From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zhe Li <lizhe67@huawei.com>, Hou Tao <houtao1@huawei.com>,
Richard Weinberger <richard@nod.at>,
Sasha Levin <sashal@kernel.org>,
linux-mtd@lists.infradead.org
Subject: [PATCH AUTOSEL 5.8 16/27] jffs2: fix UAF problem
Date: Wed, 19 Aug 2020 20:01:05 -0400 [thread overview]
Message-ID: <20200820000116.214821-16-sashal@kernel.org> (raw)
In-Reply-To: <20200820000116.214821-1-sashal@kernel.org>
From: Zhe Li <lizhe67@huawei.com>
[ Upstream commit 798b7347e4f29553db4b996393caf12f5b233daf ]
The log of UAF problem is listed below.
BUG: KASAN: use-after-free in jffs2_rmdir+0xa4/0x1cc [jffs2] at addr c1f165fc
Read of size 4 by task rm/8283
=============================================================================
BUG kmalloc-32 (Tainted: P B O ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in 0xbbbbbbbb age=3054364 cpu=0 pid=0
0xb0bba6ef
jffs2_write_dirent+0x11c/0x9c8 [jffs2]
__slab_alloc.isra.21.constprop.25+0x2c/0x44
__kmalloc+0x1dc/0x370
jffs2_write_dirent+0x11c/0x9c8 [jffs2]
jffs2_do_unlink+0x328/0x5fc [jffs2]
jffs2_rmdir+0x110/0x1cc [jffs2]
vfs_rmdir+0x180/0x268
do_rmdir+0x2cc/0x300
ret_from_syscall+0x0/0x3c
INFO: Freed in 0x205b age=3054364 cpu=0 pid=0
0x2e9173
jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
jffs2_garbage_collect_dirent.isra.3+0x21c/0x288 [jffs2]
jffs2_garbage_collect_live+0x16bc/0x1800 [jffs2]
jffs2_garbage_collect_pass+0x678/0x11d4 [jffs2]
jffs2_garbage_collect_thread+0x1e8/0x3b0 [jffs2]
kthread+0x1a8/0x1b0
ret_from_kernel_thread+0x5c/0x64
Call Trace:
[c17ddd20] [c02452d4] kasan_report.part.0+0x298/0x72c (unreliable)
[c17ddda0] [d2509680] jffs2_rmdir+0xa4/0x1cc [jffs2]
[c17dddd0] [c026da04] vfs_rmdir+0x180/0x268
[c17dde00] [c026f4e4] do_rmdir+0x2cc/0x300
[c17ddf40] [c001a658] ret_from_syscall+0x0/0x3c
The root cause is that we don't get "jffs2_inode_info.sem" before
we scan list "jffs2_inode_info.dents" in function jffs2_rmdir.
This patch add codes to get "jffs2_inode_info.sem" before we scan
"jffs2_inode_info.dents" to slove the UAF problem.
Signed-off-by: Zhe Li <lizhe67@huawei.com>
Reviewed-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jffs2/dir.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index f20cff1194bb6..776493713153f 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -590,10 +590,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
int ret;
uint32_t now = JFFS2_NOW();
+ mutex_lock(&f->sem);
for (fd = f->dents ; fd; fd = fd->next) {
- if (fd->ino)
+ if (fd->ino) {
+ mutex_unlock(&f->sem);
return -ENOTEMPTY;
+ }
}
+ mutex_unlock(&f->sem);
ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name,
dentry->d_name.len, f, now);
--
2.25.1
next prev parent reply other threads:[~2020-08-20 0:13 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-20 0:00 [PATCH AUTOSEL 5.8 01/27] scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 02/27] scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 03/27] media: budget-core: Improve exception handling in budget_register() Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 04/27] media: coda: jpeg: add NULL check after kmalloc Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 05/27] f2fs: fix to check page dirty status before writeback Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 06/27] rtc: goldfish: Enable interrupt in set_alarm() when necessary Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 07/27] media: vpss: clean up resources in init Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 08/27] f2fs: should avoid inode eviction in synchronous path Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 09/27] Input: psmouse - add a newline when printing 'proto' by sysfs Sasha Levin
2020-08-20 0:00 ` [PATCH AUTOSEL 5.8 10/27] MIPS: Fix unable to reserve memory for Crash kernel Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 11/27] m68knommu: fix overwriting of bits in ColdFire V3 cache control Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 12/27] svcrdma: Fix another Receive buffer leak Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 13/27] xfs: fix inode quota reservation checks Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 14/27] drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 15/27] riscv: Fixup static_obj() fail Sasha Levin
2020-08-20 0:01 ` Sasha Levin [this message]
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 17/27] ceph: fix use-after-free for fsc->mdsc Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 18/27] swiotlb-xen: use vmalloc_to_page on vmalloc virt addresses Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 19/27] cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 20/27] scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 21/27] virtio_ring: Avoid loop when vq is broken in virtqueue_poll Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 22/27] media: camss: fix memory leaks on error handling paths in probe Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 23/27] tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 24/27] xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 25/27] alpha: fix annotation of io{read,write}{16,32}be() Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 26/27] fat: fix fat_ra_init() for data clusters == 0 Sasha Levin
2020-08-20 0:01 ` [PATCH AUTOSEL 5.8 27/27] fs/signalfd.c: fix inconsistent return codes for signalfd4 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200820000116.214821-16-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=houtao1@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=lizhe67@huawei.com \
--cc=richard@nod.at \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).