Messages in this thread | | | Date | Mon, 26 Dec 2022 18:03:27 +0400 | Subject | Re: [PATCH] fs/ntfs3: Fix OOB read in indx_insert_into_buffer | From | Konstantin Komarov <> |
| |
On 07.12.2022 13:46, Peng Zhang wrote: > From: ZhangPeng <zhangpeng362@huawei.com> > > Syzbot reported a OOB read bug: > > BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0 > fs/ntfs3/index.c:1755 > Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630 > > Call Trace: > <TASK> > memmove+0x25/0x60 mm/kasan/shadow.c:54 > indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 > indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863 > ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548 > ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100 > lookup_open fs/namei.c:3413 [inline] > > If the member struct INDEX_BUFFER *index of struct indx_node is > incorrect, that is, the value of __le32 used is greater than the value > of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when > memmove is called in indx_insert_into_buffer(). > Fix this by adding a check in hdr_find_e(). > > Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") > Reported-by: syzbot+d882d57193079e379309@syzkaller.appspotmail.com > Signed-off-by: ZhangPeng <zhangpeng362@huawei.com> > --- > fs/ntfs3/index.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c > index 440328147e7e..28af0a5afbf2 100644 > --- a/fs/ntfs3/index.c > +++ b/fs/ntfs3/index.c > @@ -679,9 +679,13 @@ static struct NTFS_DE *hdr_find_e(const struct ntfs_index *indx, > u32 e_size, e_key_len; > u32 end = le32_to_cpu(hdr->used); > u32 off = le32_to_cpu(hdr->de_off); > + u32 total = le32_to_cpu(hdr->total); > u16 offs[128]; > > fill_table: > + if (end > total) > + return NULL; > + > if (off + sizeof(struct NTFS_DE) > end) > return NULL; > Applied, thanks for the patch!
| |