From: eadavis@sina.com
To: dan.carpenter@oracle.com
Cc: almaz.alexandrovich@paragon-software.com,
kbuild-all@lists.01.org, linux-kernel@vger.kernel.org,
lkp@intel.com, llvm@lists.linux.dev, nathan@kernel.org,
ndesaulniers@google.com, ntfs3@lists.linux.dev,
syzbot+c4d950787fd5553287b7@syzkaller.appspotmail.com,
syzkaller-bugs@googlegroups.com, trix@redhat.com,
eadaivs <eadaivs@sina.com>
Subject: [PATCH v4] fs/ntfs3: Fix buffer overflow and integer overflow
Date: Mon, 19 Sep 2022 21:21:59 +0800 [thread overview]
Message-ID: <20220919132159.307938-1-eadavis@sina.com> (raw)
In-Reply-To: <Yyhaw8iBPulIO0Pp@kadam>
From: eadaivs <eadaivs@sina.com>
1) If we call find_ea() if "bytes" less than 8 then the
unpacked_ea_size() is an out of bounds read.
2) The *off + unpacked_ea_size() can have an integer overflow.
Link: https://syzkaller.appspot.com/bug?extid=c4d950787fd5553287b7
Reported-by: syzbot+c4d950787fd5553287b7@syzkaller.appspotmail.com
Signed-off-by: eadaivs <eadaivs@sina.com>
---
Changes in v4:
Separate out the issue with the buffer overflow and the integer
overflow.
fs/ntfs3/xattr.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index afd0ddad826f..3cd1a24c7bcc 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -41,17 +41,23 @@ static inline size_t packed_ea_size(const struct EA_FULL *ea)
*
* Assume there is at least one xattr in the list.
*/
-static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes,
+static inline bool find_ea(const struct EA_FULL *ea_all, size_t bytes,
const char *name, u8 name_len, u32 *off)
{
+ const struct EA_FULL *ea;
+ u32 next_off;
*off = 0;
- if (!ea_all || !bytes)
+ if (!ea_all || bytes < sizeof(*ea))
return false;
for (;;) {
- const struct EA_FULL *ea = Add2Ptr(ea_all, *off);
- u32 next_off = *off + unpacked_ea_size(ea);
+ *ea = Add2Ptr(ea_all, *off);
+
+ if (sizeof(*ea) + *off > bytes)
+ return false;
+
+ next_off = size_add(*off + unpacked_ea_size(ea));
if (next_off > bytes)
return false;
@@ -61,8 +67,6 @@ static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes,
return true;
*off = next_off;
- if (next_off >= bytes)
- return false;
}
}
--
2.37.2
WARNING: multiple messages have this Message-ID (diff)
From: eadavis@sina.com
To: kbuild-all@lists.01.org
Subject: [PATCH v4] fs/ntfs3: Fix buffer overflow and integer overflow
Date: Mon, 19 Sep 2022 21:21:59 +0800 [thread overview]
Message-ID: <20220919132159.307938-1-eadavis@sina.com> (raw)
In-Reply-To: <Yyhaw8iBPulIO0Pp@kadam>
[-- Attachment #1: Type: text/plain, Size: 1725 bytes --]
From: eadaivs <eadaivs@sina.com>
1) If we call find_ea() if "bytes" less than 8 then the
unpacked_ea_size() is an out of bounds read.
2) The *off + unpacked_ea_size() can have an integer overflow.
Link: https://syzkaller.appspot.com/bug?extid=c4d950787fd5553287b7
Reported-by: syzbot+c4d950787fd5553287b7(a)syzkaller.appspotmail.com
Signed-off-by: eadaivs <eadaivs@sina.com>
---
Changes in v4:
Separate out the issue with the buffer overflow and the integer
overflow.
fs/ntfs3/xattr.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index afd0ddad826f..3cd1a24c7bcc 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -41,17 +41,23 @@ static inline size_t packed_ea_size(const struct EA_FULL *ea)
*
* Assume there is at least one xattr in the list.
*/
-static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes,
+static inline bool find_ea(const struct EA_FULL *ea_all, size_t bytes,
const char *name, u8 name_len, u32 *off)
{
+ const struct EA_FULL *ea;
+ u32 next_off;
*off = 0;
- if (!ea_all || !bytes)
+ if (!ea_all || bytes < sizeof(*ea))
return false;
for (;;) {
- const struct EA_FULL *ea = Add2Ptr(ea_all, *off);
- u32 next_off = *off + unpacked_ea_size(ea);
+ *ea = Add2Ptr(ea_all, *off);
+
+ if (sizeof(*ea) + *off > bytes)
+ return false;
+
+ next_off = size_add(*off + unpacked_ea_size(ea));
if (next_off > bytes)
return false;
@@ -61,8 +67,6 @@ static inline bool find_ea(const struct EA_FULL *ea_all, u32 bytes,
return true;
*off = next_off;
- if (next_off >= bytes)
- return false;
}
}
--
2.37.2
next prev parent reply other threads:[~2022-09-19 13:22 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-06 16:55 [syzbot] KASAN: slab-out-of-bounds Read in ntfs_get_ea syzbot
2022-09-12 3:41 ` [PATCH] fs/netfs3: add a boundary check for EA_FULL eadavis
2022-09-12 6:16 ` kernel test robot
2022-09-12 6:16 ` kernel test robot
2022-09-19 5:19 ` [PATCH] fs/ntfs3: "add a boundary check for EA_FULL" lose right parenthesis eadavis
2022-09-19 5:19 ` eadavis
2022-09-19 10:42 ` Dan Carpenter
2022-09-19 10:42 ` Dan Carpenter
2022-09-19 11:19 ` [PATCH v3] fs/ntfs3: add a boundary check for EA_FULL eadavis
2022-09-19 11:19 ` eadavis
2022-09-19 12:04 ` Dan Carpenter
2022-09-19 12:04 ` Dan Carpenter
2022-09-19 13:21 ` eadavis [this message]
2022-09-19 13:21 ` [PATCH v4] fs/ntfs3: Fix buffer overflow and integer overflow eadavis
2022-09-19 13:32 ` eadavis
2022-09-19 13:32 ` eadavis
2022-11-13 5:07 ` [PATCH v5] fs/ntfs3: Validate parameter bytes and valid size eadavis
2022-09-12 6:54 ` [PATCH v2] fs/netfs3: add a boundary check for EA_FULL eadavis
2022-09-14 15:34 ` Dan Carpenter
2023-01-26 8:13 ` [syzbot] KASAN: slab-out-of-bounds Read in ntfs_get_ea syzbot
2023-04-12 13:11 ` Aleksandr Nogikh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220919132159.307938-1-eadavis@sina.com \
--to=eadavis@sina.com \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=dan.carpenter@oracle.com \
--cc=eadaivs@sina.com \
--cc=kbuild-all@lists.01.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=llvm@lists.linux.dev \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=ntfs3@lists.linux.dev \
--cc=syzbot+c4d950787fd5553287b7@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=trix@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.