* [PATCH] ext4: fix use-after-free in ext4_xattr_set_entry
@ 2022-06-02 11:46 Baokun Li
2022-06-14 9:54 ` Jan Kara
0 siblings, 1 reply; 3+ messages in thread
From: Baokun Li @ 2022-06-02 11:46 UTC (permalink / raw)
To: linux-ext4
Cc: tytso, adilger.kernel, jack, ritesh.list, lczerner, linux-kernel,
yi.zhang, yebin10, yukuai3, libaokun1, Hulk Robot
Hulk Robot reported a issue:
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500
Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092
CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17
Call Trace:
[...]
memcpy+0x34/0x50 mm/kasan/kasan.c:303
ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747
ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205
ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386
ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498
__vfs_setxattr+0x112/0x170 fs/xattr.c:149
__vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180
__vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238
vfs_setxattr+0xed/0x270 fs/xattr.c:255
setxattr+0x235/0x330 fs/xattr.c:520
path_setxattr+0x176/0x190 fs/xattr.c:539
__do_sys_lsetxattr fs/xattr.c:561 [inline]
__se_sys_lsetxattr fs/xattr.c:557 [inline]
__x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557
do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x459fe9
RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9
RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140
RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80
[...]
==================================================================
Above issue may happen as follows:
-------------------------------------
ext4_xattr_set
ext4_xattr_set_handle
ext4_xattr_ibody_find
>> s->end < s->base
>> no EXT4_STATE_XATTR
>> xattr_check_inode is not executed
ext4_xattr_ibody_set
ext4_xattr_set_entry
>> size_t min_offs = s->end - s->base
>> UAF in memcpy
we can easily reproduce this problem with the following commands:
mkfs.ext4 -F /dev/sda
mount -o debug_want_extra_isize=128 /dev/sda /mnt
touch /mnt/file
setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file
In ext4_xattr_ibody_find, we have the following assignment logic:
header = IHDR(inode, raw_inode)
= raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize
is->s.base = IFIRST(header)
= header + sizeof(struct ext4_xattr_ibody_header)
is->s.end = raw_inode + s_inode_size
Obviously, when the inode does not have EXT4_status_XATTR and its
i_extra_isize is large, is->s.end may be larger than is->s.base.
In this case, the above issue may be triggered.
EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data
|---------------------------|------------|------|---------|---|--------|
As shown above, when adding an xattr to an inode, we must ensure that the
inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
---
fs/ext4/inline.c | 3 +++
fs/ext4/inode.c | 3 +--
fs/ext4/xattr.c | 6 ++++--
fs/ext4/xattr.h | 6 ++++++
4 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index cff52ff6549d..b8cec7cb4b08 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -35,6 +35,9 @@ static int get_max_inline_xattr_value_size(struct inode *inode,
struct ext4_inode *raw_inode;
int free, min_offs;
+ if (!INODE_HAVE_XATTR_SPACE(inode))
+ return 0;
+
min_offs = EXT4_SB(inode->i_sb)->s_inode_size -
EXT4_GOOD_OLD_INODE_SIZE -
EXT4_I(inode)->i_extra_isize -
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 3dce7d058985..714fa61d0afb 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4685,8 +4685,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
__le32 *magic = (void *)raw_inode +
EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize;
- if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <=
- EXT4_INODE_SIZE(inode->i_sb) &&
+ if (INODE_HAVE_XATTR_SPACE(inode) &&
*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
ext4_set_inode_state(inode, EXT4_STATE_XATTR);
return ext4_find_inline_data_nolock(inode);
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 042325349098..4a63f8386910 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -2176,8 +2176,9 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
struct ext4_inode *raw_inode;
int error;
- if (EXT4_I(inode)->i_extra_isize == 0)
+ if (!INODE_HAVE_XATTR_SPACE(inode))
return 0;
+
raw_inode = ext4_raw_inode(&is->iloc);
header = IHDR(inode, raw_inode);
is->s.base = is->s.first = IFIRST(header);
@@ -2205,8 +2206,9 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
struct ext4_xattr_search *s = &is->s;
int error;
- if (EXT4_I(inode)->i_extra_isize == 0)
+ if (!INODE_HAVE_XATTR_SPACE(inode))
return -ENOSPC;
+
error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */);
if (error)
return error;
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 77efb9a627ad..f2b299b347f9 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -95,6 +95,12 @@ struct ext4_xattr_entry {
#define EXT4_ZERO_XATTR_VALUE ((void *)-1)
+#define INODE_HAVE_XATTR_SPACE(inode) \
+ ((EXT4_I(inode)->i_extra_isize != 0) && \
+ (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \
+ sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \
+ EXT4_INODE_SIZE((inode)->i_sb)))
+
struct ext4_xattr_info {
const char *name;
const void *value;
--
2.31.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] ext4: fix use-after-free in ext4_xattr_set_entry
2022-06-02 11:46 [PATCH] ext4: fix use-after-free in ext4_xattr_set_entry Baokun Li
@ 2022-06-14 9:54 ` Jan Kara
2022-06-14 10:01 ` Baokun Li
0 siblings, 1 reply; 3+ messages in thread
From: Jan Kara @ 2022-06-14 9:54 UTC (permalink / raw)
To: Baokun Li
Cc: linux-ext4, tytso, adilger.kernel, jack, ritesh.list, lczerner,
linux-kernel, yi.zhang, yebin10, yukuai3, Hulk Robot
On Thu 02-06-22 19:46:51, Baokun Li wrote:
> Hulk Robot reported a issue:
> ==================================================================
> BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500
> Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092
>
> CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17
> Call Trace:
> [...]
> memcpy+0x34/0x50 mm/kasan/kasan.c:303
> ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747
> ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205
> ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386
> ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498
> __vfs_setxattr+0x112/0x170 fs/xattr.c:149
> __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180
> __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238
> vfs_setxattr+0xed/0x270 fs/xattr.c:255
> setxattr+0x235/0x330 fs/xattr.c:520
> path_setxattr+0x176/0x190 fs/xattr.c:539
> __do_sys_lsetxattr fs/xattr.c:561 [inline]
> __se_sys_lsetxattr fs/xattr.c:557 [inline]
> __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557
> do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x459fe9
> RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
> RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9
> RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140
> RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000
> R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80
> [...]
> ==================================================================
>
> Above issue may happen as follows:
> -------------------------------------
> ext4_xattr_set
> ext4_xattr_set_handle
> ext4_xattr_ibody_find
> >> s->end < s->base
> >> no EXT4_STATE_XATTR
> >> xattr_check_inode is not executed
> ext4_xattr_ibody_set
> ext4_xattr_set_entry
> >> size_t min_offs = s->end - s->base
> >> UAF in memcpy
>
> we can easily reproduce this problem with the following commands:
> mkfs.ext4 -F /dev/sda
> mount -o debug_want_extra_isize=128 /dev/sda /mnt
> touch /mnt/file
> setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file
>
> In ext4_xattr_ibody_find, we have the following assignment logic:
> header = IHDR(inode, raw_inode)
> = raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize
> is->s.base = IFIRST(header)
> = header + sizeof(struct ext4_xattr_ibody_header)
> is->s.end = raw_inode + s_inode_size
>
> Obviously, when the inode does not have EXT4_status_XATTR and its
> i_extra_isize is large, is->s.end may be larger than is->s.base.
> In this case, the above issue may be triggered.
>
> EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data
> |---------------------------|------------|------|---------|---|--------|
>
> As shown above, when adding an xattr to an inode, we must ensure that the
> inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad.
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Baokun Li <libaokun1@huawei.com>
Thanks for the fix! It looks good to me. Just one small nit:
> +#define INODE_HAVE_XATTR_SPACE(inode) \
> + ((EXT4_I(inode)->i_extra_isize != 0) && \
> + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \
> + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \
> + EXT4_INODE_SIZE((inode)->i_sb)))
> +
We should have ext4 in the name of the above macro so something like:
EXT4_INODE_HAS_XATTR_SPACE()
With that fixed feel free to add:
Reviewed-by: Jan Kara <jack@suse.cz>
Honza
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ext4: fix use-after-free in ext4_xattr_set_entry
2022-06-14 9:54 ` Jan Kara
@ 2022-06-14 10:01 ` Baokun Li
0 siblings, 0 replies; 3+ messages in thread
From: Baokun Li @ 2022-06-14 10:01 UTC (permalink / raw)
To: Jan Kara
Cc: linux-ext4, tytso, adilger.kernel, ritesh.list, lczerner,
linux-kernel, yi.zhang, yebin10, yukuai3, Hulk Robot
在 2022/6/14 17:54, Jan Kara 写道:
> On Thu 02-06-22 19:46:51, Baokun Li wrote:
>> Hulk Robot reported a issue:
>> ==================================================================
>> BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500
>> Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092
>>
>> CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17
>> Call Trace:
>> [...]
>> memcpy+0x34/0x50 mm/kasan/kasan.c:303
>> ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747
>> ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205
>> ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386
>> ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498
>> __vfs_setxattr+0x112/0x170 fs/xattr.c:149
>> __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180
>> __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238
>> vfs_setxattr+0xed/0x270 fs/xattr.c:255
>> setxattr+0x235/0x330 fs/xattr.c:520
>> path_setxattr+0x176/0x190 fs/xattr.c:539
>> __do_sys_lsetxattr fs/xattr.c:561 [inline]
>> __se_sys_lsetxattr fs/xattr.c:557 [inline]
>> __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557
>> do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298
>> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> RIP: 0033:0x459fe9
>> RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
>> RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9
>> RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140
>> RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000
>> R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000
>> R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80
>> [...]
>> ==================================================================
>>
>> Above issue may happen as follows:
>> -------------------------------------
>> ext4_xattr_set
>> ext4_xattr_set_handle
>> ext4_xattr_ibody_find
>> >> s->end < s->base
>> >> no EXT4_STATE_XATTR
>> >> xattr_check_inode is not executed
>> ext4_xattr_ibody_set
>> ext4_xattr_set_entry
>> >> size_t min_offs = s->end - s->base
>> >> UAF in memcpy
>>
>> we can easily reproduce this problem with the following commands:
>> mkfs.ext4 -F /dev/sda
>> mount -o debug_want_extra_isize=128 /dev/sda /mnt
>> touch /mnt/file
>> setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file
>>
>> In ext4_xattr_ibody_find, we have the following assignment logic:
>> header = IHDR(inode, raw_inode)
>> = raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize
>> is->s.base = IFIRST(header)
>> = header + sizeof(struct ext4_xattr_ibody_header)
>> is->s.end = raw_inode + s_inode_size
>>
>> Obviously, when the inode does not have EXT4_status_XATTR and its
>> i_extra_isize is large, is->s.end may be larger than is->s.base.
>> In this case, the above issue may be triggered.
>>
>> EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data
>> |---------------------------|------------|------|---------|---|--------|
>>
>> As shown above, when adding an xattr to an inode, we must ensure that the
>> inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad.
>>
>> Reported-by: Hulk Robot <hulkci@huawei.com>
>> Signed-off-by: Baokun Li <libaokun1@huawei.com>
> Thanks for the fix! It looks good to me. Just one small nit:
>
>> +#define INODE_HAVE_XATTR_SPACE(inode) \
>> + ((EXT4_I(inode)->i_extra_isize != 0) && \
>> + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \
>> + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \
>> + EXT4_INODE_SIZE((inode)->i_sb)))
>> +
> We should have ext4 in the name of the above macro so something like:
>
> EXT4_INODE_HAS_XATTR_SPACE()
>
> With that fixed feel free to add:
>
> Reviewed-by: Jan Kara <jack@suse.cz>
>
> Honza
Thank you for your review!
I will send a patch V2 with the changes suggested by you. Thanks again!
--
With Best Regards,
Baokun Li
.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-06-14 10:02 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-02 11:46 [PATCH] ext4: fix use-after-free in ext4_xattr_set_entry Baokun Li
2022-06-14 9:54 ` Jan Kara
2022-06-14 10:01 ` Baokun Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).