From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Chao Yu <yuchao0@huawei.com>, butt3rflyh4ck <butterflyhuangxx@gmail.com>, Jaegeuk Kim <jaegeuk@kernel.org>, Sasha Levin <sashal@kernel.org>, linux-f2fs-devel@lists.sourceforge.net Subject: [PATCH AUTOSEL 5.4 05/23] f2fs: fix to avoid out-of-bounds memory access Date: Wed, 12 May 2021 14:03:49 -0400 [thread overview] Message-ID: <20210512180408.665338-5-sashal@kernel.org> (raw) In-Reply-To: <20210512180408.665338-1-sashal@kernel.org> From: Chao Yu <yuchao0@huawei.com> [ Upstream commit b862676e371715456c9dade7990c8004996d0d9e ] butt3rflyh4ck <butterflyhuangxx@gmail.com> reported a bug found by syzkaller fuzzer with custom modifications in 5.12.0-rc3+ [1]: dump_stack+0xfa/0x151 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x82/0x32c mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 f2fs_test_bit fs/f2fs/f2fs.h:2572 [inline] current_nat_addr fs/f2fs/node.h:213 [inline] get_next_nat_page fs/f2fs/node.c:123 [inline] __flush_nat_entry_set fs/f2fs/node.c:2888 [inline] f2fs_flush_nat_entries+0x258e/0x2960 fs/f2fs/node.c:2991 f2fs_write_checkpoint+0x1372/0x6a70 fs/f2fs/checkpoint.c:1640 f2fs_issue_checkpoint+0x149/0x410 fs/f2fs/checkpoint.c:1807 f2fs_sync_fs+0x20f/0x420 fs/f2fs/super.c:1454 __sync_filesystem fs/sync.c:39 [inline] sync_filesystem fs/sync.c:67 [inline] sync_filesystem+0x1b5/0x260 fs/sync.c:48 generic_shutdown_super+0x70/0x370 fs/super.c:448 kill_block_super+0x97/0xf0 fs/super.c:1394 The root cause is, if nat entry in checkpoint journal area is corrupted, e.g. nid of journalled nat entry exceeds max nid value, during checkpoint, once it tries to flush nat journal to NAT area, get_next_nat_page() may access out-of-bounds memory on nat_bitmap due to it uses wrong nid value as bitmap offset. [1] https://lore.kernel.org/lkml/CAFcO6XOMWdr8pObek6eN6-fs58KG9doRFadgJj-FnF-1x43s2g@mail.gmail.com/T/#u Reported-and-tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- fs/f2fs/node.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 7ce33698ae38..48bb5d3c709d 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -2718,6 +2718,9 @@ static void remove_nats_in_journal(struct f2fs_sb_info *sbi) struct f2fs_nat_entry raw_ne; nid_t nid = le32_to_cpu(nid_in_journal(journal, i)); + if (f2fs_check_nid_range(sbi, nid)) + continue; + raw_ne = nat_in_journal(journal, i); ne = __lookup_nat_cache(nm_i, nid); -- 2.30.2
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sasha Levin <sashal@kernel.org>, butt3rflyh4ck <butterflyhuangxx@gmail.com>, linux-f2fs-devel@lists.sourceforge.net, Jaegeuk Kim <jaegeuk@kernel.org> Subject: [f2fs-dev] [PATCH AUTOSEL 5.4 05/23] f2fs: fix to avoid out-of-bounds memory access Date: Wed, 12 May 2021 14:03:49 -0400 [thread overview] Message-ID: <20210512180408.665338-5-sashal@kernel.org> (raw) In-Reply-To: <20210512180408.665338-1-sashal@kernel.org> From: Chao Yu <yuchao0@huawei.com> [ Upstream commit b862676e371715456c9dade7990c8004996d0d9e ] butt3rflyh4ck <butterflyhuangxx@gmail.com> reported a bug found by syzkaller fuzzer with custom modifications in 5.12.0-rc3+ [1]: dump_stack+0xfa/0x151 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x82/0x32c mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 f2fs_test_bit fs/f2fs/f2fs.h:2572 [inline] current_nat_addr fs/f2fs/node.h:213 [inline] get_next_nat_page fs/f2fs/node.c:123 [inline] __flush_nat_entry_set fs/f2fs/node.c:2888 [inline] f2fs_flush_nat_entries+0x258e/0x2960 fs/f2fs/node.c:2991 f2fs_write_checkpoint+0x1372/0x6a70 fs/f2fs/checkpoint.c:1640 f2fs_issue_checkpoint+0x149/0x410 fs/f2fs/checkpoint.c:1807 f2fs_sync_fs+0x20f/0x420 fs/f2fs/super.c:1454 __sync_filesystem fs/sync.c:39 [inline] sync_filesystem fs/sync.c:67 [inline] sync_filesystem+0x1b5/0x260 fs/sync.c:48 generic_shutdown_super+0x70/0x370 fs/super.c:448 kill_block_super+0x97/0xf0 fs/super.c:1394 The root cause is, if nat entry in checkpoint journal area is corrupted, e.g. nid of journalled nat entry exceeds max nid value, during checkpoint, once it tries to flush nat journal to NAT area, get_next_nat_page() may access out-of-bounds memory on nat_bitmap due to it uses wrong nid value as bitmap offset. [1] https://lore.kernel.org/lkml/CAFcO6XOMWdr8pObek6eN6-fs58KG9doRFadgJj-FnF-1x43s2g@mail.gmail.com/T/#u Reported-and-tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- fs/f2fs/node.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 7ce33698ae38..48bb5d3c709d 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -2718,6 +2718,9 @@ static void remove_nats_in_journal(struct f2fs_sb_info *sbi) struct f2fs_nat_entry raw_ne; nid_t nid = le32_to_cpu(nid_in_journal(journal, i)); + if (f2fs_check_nid_range(sbi, nid)) + continue; + raw_ne = nat_in_journal(journal, i); ne = __lookup_nat_cache(nm_i, nid); -- 2.30.2 _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next prev parent reply other threads:[~2021-05-12 19:57 UTC|newest] Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-05-12 18:03 [PATCH AUTOSEL 5.4 01/23] ARM: 9058/1: cache-v7: refactor v7_invalidate_l1 to avoid clobbering r5/r6 Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 02/23] PCI: thunder: Fix compile testing Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 03/23] dmaengine: dw-edma: Fix crash on loading/unloading driver Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 04/23] ARM: 9066/1: ftrace: pause/unpause function graph tracer in cpu_suspend() Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` Sasha Levin [this message] 2021-05-12 18:03 ` [f2fs-dev] [PATCH AUTOSEL 5.4 05/23] f2fs: fix to avoid out-of-bounds memory access Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 06/23] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 07/23] Input: elants_i2c - do not bind to i2c-hid compatible ACPI instantiated devices Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 08/23] Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck state Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 09/23] um: Mark all kernel symbols as local Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 10/23] um: Disable CONFIG_GCOV with MODULES Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 11/23] ARM: 9075/1: kernel: Fix interrupted SMC calls Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 12/23] scripts/recordmcount.pl: Fix RISC-V regex for clang Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 13/23] riscv: Workaround mcount name prior to clang-13 Sasha Levin 2021-05-12 18:03 ` Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 14/23] scsi: lpfc: Fix illegal memory access on Abort IOCBs Sasha Levin 2021-05-12 18:03 ` [PATCH AUTOSEL 5.4 15/23] ceph: fix fscache invalidation Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 16/23] scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 17/23] bridge: Fix possible races between assigning rx_handler_data and setting IFF_BRIDGE_PORT bit Sasha Levin 2021-05-12 18:04 ` [Bridge] " Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 18/23] drm/amd/display: Fix two cursor duplication when using overlay Sasha Levin 2021-05-12 18:04 ` Sasha Levin 2021-05-12 18:04 ` Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 19/23] gpiolib: acpi: Add quirk to ignore EC wakeups on Dell Venue 10 Pro 5055 Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 20/23] ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP Sasha Levin 2021-05-12 18:04 ` Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 21/23] block: reexpand iov_iter after read/write Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 22/23] lib: stackdepot: turn depot_lock spinlock to raw_spinlock Sasha Levin 2021-05-12 18:04 ` [PATCH AUTOSEL 5.4 23/23] net: stmmac: Do not enable RX FIFO overflow interrupts Sasha Levin 2021-05-12 18:04 ` Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210512180408.665338-5-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=butterflyhuangxx@gmail.com \ --cc=jaegeuk@kernel.org \ --cc=linux-f2fs-devel@lists.sourceforge.net \ --cc=linux-kernel@vger.kernel.org \ --cc=stable@vger.kernel.org \ --cc=yuchao0@huawei.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.