From patchwork Sat Jan 7 19:50:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fedor Pchelkin X-Patchwork-Id: 3698 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4e01:0:0:0:0:0 with SMTP id p1csp1431719wrt; Sat, 7 Jan 2023 11:56:20 -0800 (PST) X-Google-Smtp-Source: AMrXdXtypIToXhytjUzW/NpEpKI/+b1sZ7iZ2Qy3465UwkCjeYmxZlMaNBJbLp+SjiVZSlDFaW/K X-Received: by 2002:a05:6402:2a02:b0:470:44eb:9e58 with SMTP id ey2-20020a0564022a0200b0047044eb9e58mr53852252edb.30.1673121380121; Sat, 07 Jan 2023 11:56:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1673121380; cv=none; d=google.com; s=arc-20160816; b=mueChdR/q7Tp8qDfZ4WN31dGp63QzNAWAtOtui2hdxqdBTpvX/PyHRCmoQ/o0uZOFp cOr2nZT0awY8nK1zroc4EywYtpaivvSpVd+2BwxS+l82rzdzbbF8iEHP5AaQtIRhMm78 iZhZmVqzIl8wxWsBP49/FJateQljW8xlCMFpkOEyp95tZ2tIfJp1tEBSpBgxO4hlJVpL mUt5WrwgJujQ7GnKeSvGbDh8gUP2IxEqolAK7HLWblurM0oE5QbM7d17A44qQCsKIR2q koLD8PpdTYYrBM7iaYze/yaheuO+n2ldF0t4i9+2xdugy3hdB3UNo/c/7ItWMwAGLbbw v9Sg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature:dkim-filter; bh=zyDTpQsc+BA1w6l0ID0YaSJ5ZrE2jWSGJh7OYRgTWMY=; b=hcsDG9u2QTM9hipawtbNtaTGt1+1RRrg6BT7gRXx4sLFkTrROJ+9JL9W39FhBqNH90 M5yZQBGQxoppkyyOaRdTYguKT9fm+s1fUQYyQ7NzR8nTxt/SEnE2mqduiqVidKEwqcnf zK3ceZHQQfeqnDcdRJHQ8CK437N27pb/x7y9M1R1Q53mepFXxPUrBTamr3+flnv7JVi6 GKcWvejqrsnG/ceXGq1NsUz2HyW4J4geWOxEhwchmbv5tSdOpJcpjyEeA6I8z2AdZ21Y oRC2KNsMKu88mVRAyi9tlAL3/wd3JDLIlhBhQssKOuJvp5tQZXNLBtaky87GhfUWWVqp IPLQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=D8BLxAjC; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s18-20020a056402165200b0048f5c0d9c6fsi2084719edx.349.2023.01.07.11.55.56; Sat, 07 Jan 2023 11:56:20 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=D8BLxAjC; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232413AbjAGTut (ORCPT + 99 others); Sat, 7 Jan 2023 14:50:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229621AbjAGTur (ORCPT ); Sat, 7 Jan 2023 14:50:47 -0500 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 878E9482AF for ; Sat, 7 Jan 2023 11:50:46 -0800 (PST) Received: from fedcomp.intra.ispras.ru (unknown [46.242.14.200]) by mail.ispras.ru (Postfix) with ESMTPSA id AAE39419E9CD; Sat, 7 Jan 2023 19:50:39 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru AAE39419E9CD DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1673121039; bh=zyDTpQsc+BA1w6l0ID0YaSJ5ZrE2jWSGJh7OYRgTWMY=; h=From:To:Cc:Subject:Date:From; b=D8BLxAjCNF9AtnFH/kxA2aqlhMSg3agzUOBdF3UeaUVGc43lkLhA33ZflQ0cZg1XK ZSwUrd0GQzY3j7yQ+GNBsbFbZ2Gs+/GcMZueqcDHHZ7pILFaVKZjEvRpGZlUZYNvu7 B1VoTYByrQ/OIvArfSdNH80hjUCb3wWyOwsE71Mc= From: Fedor Pchelkin To: Jan Kara Cc: Fedor Pchelkin , linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org Subject: [PATCH 0/1] udf: Fix null-ptr-deref in udf_write_fi() Date: Sat, 7 Jan 2023 22:50:15 +0300 Message-Id: <20230107195016.290627-1-pchelkin@ispras.ru> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1754394848394622653?= X-GMAIL-MSGID: =?utf-8?q?1754394924477467924?= Hello Jan, Syzkaller reports the following problems [1]. null-ptr-deref is fixed by the following patch. About out-of-bounds write: I suppose it is due to the similar issue which caused null-ptr-deref bug - udf_find_entry() return value is not checked and we can end up with an incorrect ocfi and ofibh structs. Actually, padlen in udf_write_fi() becomes less than zero because the values it is consisted of are invalid, then padlen is passed to memcpy and here is the bug. Should I also add this to the patch description text (I'm not sure about it as that is just a consequence of null-ptr-deref bug)? With the applied patch reproducers on my machine do not trigger null-ptr-deref and out-of-bounds anymore. The only thing is that: does udf_rename() need to immediately return with an error if udf_find_entry() fails here? If ofi is an error pointer (especially -ENOMEM), udf_rename should return an error. But if ofi is NULL, the entry has probably already been deleted, and we should just skip udf_delete_entry() call. [1] https://syzkaller.appspot.com/bug?id=ddfcda66fe98b595b0fe11d9dd64eb532478f04b Fedor