* Re: [PATCH 2/2] e2fsck: fix use after free in calculate_tree()
2019-11-26 9:03 ` [PATCH 2/2] e2fsck: fix use after free in calculate_tree() Wang Shilong
@ 2019-12-30 11:38 ` Wang Shilong
2019-12-30 17:06 ` Theodore Y. Ts'o
2019-12-31 0:57 ` Theodore Y. Ts'o
2 siblings, 0 replies; 7+ messages in thread
From: Wang Shilong @ 2019-12-30 11:38 UTC (permalink / raw)
To: Ext4 Developers List; +Cc: Andreas Dilger, Li Xi, Wang Shilong
Ping...
On Tue, Nov 26, 2019 at 5:04 PM Wang Shilong <wangshilong1991@gmail.com> wrote:
>
> From: Wang Shilong <wshilong@ddn.com>
>
> Hit following Seg errors randomly when running f_large_dir test:
>
> +Signal (11) SIGSEGV si_code=SEGV_MAPERR fault addr=0x7f02cfffbc1a
> +../e2fsck/e2fsck[0x43766e]
> +/lib64/libpthread.so.0(+0xf7e0)[0x7f02d8c9a7e0]
> +../e2fsck/e2fsck(e2fsck_rehash_dir+0x10f3)[0x436173]
> +../e2fsck/e2fsck(e2fsck_rehash_directories+0xf4)[0x4362d4]
> +../e2fsck/e2fsck(e2fsck_pass3+0x722)[0x4292c2]
> +../e2fsck/e2fsck(e2fsck_run+0x47)[0x414ef7]
> +../e2fsck/e2fsck(main+0x1c1d)[0x41319d]
> +/lib64/libc.so.6(__libc_start_main+0x100)[0x7f02d8915d20]
> +../e2fsck/e2fsck[0x40fc59]
> +Exit status is 8
>
> gdb output is:
> 0x436173 is in e2fsck_rehash_dir (rehash.c:752).
> warning: Source file is more recent than executable.
> 747 dx_ent->hash =
> 748 ext2fs_cpu_to_le32(outdir->hashes[i]);
> 749 dx_ent++;
> 750 c3--;
> 751 }
> 752 int_limit->count = ext2fs_cpu_to_le16(limit->limit - c2);
> 753 int_limit->limit = ext2fs_cpu_to_le16(limit->limit);
> 754
> 755 limit->count = ext2fs_cpu_to_le16(limit->limit - c3);
> 756 limit->limit = ext2fs_cpu_to_le16(limit->limit);
>
> The problem is alloc_blocks() will call get_next_block()
> which might reallocate @outdir->buf, and memory address
> could be changed after this. @int_limit and @root should
> be recalculated based on new start address. Otherwise,
> it will try to access freed memory and cause SEGV_MAPERR
> errors.
>
> Signed-off-by: Wang Shilong <wshilong@ddn.com>
> ---
> e2fsck/rehash.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
> index 5250652e..0eb99328 100644
> --- a/e2fsck/rehash.c
> +++ b/e2fsck/rehash.c
> @@ -636,6 +636,9 @@ static int alloc_blocks(ext2_filsys fs,
> if (retval)
> return retval;
>
> + /* outdir->buf might be reallocated */
> + *prev_ent = (struct ext2_dx_entry *) (outdir->buf + *prev_offset);
> +
> *next_ent = set_int_node(fs, block_start);
> *limit = (struct ext2_dx_countlimit *)(*next_ent);
> if (next_offset)
> @@ -725,12 +728,18 @@ static errcode_t calculate_tree(ext2_filsys fs,
> return retval;
> }
> if (c3 == 0) {
> + int delta1 = int_offset;;
> + int delta2 = (char *)root - outdir->buf;
> +
> retval = alloc_blocks(fs, &limit, &int_ent,
> &dx_ent, &int_offset,
> NULL, outdir, i, &c2,
> &c3);
> if (retval)
> return retval;
> + /* outdir->buf might be reallocated */
> + int_limit = (struct ext2_dx_countlimit *)(outdir->buf + delta1);
> + root = (struct ext2_dx_entry *)(outdir->buf + delta2);
>
> }
> dx_ent->block = ext2fs_cpu_to_le32(i);
> --
> 2.21.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 2/2] e2fsck: fix use after free in calculate_tree()
2019-11-26 9:03 ` [PATCH 2/2] e2fsck: fix use after free in calculate_tree() Wang Shilong
2019-12-30 11:38 ` Wang Shilong
@ 2019-12-30 17:06 ` Theodore Y. Ts'o
2019-12-31 0:57 ` Theodore Y. Ts'o
2 siblings, 0 replies; 7+ messages in thread
From: Theodore Y. Ts'o @ 2019-12-30 17:06 UTC (permalink / raw)
To: Wang Shilong; +Cc: linux-ext4, adilger, lixi, wshilong
On Tue, Nov 26, 2019 at 06:03:59PM +0900, Wang Shilong wrote:
> @@ -725,12 +728,18 @@ static errcode_t calculate_tree(ext2_filsys fs,
> return retval;
> }
> if (c3 == 0) {
> + int delta1 = int_offset;;
> + int delta2 = (char *)root - outdir->buf;
> +
> retval = alloc_blocks(fs, &limit, &int_ent,
> &dx_ent, &int_offset,
> NULL, outdir, i, &c2,
> &c3);
> if (retval)
> return retval;
> + /* outdir->buf might be reallocated */
> + int_limit = (struct ext2_dx_countlimit *)(outdir->buf + delta1);
> + root = (struct ext2_dx_entry *)(outdir->buf + delta2);
>
> }
> dx_ent->block = ext2fs_cpu_to_le32(i);
Um, are you sure
int delta1 = int_offset;;
is correct? I would think
int delta1 = (char *)int_limit - outdir->buf;
is what is needed; it's certainly much more clear.
- Ted
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 2/2] e2fsck: fix use after free in calculate_tree()
2019-11-26 9:03 ` [PATCH 2/2] e2fsck: fix use after free in calculate_tree() Wang Shilong
2019-12-30 11:38 ` Wang Shilong
2019-12-30 17:06 ` Theodore Y. Ts'o
@ 2019-12-31 0:57 ` Theodore Y. Ts'o
2019-12-31 1:41 ` Wang Shilong
2 siblings, 1 reply; 7+ messages in thread
From: Theodore Y. Ts'o @ 2019-12-31 0:57 UTC (permalink / raw)
To: Wang Shilong; +Cc: linux-ext4, adilger, lixi, wshilong
Here is the version which I plan to use in e2fsprogs's maint branch.
- Ted
commit aacc234471a9a0ab6d8d6f610a0e4996e9bfc785
Author: Wang Shilong <wshilong@ddn.com>
Date: Mon Dec 30 19:52:39 2019 -0500
e2fsck: fix use after free in calculate_tree()
The problem is alloc_blocks() will call get_next_block() which might
reallocate outdir->buf, and memory address could be changed after
this. To fix this, pointers that point into outdir->buf, such as
int_limit and root need to be recaulated based on the new starting
address of outdir->buf.
[ Changed to correctly recalculate int_limit, and to optimize how we
reallocate outdir->buf. -TYT ]
Signed-off-by: Wang Shilong <wshilong@ddn.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
index 392cfe9f..54bc6803 100644
--- a/e2fsck/rehash.c
+++ b/e2fsck/rehash.c
@@ -301,7 +301,11 @@ static errcode_t get_next_block(ext2_filsys fs, struct out_dir *outdir,
errcode_t retval;
if (outdir->num >= outdir->max) {
- retval = alloc_size_dir(fs, outdir, outdir->max + 50);
+ int increment = outdir->max / 10;
+
+ if (increment < 50)
+ increment = 50;
+ retval = alloc_size_dir(fs, outdir, outdir->max + increment);
if (retval)
return retval;
}
@@ -645,6 +649,9 @@ static int alloc_blocks(ext2_filsys fs,
if (retval)
return retval;
+ /* outdir->buf might be reallocated */
+ *prev_ent = (struct ext2_dx_entry *) (outdir->buf + *prev_offset);
+
*next_ent = set_int_node(fs, block_start);
*limit = (struct ext2_dx_countlimit *)(*next_ent);
if (next_offset)
@@ -734,6 +741,9 @@ static errcode_t calculate_tree(ext2_filsys fs,
return retval;
}
if (c3 == 0) {
+ int delta1 = (char *)int_limit - outdir->buf;
+ int delta2 = (char *)root - outdir->buf;
+
retval = alloc_blocks(fs, &limit, &int_ent,
&dx_ent, &int_offset,
NULL, outdir, i, &c2,
@@ -741,6 +751,11 @@ static errcode_t calculate_tree(ext2_filsys fs,
if (retval)
return retval;
+ /* outdir->buf might be reallocated */
+ int_limit = (struct ext2_dx_countlimit *)
+ (outdir->buf + delta1);
+ root = (struct ext2_dx_entry *)
+ (outdir->buf + delta2);
}
dx_ent->block = ext2fs_cpu_to_le32(i);
if (c3 != limit->limit)
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH 2/2] e2fsck: fix use after free in calculate_tree()
2019-12-31 0:57 ` Theodore Y. Ts'o
@ 2019-12-31 1:41 ` Wang Shilong
0 siblings, 0 replies; 7+ messages in thread
From: Wang Shilong @ 2019-12-31 1:41 UTC (permalink / raw)
To: Theodore Y. Ts'o
Cc: Ext4 Developers List, Andreas Dilger, Li Xi, Wang Shilong
Looks good to me, thanks for refresh the patch!
On Tue, Dec 31, 2019 at 8:57 AM Theodore Y. Ts'o <tytso@mit.edu> wrote:
>
> Here is the version which I plan to use in e2fsprogs's maint branch.
>
> - Ted
>
> commit aacc234471a9a0ab6d8d6f610a0e4996e9bfc785
> Author: Wang Shilong <wshilong@ddn.com>
> Date: Mon Dec 30 19:52:39 2019 -0500
>
> e2fsck: fix use after free in calculate_tree()
>
> The problem is alloc_blocks() will call get_next_block() which might
> reallocate outdir->buf, and memory address could be changed after
> this. To fix this, pointers that point into outdir->buf, such as
> int_limit and root need to be recaulated based on the new starting
> address of outdir->buf.
>
> [ Changed to correctly recalculate int_limit, and to optimize how we
> reallocate outdir->buf. -TYT ]
>
> Signed-off-by: Wang Shilong <wshilong@ddn.com>
> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
>
> diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
> index 392cfe9f..54bc6803 100644
> --- a/e2fsck/rehash.c
> +++ b/e2fsck/rehash.c
> @@ -301,7 +301,11 @@ static errcode_t get_next_block(ext2_filsys fs, struct out_dir *outdir,
> errcode_t retval;
>
> if (outdir->num >= outdir->max) {
> - retval = alloc_size_dir(fs, outdir, outdir->max + 50);
> + int increment = outdir->max / 10;
> +
> + if (increment < 50)
> + increment = 50;
> + retval = alloc_size_dir(fs, outdir, outdir->max + increment);
> if (retval)
> return retval;
> }
> @@ -645,6 +649,9 @@ static int alloc_blocks(ext2_filsys fs,
> if (retval)
> return retval;
>
> + /* outdir->buf might be reallocated */
> + *prev_ent = (struct ext2_dx_entry *) (outdir->buf + *prev_offset);
> +
> *next_ent = set_int_node(fs, block_start);
> *limit = (struct ext2_dx_countlimit *)(*next_ent);
> if (next_offset)
> @@ -734,6 +741,9 @@ static errcode_t calculate_tree(ext2_filsys fs,
> return retval;
> }
> if (c3 == 0) {
> + int delta1 = (char *)int_limit - outdir->buf;
> + int delta2 = (char *)root - outdir->buf;
> +
> retval = alloc_blocks(fs, &limit, &int_ent,
> &dx_ent, &int_offset,
> NULL, outdir, i, &c2,
> @@ -741,6 +751,11 @@ static errcode_t calculate_tree(ext2_filsys fs,
> if (retval)
> return retval;
>
> + /* outdir->buf might be reallocated */
> + int_limit = (struct ext2_dx_countlimit *)
> + (outdir->buf + delta1);
> + root = (struct ext2_dx_entry *)
> + (outdir->buf + delta2);
> }
> dx_ent->block = ext2fs_cpu_to_le32(i);
> if (c3 != limit->limit)
>
^ permalink raw reply [flat|nested] 7+ messages in thread