Message ID | 20221207162807.227498-1-zengheng4@huawei.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp286086wrr; Wed, 7 Dec 2022 08:36:53 -0800 (PST) X-Google-Smtp-Source: AA0mqf4+qVu99yW4IvsXnYCo+cs+kPXcD8pla93mgYkGTmFgNYMUT/kytlYpz5wD0xJJ/ktkIvo/ X-Received: by 2002:a63:d60a:0:b0:476:85ed:5596 with SMTP id q10-20020a63d60a000000b0047685ed5596mr64458844pgg.88.1670431013488; Wed, 07 Dec 2022 08:36:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670431013; cv=none; d=google.com; s=arc-20160816; b=ypioKTQ+12qMTjsd3Jo+1+fuvJbfJGnaQmesYKRt7SJjT7NkwTtWcMMh6uKdsZio16 M+8a7rrPTuF90hwMHUUYAic+GypcJNcBNem6boLqLj+cTggQliZPirRCJJMrwm58ufDE efp6u42zaxMD5YgF6IIZLGJT1MrQjXdF7EFIUOllDpF9im5/urVSIVSZtGWXhjlUb1uT +O3UNh7sI0qyog2smxvBLLs8WE8u2shr6zWwEb0lezbkYcqBVJYafyQFlJ+0c8Kf4/hU ugfM1GqfivXcPIS0XsddWfr5IrigWSUZpi03SEhw6i0DFHYVxhXPcBB5KLkuAOMGvki7 cyeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=jCg8WARo0huBoluUIa28H+PWD4IKMhRVHCC+t7acHAU=; b=orlPE8vTbi2xfsA0TP3nOA8hhKlliDUPTcO4v4cyeH+GMsZhsS5+irrZYXqTB+2cED 9+YCXTGQN2Z/UzrttRydTq2+kpTdNZf2t2mo4gyRMCK1WWBgk+R6/MLsd7uhv9zakopx wLVIyc5TyyUQXBUH7znqOKzSvakyd78VD3EMpsRX3xMVEmw5Fj294ia1aficddlHqPY2 RMmd56PhyNiaJO43NDGNPMqHdL1rXsjXTOucRYuc5OERcmZjnkRMDGMVV4YwoQ7Fby7J NIOBvdgxmBm/NBx+wA1T/1OXVf6MzKW/1P+anazCWZ+ftKYhYUu52BTeoeKsBXpGHC9z O4wQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id nv13-20020a17090b1b4d00b002192eb3532bsi2020098pjb.116.2022.12.07.08.36.38; Wed, 07 Dec 2022 08:36:53 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229703AbiLGQab (ORCPT <rfc822;foxyelen666@gmail.com> + 99 others); Wed, 7 Dec 2022 11:30:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229572AbiLGQaa (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Wed, 7 Dec 2022 11:30:30 -0500 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 57CE52BFA for <linux-kernel@vger.kernel.org>; Wed, 7 Dec 2022 08:30:28 -0800 (PST) Received: from kwepemi500024.china.huawei.com (unknown [172.30.72.53]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4NS2jp6tDlzJp5r; Thu, 8 Dec 2022 00:26:54 +0800 (CST) Received: from huawei.com (10.175.103.91) by kwepemi500024.china.huawei.com (7.221.188.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 8 Dec 2022 00:30:25 +0800 From: Zeng Heng <zengheng4@huawei.com> To: <almaz.alexandrovich@paragon-software.com> CC: <ntfs3@lists.linux.dev>, <liwei391@huawei.com>, <linux-kernel@vger.kernel.org>, <syzkaller-bugs@googlegroups.com> Subject: [PATCH] ntfs: fix panic about slab-out-of-bounds caused by ntfs_listxattr() Date: Thu, 8 Dec 2022 00:28:07 +0800 Message-ID: <20221207162807.227498-1-zengheng4@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.175.103.91] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemi500024.china.huawei.com (7.221.188.100) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751573870326256449?= X-GMAIL-MSGID: =?utf-8?q?1751573870326256449?= |
Series |
ntfs: fix panic about slab-out-of-bounds caused by ntfs_listxattr()
|
|
Commit Message
Zeng Heng
Dec. 7, 2022, 4:28 p.m. UTC
Here is a BUG report from syzbot:
BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632
Call Trace:
ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
vfs_listxattr fs/xattr.c:457 [inline]
listxattr+0x293/0x2d0 fs/xattr.c:804
Fix the logic of ea_all iteration. When the ea->name_len is 0,
return immediately, or Add2Ptr() would visit invalid memory
in the next loop.
Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com
Signed-off-by: Zeng Heng <zengheng4@huawei.com>
---
fs/ntfs3/xattr.c | 3 +++
1 file changed, 3 insertions(+)
Comments
On 2022/12/8 0:28, Zeng Heng wrote: > Here is a BUG report from syzbot: > > BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] > BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 > Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632 > > Call Trace: > ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] > ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 > vfs_listxattr fs/xattr.c:457 [inline] > listxattr+0x293/0x2d0 fs/xattr.c:804 > > Fix the logic of ea_all iteration. When the ea->name_len is 0, > return immediately, or Add2Ptr() would visit invalid memory > in the next loop. > > Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") > Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com > Signed-off-by: Zeng Heng <zengheng4@huawei.com> > --- > fs/ntfs3/xattr.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c > index 7de8718c68a9..911e110b8d6e 100644 > --- a/fs/ntfs3/xattr.c > +++ b/fs/ntfs3/xattr.c > @@ -178,6 +178,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, > for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) { > ea = Add2Ptr(ea_all, off); > > + if (!ea->name_len) > + break; > + > if (buffer) { > if (ret + ea->name_len + 1 > bytes_per_buffer) { > err = -ERANGE; Is there any comment about this patch? Thanks for advance. Zeng Heng
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index 7de8718c68a9..911e110b8d6e 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -178,6 +178,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) { ea = Add2Ptr(ea_all, off); + if (!ea->name_len) + break; + if (buffer) { if (ret + ea->name_len + 1 > bytes_per_buffer) { err = -ERANGE;