* Re: Cramfs: "unable to handle kernel paging request" when reading a file from a fuzzed FS image [not found] <CAE5jQCdhWVVqf8en9S-3mbDBwuxk481S+hi-uvQSw6Gf6jKujQ@mail.gmail.com> @ 2018-10-29 3:43 ` Nicolas Pitre 2018-10-29 7:13 ` Anatoly Trosinenko 0 siblings, 1 reply; 4+ messages in thread From: Nicolas Pitre @ 2018-10-29 3:43 UTC (permalink / raw) To: Anatoly Trosinenko; +Cc: linux-kernel On Sun, 28 Oct 2018, Anatoly Trosinenko wrote: > Hello, > > When reading a file from a fuzzed cramfs image, unhandled kernel > paging request occurs. Hmmm... It doesn't show up on my test system. > How to reproduce with kvm-xfstests: > 1) Checkout the v4.19 tag, copy x86_64-config-4.14 to .config, perform > `make olddefconfig` > 2) Enable Cramfs in the config, then compile > 3) In the `kvm-xfstests shell` perform: > > root@kvm-xfstests:~# mount /vtmp > root@kvm-xfstests:~# mount /vtmp/cramfs.img /mnt How do I populate /vtmp? Mine is empty at this point. I imagine I should put the cramfs image somewhere on the host, but I'm not that familiar withkvm. Nicolas ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Cramfs: "unable to handle kernel paging request" when reading a file from a fuzzed FS image 2018-10-29 3:43 ` Cramfs: "unable to handle kernel paging request" when reading a file from a fuzzed FS image Nicolas Pitre @ 2018-10-29 7:13 ` Anatoly Trosinenko 2018-10-29 16:03 ` Nicolas Pitre 0 siblings, 1 reply; 4+ messages in thread From: Anatoly Trosinenko @ 2018-10-29 7:13 UTC (permalink / raw) To: nicolas.pitre; +Cc: linux-kernel > How do I populate /vtmp? Mine is empty at this point. I imagine I should put the cramfs image somewhere on the host, but I'm not that familiar withkvm. Oops, forgot to say, it is the /tmp/kvm-xfstests-$USER directory on the host (it will be created when you first launch kvm-xfstests and it is "live", i.e. like NFS, not like "pack to ext4 image then boot and mount"). > Hmmm... It doesn't show up on my test system. Mounted it on my host Ubuntu 18.10 amd64, executed `cat /mnt/xyz` and it was "Killed". Maybe it is something freshly added or arch-dependent... # uname -a Linux trosinenko-pc 4.18.0-10-generic #11-Ubuntu SMP Thu Oct 11 15:13:55 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux Best regards Anatoly пн, 29 окт. 2018 г. в 6:43, Nicolas Pitre <nicolas.pitre@linaro.org>: > > On Sun, 28 Oct 2018, Anatoly Trosinenko wrote: > > > Hello, > > > > When reading a file from a fuzzed cramfs image, unhandled kernel > > paging request occurs. > > Hmmm... It doesn't show up on my test system. > > > How to reproduce with kvm-xfstests: > > 1) Checkout the v4.19 tag, copy x86_64-config-4.14 to .config, perform > > `make olddefconfig` > > 2) Enable Cramfs in the config, then compile > > 3) In the `kvm-xfstests shell` perform: > > > > root@kvm-xfstests:~# mount /vtmp > > root@kvm-xfstests:~# mount /vtmp/cramfs.img /mnt > > How do I populate /vtmp? Mine is empty at this point. I imagine I should > put the cramfs image somewhere on the host, but I'm not that familiar > withkvm. > > > Nicolas ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Cramfs: "unable to handle kernel paging request" when reading a file from a fuzzed FS image 2018-10-29 7:13 ` Anatoly Trosinenko @ 2018-10-29 16:03 ` Nicolas Pitre 2018-10-31 13:06 ` Anatoly Trosinenko 0 siblings, 1 reply; 4+ messages in thread From: Nicolas Pitre @ 2018-10-29 16:03 UTC (permalink / raw) To: Anatoly Trosinenko; +Cc: linux-kernel On Mon, 29 Oct 2018, Anatoly Trosinenko wrote: > > How do I populate /vtmp? Mine is empty at this point. I imagine I > > should put the cramfs image somewhere on the host, but I'm not that > > familiar withkvm. > > Oops, forgot to say, it is the /tmp/kvm-xfstests-$USER directory on > the host (it will be created when you first launch kvm-xfstests and it > is "live", i.e. like NFS, not like "pack to ext4 image then boot and > mount"). OK, I reproduced it. The fix is as follows: diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c index f408994fc6..6e000392e4 100644 --- a/fs/cramfs/inode.c +++ b/fs/cramfs/inode.c @@ -202,7 +202,8 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset, continue; blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_SHIFT; blk_offset += offset; - if (blk_offset + len > BUFFER_SIZE) + if (blk_offset > BUFFER_SIZE || + blk_offset + len > BUFFER_SIZE) continue; return read_buffers[i] + blk_offset; } User space will get a bunch of zeroes rather than an explicit error in this case. There is just so many ways to corrupt a cramfs image without detecting it afterwards that I don't think it is worth doing more than making sure the system won't be compromized. > > Hmmm... It doesn't show up on my test system. > > Mounted it on my host Ubuntu 18.10 amd64, executed `cat /mnt/xyz` and > it was "Killed". Maybe it is something freshly added or > arch-dependent... It actually depends on whether there is something mapped immediately next to the cramfs cache buffer. In any case, this is a nice catch. Thank you for reporting it. Nicolas ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: Cramfs: "unable to handle kernel paging request" when reading a file from a fuzzed FS image 2018-10-29 16:03 ` Nicolas Pitre @ 2018-10-31 13:06 ` Anatoly Trosinenko 0 siblings, 0 replies; 4+ messages in thread From: Anatoly Trosinenko @ 2018-10-31 13:06 UTC (permalink / raw) To: Nicolas Pitre; +Cc: linux-kernel Tested in fresh torvalds/master branch. Thank you! Best regards Anatoly пн, 29 окт. 2018 г. в 19:03, Nicolas Pitre <nicolas.pitre@linaro.org>: > > On Mon, 29 Oct 2018, Anatoly Trosinenko wrote: > > > > How do I populate /vtmp? Mine is empty at this point. I imagine I > > > should put the cramfs image somewhere on the host, but I'm not that > > > familiar withkvm. > > > > Oops, forgot to say, it is the /tmp/kvm-xfstests-$USER directory on > > the host (it will be created when you first launch kvm-xfstests and it > > is "live", i.e. like NFS, not like "pack to ext4 image then boot and > > mount"). > > OK, I reproduced it. The fix is as follows: > > diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c > index f408994fc6..6e000392e4 100644 > --- a/fs/cramfs/inode.c > +++ b/fs/cramfs/inode.c > @@ -202,7 +202,8 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset, > continue; > blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_SHIFT; > blk_offset += offset; > - if (blk_offset + len > BUFFER_SIZE) > + if (blk_offset > BUFFER_SIZE || > + blk_offset + len > BUFFER_SIZE) > continue; > return read_buffers[i] + blk_offset; > } > > User space will get a bunch of zeroes rather than an explicit error in > this case. There is just so many ways to corrupt a cramfs image without > detecting it afterwards that I don't think it is worth doing more than > making sure the system won't be compromized. > > > > Hmmm... It doesn't show up on my test system. > > > > Mounted it on my host Ubuntu 18.10 amd64, executed `cat /mnt/xyz` and > > it was "Killed". Maybe it is something freshly added or > > arch-dependent... > > It actually depends on whether there is something mapped immediately > next to the cramfs cache buffer. > > In any case, this is a nice catch. Thank you for reporting it. > > > Nicolas ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-10-31 13:07 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CAE5jQCdhWVVqf8en9S-3mbDBwuxk481S+hi-uvQSw6Gf6jKujQ@mail.gmail.com>
2018-10-29 3:43 ` Cramfs: "unable to handle kernel paging request" when reading a file from a fuzzed FS image Nicolas Pitre
2018-10-29 7:13 ` Anatoly Trosinenko
2018-10-29 16:03 ` Nicolas Pitre
2018-10-31 13:06 ` Anatoly Trosinenko
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).