android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5a62248c58
android_kernel_asus_sm8350/fs
History
Baokun Li 5a62248c58 ext4: fix use-after-free in ext4_xattr_set_entry 
[ Upstream commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 ]

Hulk Robot reported a issue:
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500
Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092

CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17
Call Trace:
[...]
 memcpy+0x34/0x50 mm/kasan/kasan.c:303
 ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747
 ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205
 ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386
 ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498
 __vfs_setxattr+0x112/0x170 fs/xattr.c:149
 __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180
 __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238
 vfs_setxattr+0xed/0x270 fs/xattr.c:255
 setxattr+0x235/0x330 fs/xattr.c:520
 path_setxattr+0x176/0x190 fs/xattr.c:539
 __do_sys_lsetxattr fs/xattr.c:561 [inline]
 __se_sys_lsetxattr fs/xattr.c:557 [inline]
 __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557
 do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x459fe9
RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd
RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9
RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140
RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80
[...]
==================================================================

Above issue may happen as follows:
-------------------------------------
ext4_xattr_set
  ext4_xattr_set_handle
    ext4_xattr_ibody_find
      >> s->end < s->base
      >> no EXT4_STATE_XATTR
      >> xattr_check_inode is not executed
    ext4_xattr_ibody_set
      ext4_xattr_set_entry
       >> size_t min_offs = s->end - s->base
       >> UAF in memcpy

we can easily reproduce this problem with the following commands:
    mkfs.ext4 -F /dev/sda
    mount -o debug_want_extra_isize=128 /dev/sda /mnt
    touch /mnt/file
    setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file

In ext4_xattr_ibody_find, we have the following assignment logic:
  header = IHDR(inode, raw_inode)
         = raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize
  is->s.base = IFIRST(header)
             = header + sizeof(struct ext4_xattr_ibody_header)
  is->s.end = raw_inode + s_inode_size

In ext4_xattr_set_entry
  min_offs = s->end - s->base
           = s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
	     sizeof(struct ext4_xattr_ibody_header)
  last = s->first
  free = min_offs - ((void *)last - s->base) - sizeof(__u32)
       = s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
         sizeof(struct ext4_xattr_ibody_header) - sizeof(__u32)

In the calculation formula, all values except s_inode_size and
i_extra_size are fixed values. When i_extra_size is the maximum value
s_inode_size - EXT4_GOOD_OLD_INODE_SIZE, min_offs is -4 and free is -8.
The value overflows. As a result, the preceding issue is triggered when
memcpy is executed.

Therefore, when finding xattr or setting xattr, check whether
there is space for storing xattr in the inode to resolve this issue.

Cc: stable@kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220616021358.2504451-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-26 11:24:05 +02:00
..
9p 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" 2022-06-22 14:11:02 +02:00
adfs Merge branch 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 11:33:22 -07:00
affs affs: initialize fsdata in affs_truncate() 2023-02-06 07:52:36 +01:00
afs afs: Fix fileserver probe RTT handling 2022-12-08 11:23:03 +01:00
autofs autofs: fix a leak in autofs_expire_indirect() 2019-10-25 00:03:11 -04:00
befs fs: Fill in max and min timestamps in superblock 2019-08-30 07:27:17 -07:00
bfs bfs: don't use WARNING: string when it's just info. 2021-01-06 14:48:39 +01:00
btrfs btrfs: fix fast csum implementation detection 2023-04-20 12:07:35 +02:00
cachefiles cachefiles: Handle readpage error correctly 2020-11-05 11:43:36 +01:00
ceph ceph: flush cap releases when the session is flushed 2023-02-22 12:50:33 +01:00
cifs smb3: fix problem with null cifs super block with previous patch 2023-04-20 12:07:32 +02:00
coda coda: Avoid partial allocation of sig_inputArgs 2023-03-11 16:43:56 +01:00
configfs configfs: fix possible memory leak in configfs_create_dir() 2023-01-18 11:41:09 +01:00
cramfs cramfs: fix usage on non-MTD device 2019-11-23 21:44:49 -05:00
crypto fscrypt: add fscrypt_symlink_getattr() for computing st_size 2021-09-12 08:56:38 +02:00
debugfs debugfs: fix error when writing negative value to atomic_t debugfs file 2023-01-18 11:40:56 +01:00
devpts fsnotify: fix fsnotify hooks in pseudo filesystems 2022-02-01 17:24:34 +01:00
dlm fs: dlm: handle -EBUSY first in lock arg validation 2022-10-26 13:22:14 +02:00
ecryptfs Revert "ecryptfs: replace BUG_ON with error handling code" 2021-05-26 12:05:19 +02:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2020-12-02 08:49:53 +01:00
efs fs: Fill in max and min timestamps in superblock 2019-08-30 07:27:17 -07:00
erofs erofs: avoid consecutive detection for Highmem memory 2022-08-25 11:17:36 +02:00
exportfs exportfs_decode_fh(): negative pinned may become positive without the parent locked 2019-11-10 11:56:05 -05:00
ext2 ext2: Add more validity checks for inode counts 2022-08-25 11:17:28 +02:00
ext4 ext4: fix use-after-free in ext4_xattr_set_entry 2023-04-26 11:24:05 +02:00
f2fs fs: f2fs: initialize fsdata in pagecache_write() 2023-03-11 16:44:08 +01:00
fat fat: add ratelimit to fat*_ent_bread() 2022-06-14 18:11:30 +02:00
freevxfs fs: Fill in max and min timestamps in superblock 2019-08-30 07:27:17 -07:00
fscache fscache: Fix cookie key hashing 2021-09-22 12:26:25 +02:00
fuse fuse: lock inode unconditionally in fuse_fallocate() 2022-12-08 11:23:01 +01:00
gfs2 gfs2: Always check inode size of inline inodes 2023-04-05 11:16:46 +02:00
hfs hfs: fix missing hfs_bnode_get() in __hfs_bnode_create 2023-03-11 16:43:59 +01:00
hfsplus fs: hfsplus: fix UAF issue in hfsplus_put_super 2023-03-11 16:43:59 +01:00
hostfs hostfs: fix memory handling in follow_link() 2021-04-14 08:24:14 +02:00
hpfs fs: hpfs: Initialize filesystem timestamp ranges 2019-08-30 08:11:25 -07:00
hugetlbfs hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() 2023-01-18 11:41:38 +01:00
iomap iomap: iomap_write_failed fix 2022-06-14 18:11:36 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 14:43:03 +01:00
jbd2 jbd2: wake up journal waiters in FIFO order, not LIFO 2022-10-26 13:22:17 +02:00
jffs2 jffs2: correct logic when creating a hole in jffs2_write_begin 2023-03-22 13:28:07 +01:00
jfs fs/jfs: fix shift exponent db_agl2size negative 2023-03-11 16:44:07 +01:00
kernfs kernfs: fix use-after-free in __kernfs_remove 2022-11-03 23:56:54 +09:00
lockd lockd: lockd server-side shouldn't set fl_ops 2021-09-22 12:26:34 +02:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-15 14:18:35 +02:00
nfs NFSv4: Fix hangs when recovering open state after a server reboot 2023-04-05 11:16:45 +02:00
nfs_common nfs_common: need lock during iterate through the list 2020-12-30 11:51:22 +01:00
nfsd NFSD: callback request does not use correct credential for AUTH_SYS 2023-04-20 12:07:33 +02:00
nilfs2 nilfs2: initialize unused bytes in segment summary blocks 2023-04-26 11:24:04 +02:00
nls
notify fsnotify: fix wrong lockdep annotations 2022-06-14 18:11:34 +02:00
ntfs ntfs: check overflow when iterating ATTR_RECORDs 2022-11-25 17:42:22 +01:00
ocfs2 ocfs2: fix data corruption after failed write 2023-04-05 11:16:42 +02:00
omfs fs: omfs: Initialize filesystem timestamp ranges 2019-08-30 08:11:25 -07:00
openpromfs Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
orangefs orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() 2023-01-18 11:41:39 +01:00
overlayfs ovl: Use ovl mounter's fsuid and fsgid in ovl_link() 2023-01-18 11:41:43 +01:00
proc mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps 2023-02-22 12:50:28 +01:00
pstore pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES 2023-01-18 11:41:40 +01:00
qnx4 qnx4: work around gcc false positive warning bug 2021-09-30 10:09:26 +02:00
qnx6 fs: Fill in max and min timestamps in superblock 2019-08-30 07:27:17 -07:00
quota ext4: fix bug_on in __es_tree_search caused by bad quota inode 2023-01-18 11:42:02 +01:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2020-10-29 09:57:53 +01:00
reiserfs fs: reiserfs: remove useless new_opts in reiserfs_remount 2023-02-06 07:52:43 +01:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-26 10:40:51 +02:00
squashfs revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 2023-02-22 12:50:39 +01:00
sysfs sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output 2021-03-07 12:20:48 +01:00
sysv fs: sysv: Fix sysv_nblocks() returns wrong value 2023-01-18 11:40:58 +01:00
tracefs tracefs: Only clobber mode/uid/gid on remount if asked 2022-09-20 12:28:00 +02:00
ubifs ubifs: ubifs_writepage: Mark page dirty after writing inode failed 2023-03-11 16:44:10 +01:00
udf udf: Fix file corruption when appending just after end of preallocated extent 2023-03-11 16:44:01 +01:00
ufs fs/ufs: avoid potential u32 multiplication overflow 2020-08-21 13:05:37 +02:00
unicode unicode: make array 'token' static const, makes object smaller 2019-09-17 11:48:24 -04:00
verity fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY 2023-04-05 11:16:42 +02:00
xfs xfs: force log and push AIL to clear pinned inodes when aborting mount 2023-04-20 12:07:38 +02:00
aio.c aio: fix mremap after fork null-deref 2023-02-22 12:50:35 +01:00
anon_inodes.c Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
attr.c vfs: Check the truncate maximum size in inode_newsize_ok() 2022-08-25 11:17:21 +02:00
bad_inode.c
binfmt_aout.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:41:46 +01:00
binfmt_elf_fdpic.c binfmt: Fix error return code in load_elf_fdpic_binary() 2023-01-18 11:41:46 +01:00
binfmt_elf.c elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 2021-10-06 15:42:35 +02:00
binfmt_em86.c
binfmt_flat.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:41:46 +01:00
binfmt_misc.c binfmt_misc: fix shift-out-of-bounds in check_special_flags 2023-01-18 11:41:33 +01:00
binfmt_script.c
block_dev.c block: reexpand iov_iter after read/write 2021-05-22 11:38:29 +02:00
buffer.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:42:22 +01:00
char_dev.c chardev: fix error handling in cdev_device_add() 2023-01-18 11:41:25 +01:00
compat_binfmt_elf.c
compat_ioctl.c compat_ioctl: remove /dev/random commands 2022-06-22 14:11:03 +02:00
compat.c
coredump.c coredump: fix core_pattern parse error 2020-12-11 13:23:30 +01:00
d_path.c fs: fix NULL dereference due to data race in prepend_path() 2020-10-29 09:57:45 +01:00
dax.c dax: fix cache flush on PMD-mapped pages 2022-06-14 18:11:41 +02:00
dcache.c fix dget_parent() fastpath race 2020-10-01 13:17:19 +02:00
dcookies.c
direct-io.c fs: direct-io: fix missing sdio->boundary 2021-04-14 08:24:11 +02:00
drop_caches.c fs: avoid softlockups in s_inodes iterators 2020-01-12 12:21:37 +01:00
eventfd.c eventfd: track eventfd_signal() recursion depth 2020-02-11 04:35:37 -08:00
eventpoll.c epoll: check for events when removing a timed out thread from the wait queue 2022-12-08 11:23:05 +01:00
exec.c exec: Force single empty string when argv is empty 2022-06-06 08:33:50 +02:00
fcntl.c fcntl: fix potential deadlock for &fasync_struct.fa_lock 2021-09-15 09:47:28 +02:00
fhandle.c fs/handle.c - fix up kerneldoc 2019-08-07 21:51:47 -04:00
file_table.c SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 2022-05-25 09:14:34 +02:00
file.c fs: prevent out-of-bounds array speculation when closing a file descriptor 2023-03-17 08:32:47 +01:00
filesystems.c fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() 2020-04-17 10:50:21 +02:00
fs_context.c memcg: charge fs_context and legacy_fs_context 2022-02-08 18:24:29 +01:00
fs_parser.c vfs: Make fs_parse() handle fs_param_is_fd-type params better 2019-09-12 21:06:14 -04:00
fs_pin.c switch the remnants of releasing the mountpoint away from fs_pin 2019-07-16 22:52:37 -04:00
fs_struct.c
fs_types.c
fs-writeback.c fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages 2022-06-14 18:11:44 +02:00
fsopen.c Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
inode.c fs: fix UAF/GPF bug in nilfs_mdt_destroy 2022-10-15 07:54:36 +02:00
internal.h cgroup1: fix leaked context root causing sporadic NULL deref in LTP 2021-07-31 08:19:37 +02:00
io_uring.c io_uring/af_unix: defer registered files gc to io_uring release 2022-10-26 13:22:59 +02:00
ioctl.c compat_ioctl: add compat_ptr_ioctl() 2019-12-17 19:55:30 +01:00
Kconfig fs-verity for 5.4 2019-09-18 16:59:14 -07:00
Kconfig.binfmt
libfs.c libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value 2023-01-18 11:40:55 +01:00
locks.c locks: reinstate locks_delete_block optimization 2020-03-25 08:25:41 +01:00
Makefile fs-verity for 5.4 2019-09-18 16:59:14 -07:00
mbcache.c mbcache: Avoid nesting of cache->c_list_lock under bit locks 2023-01-18 11:41:59 +01:00
mount.h switch the remnants of releasing the mountpoint away from fs_pin 2019-07-16 22:52:37 -04:00
mpage.c fs: move guard_bio_eod() after bio_set_op_attrs 2020-01-17 19:48:21 +01:00
namei.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:42:22 +01:00
namespace.c fs: warn about impending deprecation of mandatory locks 2021-08-26 08:36:22 -04:00
no-block.c
nsfs.c
open.c cifs_atomic_open(): fix double-put on late allocation failure 2020-03-18 07:17:51 +01:00
pipe.c pipe: increase minimum default pipe size to 2 pages 2021-08-12 13:21:02 +02:00
pnode.c pnode: terminate at peers of source 2023-01-18 11:41:44 +01:00
pnode.h mount: fix mounting of detached mounts onto targets that reside on shared mounts 2021-03-17 17:03:33 +01:00
posix_acl.c
proc_namespace.c vfs: subtype handling moved to fuse 2019-09-06 21:28:49 +02:00
read_write.c fs: allow deduplication of eof block into the end of the destination file 2020-02-11 04:35:23 -08:00
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-21 12:56:16 +02:00
select.c select: Fix indefinitely sleeping task in poll_schedule_timeout() 2022-01-29 10:25:11 +01:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:10:54 +02:00
signalfd.c io_uring: disable polling pollfree files 2022-09-05 10:27:47 +02:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-17 17:24:32 +02:00
stack.c
stat.c stat: fix inconsistency between struct stat and struct compat_stat 2022-04-27 13:50:48 +02:00
statfs.c vfs: Fix EOVERFLOW testing in put_compat_statfs64 2019-10-03 14:21:35 -07:00
super.c vfs: make freeze_super abort when sync_filesystem returns error 2022-02-23 11:59:55 +01:00
sync.c
timerfd.c timerfd: Prepare for PREEMPT_RT 2019-08-01 20:51:23 +02:00
userfaultfd.c userfaultfd: open userfaultfds with O_RDONLY 2022-10-26 13:22:21 +02:00
utimes.c utimes: Clamp the timestamps in notify_change() 2020-02-11 04:35:12 -08:00
xattr.c fs: don't audit the capability check in simple_xattr_list() 2023-01-18 11:40:53 +01:00