leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0be698ecbe
linux/fs/ext4
History
Ye Bin 0be698ecbe ext4: fix use-after-free in ext4_rename_dir_prepare 
We got issue as follows:
EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
ext4_get_first_dir_block: bh->b_data=0xffff88810bee6000 len=34478
ext4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh->b_data=0xffff88810bee6000
ext4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae
==================================================================
BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x152/0x220
Read of size 4 at addr ffff88810beee6ae by task rep/1895

CPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0+ #241
Call Trace:
 dump_stack+0xbe/0xf9
 print_address_description.constprop.0+0x1e/0x220
 kasan_report.cold+0x37/0x7f
 ext4_rename_dir_prepare+0x152/0x220
 ext4_rename+0xf44/0x1ad0
 ext4_rename2+0x11c/0x170
 vfs_rename+0xa84/0x1440
 do_renameat2+0x683/0x8f0
 __x64_sys_renameat+0x53/0x60
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f45a6fc41c9
RSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9
RDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005
RBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080
R10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0
R13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000

The buggy address belongs to the page:
page:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee
flags: 0x200000000000000()
raw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000
raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                  ^
 ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Disabling lock debugging due to kernel taint
ext4_rename_dir_prepare: [2] parent_de->inode=3537895424
ext4_rename_dir_prepare: [3] dir=0xffff888124170140
ext4_rename_dir_prepare: [4] ino=2
ext4_rename_dir_prepare: ent->dir->i_ino=2 parent=-757071872

Reason is first directory entry which 'rec_len' is 34478, then will get illegal
parent entry. Now, we do not check directory entry after read directory block
in 'ext4_get_first_dir_block'.
To solve this issue, check directory entry in 'ext4_get_first_dir_block'.

[ Trigger an ext4_error() instead of just warning if the directory is
  missing a '.' or '..' entry.   Also make sure we return an error code
  if the file system is corrupted.  -TYT ]

Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220414025223.4113128-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
2022-05-17 14:16:56 -04:00
..
.kunitconfig ext4: add .kunitconfig fragment to enable ext4-specific tests 2021-02-11 23:16:30 -05:00
acl.c fs/ext4: fix comments mentioning i_mutex 2022-02-03 10:57:53 -05:00
acl.h vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
balloc.c ext4: fix kernel doc warnings 2022-03-15 17:45:36 -04:00
bitmap.c
block_validity.c ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid() 2022-02-25 21:34:56 -05:00
dir.c ext4: fix spelling errors in comments 2022-05-11 15:19:06 -04:00
ext4_extents.h ext4: fix sparse warnings 2021-08-30 23:36:50 -04:00
ext4_jbd2.c ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits' 2022-01-10 13:25:55 -05:00
ext4_jbd2.h fs/ext4: fix comments mentioning i_mutex 2022-02-03 10:57:53 -05:00
ext4.h ext4: update the cached overhead value in the superblock 2022-04-14 22:39:00 -04:00
extents_status.c ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit 2021-06-22 21:34:17 -04:00
extents_status.h
extents.c ext4: fix fallocate to use file_modified to update permissions consistently 2022-04-12 22:22:02 -04:00
fast_commit.c ext4: remove unnecessary conditionals 2022-05-13 16:27:24 -04:00
fast_commit.h flexible-array transformations for 5.18-rc1 2022-03-24 11:39:32 -07:00
file.c fs: Pass an iocb to generic_perform_write() 2022-04-01 14:40:44 -04:00
fsmap.c treewide: Change list_sort to use const pointers 2021-04-08 16:04:22 -07:00
fsmap.h ext4: fsmap: fix the block/inode bitmap comment 2021-06-24 09:48:29 -04:00
fsync.c block: use an on-stack bio in blkdev_issue_flush 2021-01-27 09:51:48 -07:00
hash.c unicode: clean up the Kconfig symbol confusion 2022-01-20 19:57:24 -05:00
ialloc.c ext4: Support for checksumming from journal triggers 2021-08-30 23:36:50 -04:00
indirect.c fs/ext4: fix comments mentioning i_mutex 2022-02-03 10:57:53 -05:00
inline.c ext4: remove unnecessary type castings 2022-05-11 15:19:06 -04:00
inode-test.c fs: ext4: Modify inode-test.c to use KUnit parameterized testing feature 2020-12-02 16:07:25 -07:00
inode.c ext4: fix warning in ext4_handle_inode_extension 2022-05-11 15:18:40 -04:00
ioctl.c ext4: update the cached overhead value in the superblock 2022-04-14 22:39:00 -04:00
Kconfig ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it 2021-02-11 23:12:59 -05:00
Makefile ext4: Move orphan inode handling into a separate file 2021-08-30 23:36:51 -04:00
mballoc.c ext4: remove unnecessary code in __mb_check_buddy 2022-05-11 15:19:06 -04:00
mballoc.h ext4: fix various seppling typos 2021-04-09 23:14:59 -04:00
migrate.c fs/ext4: fix comments mentioning i_mutex 2022-02-03 10:57:53 -05:00
mmp.c ext4: remove unnecessary type castings 2022-05-11 15:19:06 -04:00
move_extent.c ext4: remove redundant o_start statement 2022-01-10 13:25:56 -05:00
namei.c ext4: fix use-after-free in ext4_rename_dir_prepare 2022-05-17 14:16:56 -04:00
orphan.c fs/ext4: fix comments mentioning i_mutex 2022-02-03 10:57:53 -05:00
page-io.c Fix some syzbot-detected bugs, as well as other bugs found by I/O 2022-04-22 18:18:27 -07:00
readpage.c fs: Remove ->readpages address space operation 2022-04-01 13:45:33 -04:00
resize.c ext4: use time_is_before_jiffies() instead of open coding it 2022-03-02 23:50:02 -05:00
super.c ext4: add unmount filesystem message 2022-05-13 17:00:39 -04:00
symlink.c ext4: report correct st_size for encrypted symlinks 2021-07-25 20:01:06 -07:00
sysfs.c unicode: clean up the Kconfig symbol confusion 2022-01-20 19:57:24 -05:00
truncate.h ext4: Convert to use mapping->invalidate_lock 2021-07-13 14:29:00 +02:00
verity.c New features for ext4 this cycle include support for encrypted 2021-04-30 15:35:30 -07:00
xattr_hurd.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_security.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_trusted.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_user.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr.c ext4: fast commit may not fallback for ineligible commit 2022-02-03 10:56:39 -05:00
xattr.h ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() 2021-06-24 10:09:39 -04:00