:58 +02:00
2021-05-11 14:47:12 +02:00
2022-04-08 14:39:57 +02:00
2021-09-15 09:50:27 +02:00
2020-10-17 15:05:30 -06:00
2022-04-08 14:40:30 +02:00
2022-02-08 18:30:36 +01:00
2020-10-13 18:38:27 -07:00
2020-07-29 16:14:27 +02:00
2021-07-14 16:56:31 +02:00
2020-08-23 17:36:59 -05:00
2020-08-04 21:02:38 -04:00
2021-11-26 10:39:22 +01:00
2021-07-31 08:16:11 +02:00
2022-04-13 21:01:08 +02:00
2021-09-18 13:40:06 +02:00
2021-02-13 13:54:56 +01:00
2020-07-31 08:16:01 +02:00
2021-02-17 11:02:21 +01:00
2021-10-27 09:56:51 +02:00
2020-11-22 10:48:22 -08:00
2021-03-20 10:43:44 +01:00
2020-10-23 11:33:41 -07:00
2022-02-01 17:25:48 +01:00
2021-08-26 08:35:57 -04:00
2021-07-14 16:55:59 +02:00
2022-03-16 14:16:02 +01:00
2021-03-17 17:06:13 +01:00
2020-12-30 11:54:02 +01:00
2020-10-23 11:33:41 -07:00
2021-04-21 13:00:54 +02:00
2020-10-15 09:48:49 -07:00
2022-01-29 10:26:11 +01:00
2021-07-20 16:05:59 +02:00
2021-12-14 11:32:40 +01:00
2020-10-24 12:40:18 -07:00
2022-04-27 13:53:54 +02:00
2020-08-27 16:06:47 -04:00
2022-02-23 12:00:59 +01:00
2021-10-27 09:56:51 +02:00
2020-07-31 08:16:01 +02:00
2020-10-13 18:38:27 -07:00
75ac724684