* [PATCH v2 1/2] exfat: move is_valid_cluster to a common header @ 2022-05-11 18:59 ` Tadeusz Struk 2022-05-11 18:59 ` [PATCH v2 2/2] exfat: check if cluster num is valid Tadeusz Struk 2022-05-15 14:38 ` [PATCH v2 1/2] exfat: move is_valid_cluster to a common header Sungjong Seo 0 siblings, 2 replies; 7+ messages in thread From: Tadeusz Struk @ 2022-05-11 18:59 UTC (permalink / raw) To: linkinjeon Cc: Tadeusz Struk, Sungjong Seo, linux-fsdevel, stable, linux-kernel Move the is_valid_cluster() helper from fatent.c to a common header to make it reusable in other *.c files. Cc: Namjae Jeon <linkinjeon@kernel.org> Cc: Sungjong Seo <sj1557.seo@samsung.com> Cc: linux-fsdevel@vger.kernel.org Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> --- fs/exfat/exfat_fs.h | 6 ++++++ fs/exfat/fatent.c | 6 ------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h index c6800b880920..42d06c68d5c5 100644 --- a/fs/exfat/exfat_fs.h +++ b/fs/exfat/exfat_fs.h @@ -381,6 +381,12 @@ static inline int exfat_sector_to_cluster(struct exfat_sb_info *sbi, EXFAT_RESERVED_CLUSTERS; } +static inline bool is_valid_cluster(struct exfat_sb_info *sbi, + unsigned int clus) +{ + return clus >= EXFAT_FIRST_CLUSTER && clus < sbi->num_clusters; +} + /* super.c */ int exfat_set_volume_dirty(struct super_block *sb); int exfat_clear_volume_dirty(struct super_block *sb); diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c index a3464e56a7e1..421c27353104 100644 --- a/fs/exfat/fatent.c +++ b/fs/exfat/fatent.c @@ -81,12 +81,6 @@ int exfat_ent_set(struct super_block *sb, unsigned int loc, return 0; } -static inline bool is_valid_cluster(struct exfat_sb_info *sbi, - unsigned int clus) -{ - return clus >= EXFAT_FIRST_CLUSTER && clus < sbi->num_clusters; -} - int exfat_ent_get(struct super_block *sb, unsigned int loc, unsigned int *content) { -- 2.36.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH v2 2/2] exfat: check if cluster num is valid 2022-05-11 18:59 ` [PATCH v2 1/2] exfat: move is_valid_cluster to a common header Tadeusz Struk @ 2022-05-11 18:59 ` Tadeusz Struk 2022-05-15 14:52 ` Sungjong Seo 2022-05-15 14:38 ` [PATCH v2 1/2] exfat: move is_valid_cluster to a common header Sungjong Seo 1 sibling, 1 reply; 7+ messages in thread From: Tadeusz Struk @ 2022-05-11 18:59 UTC (permalink / raw) To: linkinjeon Cc: Tadeusz Struk, Sungjong Seo, linux-fsdevel, stable, linux-kernel, syzbot+a4087e40b9c13aad7892 Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. This was triggered by reproducer calling truncute with size 0, which causes the following trace: BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz-executor251/365 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x81/0x3c0 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 exfat_free_cluster+0x25a/0x4a0 fs/exfat/fatent.c:181 __exfat_truncate+0x99e/0xe00 fs/exfat/file.c:217 exfat_truncate+0x11b/0x4f0 fs/exfat/file.c:243 exfat_setattr+0xa03/0xd40 fs/exfat/file.c:339 notify_change+0xb76/0xe10 fs/attr.c:336 do_truncate+0x1ea/0x2d0 fs/open.c:65 Add checks to validate if cluster number is within valid range in exfat_clear_bitmap() and exfat_set_bitmap() Cc: Namjae Jeon <linkinjeon@kernel.org> Cc: Sungjong Seo <sj1557.seo@samsung.com> Cc: linux-fsdevel@vger.kernel.org Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org Link: https://syzkaller.appspot.com/bug?id=50381fc73821ecae743b8cf24b4c9a04776f767c Reported-by: syzbot+a4087e40b9c13aad7892@syzkaller.appspotmail.com Fixes: 1e49a94cf707 ("exfat: add bitmap operations") Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> --- v2: - Use is_valid_cluster() helper to validate clu --- fs/exfat/balloc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c index 03f142307174..92f5b5b5a0d0 100644 --- a/fs/exfat/balloc.c +++ b/fs/exfat/balloc.c @@ -149,6 +149,9 @@ int exfat_set_bitmap(struct inode *inode, unsigned int clu, bool sync) struct exfat_sb_info *sbi = EXFAT_SB(sb); WARN_ON(clu < EXFAT_FIRST_CLUSTER); + if (!is_valid_cluster(sbi, clu)) + return -EINVAL; + ent_idx = CLUSTER_TO_BITMAP_ENT(clu); i = BITMAP_OFFSET_SECTOR_INDEX(sb, ent_idx); b = BITMAP_OFFSET_BIT_IN_SECTOR(sb, ent_idx); @@ -167,6 +170,9 @@ void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) struct exfat_mount_options *opts = &sbi->options; WARN_ON(clu < EXFAT_FIRST_CLUSTER); + if (!is_valid_cluster(sbi, clu)) + return; + ent_idx = CLUSTER_TO_BITMAP_ENT(clu); i = BITMAP_OFFSET_SECTOR_INDEX(sb, ent_idx); b = BITMAP_OFFSET_BIT_IN_SECTOR(sb, ent_idx); -- 2.36.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* RE: [PATCH v2 2/2] exfat: check if cluster num is valid 2022-05-11 18:59 ` [PATCH v2 2/2] exfat: check if cluster num is valid Tadeusz Struk @ 2022-05-15 14:52 ` Sungjong Seo 2022-05-16 14:51 ` Tadeusz Struk 0 siblings, 1 reply; 7+ messages in thread From: Sungjong Seo @ 2022-05-15 14:52 UTC (permalink / raw) To: 'Tadeusz Struk', linkinjeon Cc: linux-fsdevel, stable, linux-kernel, syzbot+a4087e40b9c13aad7892, sj1557.seo > Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. > This was triggered by reproducer calling truncute with size 0, which > causes the following trace: > > BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap+0x147/0x490 > fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz- > executor251/365 > > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b > lib/dump_stack.c:118 > print_address_description+0x81/0x3c0 mm/kasan/report.c:233 > __kasan_report mm/kasan/report.c:419 [inline] > kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 > exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 > exfat_free_cluster+0x25a/0x4a0 fs/exfat/fatent.c:181 > __exfat_truncate+0x99e/0xe00 fs/exfat/file.c:217 > exfat_truncate+0x11b/0x4f0 fs/exfat/file.c:243 > exfat_setattr+0xa03/0xd40 fs/exfat/file.c:339 > notify_change+0xb76/0xe10 fs/attr.c:336 > do_truncate+0x1ea/0x2d0 fs/open.c:65 > > Add checks to validate if cluster number is within valid range in > exfat_clear_bitmap() and exfat_set_bitmap() > > Cc: Namjae Jeon <linkinjeon@kernel.org> > Cc: Sungjong Seo <sj1557.seo@samsung.com> > Cc: linux-fsdevel@vger.kernel.org > Cc: stable@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > > Link: https://protect2.fireeye.com/v1/url?k=24a746d8-45dcec51-24a6cd97- > 74fe48600034-8e4653a49a463f3c&q=1&e=0efc824d-6463-4253-9cd7- > ce3199dbf513&u=https%3A%2F%2Fsyzkaller.appspot.com%2Fbug%3Fid%3D50381fc738 > 21ecae743b8cf24b4c9a04776f767c > Reported-by: syzbot+a4087e40b9c13aad7892@syzkaller.appspotmail.com > Fixes: 1e49a94cf707 ("exfat: add bitmap operations") > Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> Looks good. And it seems that WARN_ON() is no longer needed. Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com> > --- > v2: > - Use is_valid_cluster() helper to validate clu > --- > fs/exfat/balloc.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c index > 03f142307174..92f5b5b5a0d0 100644 > --- a/fs/exfat/balloc.c > +++ b/fs/exfat/balloc.c > @@ -149,6 +149,9 @@ int exfat_set_bitmap(struct inode *inode, unsigned int > clu, bool sync) > struct exfat_sb_info *sbi = EXFAT_SB(sb); > > WARN_ON(clu < EXFAT_FIRST_CLUSTER); > + if (!is_valid_cluster(sbi, clu)) > + return -EINVAL; > + > ent_idx = CLUSTER_TO_BITMAP_ENT(clu); > i = BITMAP_OFFSET_SECTOR_INDEX(sb, ent_idx); > b = BITMAP_OFFSET_BIT_IN_SECTOR(sb, ent_idx); @@ -167,6 +170,9 @@ > void exfat_clear_bitmap(struct inode *inode, unsigned int clu, bool sync) > struct exfat_mount_options *opts = &sbi->options; > > WARN_ON(clu < EXFAT_FIRST_CLUSTER); > + if (!is_valid_cluster(sbi, clu)) > + return; > + > ent_idx = CLUSTER_TO_BITMAP_ENT(clu); > i = BITMAP_OFFSET_SECTOR_INDEX(sb, ent_idx); > b = BITMAP_OFFSET_BIT_IN_SECTOR(sb, ent_idx); > -- > 2.36.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 2/2] exfat: check if cluster num is valid 2022-05-15 14:52 ` Sungjong Seo @ 2022-05-16 14:51 ` Tadeusz Struk 2022-05-16 23:31 ` Namjae Jeon 0 siblings, 1 reply; 7+ messages in thread From: Tadeusz Struk @ 2022-05-16 14:51 UTC (permalink / raw) To: Sungjong Seo, linkinjeon Cc: linux-fsdevel, stable, linux-kernel, syzbot+a4087e40b9c13aad7892 On 5/15/22 07:52, Sungjong Seo wrote: >> Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. >> This was triggered by reproducer calling truncute with size 0, which >> causes the following trace: >> >> BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap+0x147/0x490 >> fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz- >> executor251/365 >> >> Call Trace: >> __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b >> lib/dump_stack.c:118 >> print_address_description+0x81/0x3c0 mm/kasan/report.c:233 >> __kasan_report mm/kasan/report.c:419 [inline] >> kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 >> __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 >> exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 >> exfat_free_cluster+0x25a/0x4a0 fs/exfat/fatent.c:181 >> __exfat_truncate+0x99e/0xe00 fs/exfat/file.c:217 >> exfat_truncate+0x11b/0x4f0 fs/exfat/file.c:243 >> exfat_setattr+0xa03/0xd40 fs/exfat/file.c:339 >> notify_change+0xb76/0xe10 fs/attr.c:336 >> do_truncate+0x1ea/0x2d0 fs/open.c:65 >> >> Add checks to validate if cluster number is within valid range in >> exfat_clear_bitmap() and exfat_set_bitmap() >> >> Cc: Namjae Jeon<linkinjeon@kernel.org> >> Cc: Sungjong Seo<sj1557.seo@samsung.com> >> Cc:linux-fsdevel@vger.kernel.org >> Cc:stable@vger.kernel.org >> Cc:linux-kernel@vger.kernel.org >> >> Link:https://protect2.fireeye.com/v1/url?k=24a746d8-45dcec51-24a6cd97- >> 74fe48600034-8e4653a49a463f3c&q=1&e=0efc824d-6463-4253-9cd7- >> ce3199dbf513&u=https%3A%2F%2Fsyzkaller.appspot.com%2Fbug%3Fid%3D50381fc738 >> 21ecae743b8cf24b4c9a04776f767c >> Reported-by:syzbot+a4087e40b9c13aad7892@syzkaller.appspotmail.com >> Fixes: 1e49a94cf707 ("exfat: add bitmap operations") >> Signed-off-by: Tadeusz Struk<tadeusz.struk@linaro.org> > Looks good. > And it seems that WARN_ON() is no longer needed. Right. Do you want me to send a follow up patch that drops the WARN_ONs? > Reviewed-by: Sungjong Seo<sj1557.seo@samsung.com> > Thank you. -- Thanks, Tadeusz ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 2/2] exfat: check if cluster num is valid 2022-05-16 14:51 ` Tadeusz Struk @ 2022-05-16 23:31 ` Namjae Jeon 2022-05-16 23:38 ` Tadeusz Struk 0 siblings, 1 reply; 7+ messages in thread From: Namjae Jeon @ 2022-05-16 23:31 UTC (permalink / raw) To: Tadeusz Struk Cc: Sungjong Seo, linux-fsdevel, stable, linux-kernel, syzbot+a4087e40b9c13aad7892 2022-05-16 23:51 GMT+09:00, Tadeusz Struk <tadeusz.struk@linaro.org>: > On 5/15/22 07:52, Sungjong Seo wrote: >>> Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. >>> This was triggered by reproducer calling truncute with size 0, which >>> causes the following trace: >>> >>> BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap+0x147/0x490 >>> fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task >>> syz- >>> executor251/365 >>> >>> Call Trace: >>> __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b >>> lib/dump_stack.c:118 >>> print_address_description+0x81/0x3c0 mm/kasan/report.c:233 >>> __kasan_report mm/kasan/report.c:419 [inline] >>> kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436 >>> __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 >>> exfat_clear_bitmap+0x147/0x490 fs/exfat/balloc.c:174 >>> exfat_free_cluster+0x25a/0x4a0 fs/exfat/fatent.c:181 >>> __exfat_truncate+0x99e/0xe00 fs/exfat/file.c:217 >>> exfat_truncate+0x11b/0x4f0 fs/exfat/file.c:243 >>> exfat_setattr+0xa03/0xd40 fs/exfat/file.c:339 >>> notify_change+0xb76/0xe10 fs/attr.c:336 >>> do_truncate+0x1ea/0x2d0 fs/open.c:65 >>> >>> Add checks to validate if cluster number is within valid range in >>> exfat_clear_bitmap() and exfat_set_bitmap() >>> >>> Cc: Namjae Jeon<linkinjeon@kernel.org> >>> Cc: Sungjong Seo<sj1557.seo@samsung.com> >>> Cc:linux-fsdevel@vger.kernel.org >>> Cc:stable@vger.kernel.org >>> Cc:linux-kernel@vger.kernel.org >>> >>> Link:https://protect2.fireeye.com/v1/url?k=24a746d8-45dcec51-24a6cd97- >>> 74fe48600034-8e4653a49a463f3c&q=1&e=0efc824d-6463-4253-9cd7- >>> ce3199dbf513&u=https%3A%2F%2Fsyzkaller.appspot.com%2Fbug%3Fid%3D50381fc738 >>> 21ecae743b8cf24b4c9a04776f767c >>> Reported-by:syzbot+a4087e40b9c13aad7892@syzkaller.appspotmail.com >>> Fixes: 1e49a94cf707 ("exfat: add bitmap operations") >>> Signed-off-by: Tadeusz Struk<tadeusz.struk@linaro.org> >> Looks good. >> And it seems that WARN_ON() is no longer needed. > > Right. Do you want me to send a follow up patch that drops the WARN_ONs? You don't need to do it. I have applied this patch to #exfat dev branch after removing it. Note that I have combined 1/2 into 2/2 patch. Thanks! > >> Reviewed-by: Sungjong Seo<sj1557.seo@samsung.com> >> > > Thank you. > > -- > Thanks, > Tadeusz > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2 2/2] exfat: check if cluster num is valid 2022-05-16 23:31 ` Namjae Jeon @ 2022-05-16 23:38 ` Tadeusz Struk 0 siblings, 0 replies; 7+ messages in thread From: Tadeusz Struk @ 2022-05-16 23:38 UTC (permalink / raw) To: Namjae Jeon Cc: Sungjong Seo, linux-fsdevel, stable, linux-kernel, syzbot+a4087e40b9c13aad7892 On 5/16/22 16:31, Namjae Jeon wrote: >>> Looks good. >>> And it seems that WARN_ON() is no longer needed. >> Right. Do you want me to send a follow up patch that drops the WARN_ONs? > You don't need to do it. I have applied this patch to #exfat dev > branch after removing it. > Note that I have combined 1/2 into 2/2 patch. > Thanks! That's fine with me. Thanks for taking it. -- Thanks, Tadeusz ^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: [PATCH v2 1/2] exfat: move is_valid_cluster to a common header 2022-05-11 18:59 ` [PATCH v2 1/2] exfat: move is_valid_cluster to a common header Tadeusz Struk 2022-05-11 18:59 ` [PATCH v2 2/2] exfat: check if cluster num is valid Tadeusz Struk @ 2022-05-15 14:38 ` Sungjong Seo 1 sibling, 0 replies; 7+ messages in thread From: Sungjong Seo @ 2022-05-15 14:38 UTC (permalink / raw) To: 'Tadeusz Struk', linkinjeon Cc: linux-fsdevel, stable, linux-kernel, sj1557.seo > Move the is_valid_cluster() helper from fatent.c to a common header to > make it reusable in other *.c files. > > Cc: Namjae Jeon <linkinjeon@kernel.org> > Cc: Sungjong Seo <sj1557.seo@samsung.com> > Cc: linux-fsdevel@vger.kernel.org > Cc: stable@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > > Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> Looks good, thanks for your patch! Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com> > --- > fs/exfat/exfat_fs.h | 6 ++++++ > fs/exfat/fatent.c | 6 ------ > 2 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h index > c6800b880920..42d06c68d5c5 100644 > --- a/fs/exfat/exfat_fs.h > +++ b/fs/exfat/exfat_fs.h > @@ -381,6 +381,12 @@ static inline int exfat_sector_to_cluster(struct > exfat_sb_info *sbi, > EXFAT_RESERVED_CLUSTERS; > } > > +static inline bool is_valid_cluster(struct exfat_sb_info *sbi, > + unsigned int clus) > +{ > + return clus >= EXFAT_FIRST_CLUSTER && clus < sbi->num_clusters; } > + > /* super.c */ > int exfat_set_volume_dirty(struct super_block *sb); int > exfat_clear_volume_dirty(struct super_block *sb); diff --git > a/fs/exfat/fatent.c b/fs/exfat/fatent.c index a3464e56a7e1..421c27353104 > 100644 > --- a/fs/exfat/fatent.c > +++ b/fs/exfat/fatent.c > @@ -81,12 +81,6 @@ int exfat_ent_set(struct super_block *sb, unsigned int > loc, > return 0; > } > > -static inline bool is_valid_cluster(struct exfat_sb_info *sbi, > - unsigned int clus) > -{ > - return clus >= EXFAT_FIRST_CLUSTER && clus < sbi->num_clusters; > -} > - > int exfat_ent_get(struct super_block *sb, unsigned int loc, > unsigned int *content) > { > -- > 2.36.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-05-16 23:39 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20220511185940epcas1p3c5eb0603b969fe2753b4f16f6f8842a7@epcas1p3.samsung.com>
2022-05-11 18:59 ` [PATCH v2 1/2] exfat: move is_valid_cluster to a common header Tadeusz Struk
2022-05-11 18:59 ` [PATCH v2 2/2] exfat: check if cluster num is valid Tadeusz Struk
2022-05-15 14:52 ` Sungjong Seo
2022-05-16 14:51 ` Tadeusz Struk
2022-05-16 23:31 ` Namjae Jeon
2022-05-16 23:38 ` Tadeusz Struk
2022-05-15 14:38 ` [PATCH v2 1/2] exfat: move is_valid_cluster to a common header Sungjong Seo
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.