From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Hawkins Jiawei <yin31149@gmail.com>,
syzbot+8d6fbb27a6aded64b25b@syzkaller.appspotmail.com,
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>,
Sasha Levin <sashal@kernel.org>,
ntfs3@lists.linux.dev
Subject: [PATCH AUTOSEL 6.1 10/28] fs/ntfs3: Fix slab-out-of-bounds read in run_unpack
Date: Tue, 27 Dec 2022 15:32:31 -0500 [thread overview]
Message-ID: <20221227203249.1213526-10-sashal@kernel.org> (raw)
In-Reply-To: <20221227203249.1213526-1-sashal@kernel.org>
From: Hawkins Jiawei <yin31149@gmail.com>
[ Upstream commit 887bfc546097fbe8071dac13b2fef73b77920899 ]
Syzkaller reports slab-out-of-bounds bug as follows:
==================================================================
BUG: KASAN: slab-out-of-bounds in run_unpack+0x8b7/0x970 fs/ntfs3/run.c:944
Read of size 1 at addr ffff88801bbdff02 by task syz-executor131/3611
[...]
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
run_unpack+0x8b7/0x970 fs/ntfs3/run.c:944
run_unpack_ex+0xb0/0x7c0 fs/ntfs3/run.c:1057
ntfs_read_mft fs/ntfs3/inode.c:368 [inline]
ntfs_iget5+0xc20/0x3280 fs/ntfs3/inode.c:501
ntfs_loadlog_and_replay+0x124/0x5d0 fs/ntfs3/fsntfs.c:272
ntfs_fill_super+0x1eff/0x37f0 fs/ntfs3/super.c:1018
get_tree_bdev+0x440/0x760 fs/super.c:1323
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]
</TASK>
The buggy address belongs to the physical page:
page:ffffea00006ef600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bbd8
head:ffffea00006ef600 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88801bbdfe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801bbdfe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801bbdff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88801bbdff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88801bbe0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Kernel will tries to read record and parse MFT from disk in
ntfs_read_mft().
Yet the problem is that during enumerating attributes in record,
kernel doesn't check whether run_off field loading from the disk
is a valid value.
To be more specific, if attr->nres.run_off is larger than attr->size,
kernel will passes an invalid argument run_buf_size in
run_unpack_ex(), which having an integer overflow. Then this invalid
argument will triggers the slab-out-of-bounds Read bug as above.
This patch solves it by adding the sanity check between
the offset to packed runs and attribute size.
link: https://lore.kernel.org/all/0000000000009145fc05e94bd5c3@google.com/#t
Reported-and-tested-by: syzbot+8d6fbb27a6aded64b25b@syzkaller.appspotmail.com
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ntfs3/inode.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index c18bedaf228d..d98d047c778c 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -373,6 +373,13 @@ static struct inode *ntfs_read_mft(struct inode *inode,
}
t64 = le64_to_cpu(attr->nres.svcn);
+
+ /* offset to packed runs is out-of-bounds */
+ if (roff > asize) {
+ err = -EINVAL;
+ goto out;
+ }
+
err = run_unpack_ex(run, sbi, ino, t64, le64_to_cpu(attr->nres.evcn),
t64, Add2Ptr(attr, roff), asize - roff);
if (err < 0)
--
2.35.1
next prev parent reply other threads:[~2022-12-27 20:33 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-27 20:32 [PATCH AUTOSEL 6.1 01/28] fs/ntfs3: Validate BOOT record_size Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 02/28] fs/ntfs3: Add overflow check for attribute size Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 03/28] fs/ntfs3: Validate data run offset Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 04/28] fs/ntfs3: Add null pointer check to attr_load_runs_vcn Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 05/28] fs/ntfs3: Fix memory leak on ntfs_fill_super() error path Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 06/28] fs/ntfs3: Add null pointer check for inode operations Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 07/28] fs/ntfs3: Validate attribute name offset Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 08/28] fs/ntfs3: Validate buffer length while parsing index Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 09/28] fs/ntfs3: Validate resident attribute name Sasha Levin
2022-12-27 20:32 ` Sasha Levin [this message]
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 14/28] fs/ntfs3: Validate index root when initialize NTFS security Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 15/28] fs/ntfs3: Use __GFP_NOWARN allocation at wnd_init() Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 16/28] fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_fill_super() Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 17/28] fs/ntfs3: Delete duplicate condition in ntfs_read_mft() Sasha Levin
2022-12-27 20:32 ` [PATCH AUTOSEL 6.1 18/28] fs/ntfs3: Fix slab-out-of-bounds in r_page Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221227203249.1213526-10-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=linux-kernel@vger.kernel.org \
--cc=ntfs3@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=syzbot+8d6fbb27a6aded64b25b@syzkaller.appspotmail.com \
--cc=yin31149@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).