Bug 200465
| Summary: | null ptr dereference in fscrypt_do_page_crypto() when operating a file on a corrupted f2fs image | ||
|---|---|---|---|
| Product: | File System | Reporter: | Wen Xu (wen.xu) |
| Component: | f2fs | Assignee: | Default virtual assignee for f2fs (filesystem_f2fs) |
| Status: | NEEDINFO --- | ||
| Severity: | normal | CC: | chao, sbeattie, wen.xu |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 4.18 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: | The (compressed) crafted image which causes crash | ||
|
Description
Wen Xu
2018-07-09 23:38:24 UTC
Wen Xu, I didn't see encryption feature is on in uploaded image, but actually, our stack is stuck in decrypting flow, could you check the image again? Info: superblock features = 0 : This was assigned CVE-2018-14616 (see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14616). Chao, is it correct that the fix for this issue landed as https://git.kernel.org/linus/91291e9998d208370eb8156c760691b873bd7522 ? Or are additional fixes needed? Thanks! Steve, I figure out that patch to solve issue which I encounter with image attached by Wen Xu, the bug can be triggered with below scripts: - mount image /mnt/f2fs/ - cd /mnt/f2fs/foo/bar/ - ls -l After applying that patch, the problem was gone. But when the bug triggeres, related call stack is not the same as reported one, also I can't reproduce reported call stack with the method provided from Wen Xu. I guess the right producing way is adding master key for encrypted file, I'd like to confirm with Wen Xu. (In reply to Chao Yu from comment #3) > Steve, > > I figure out that patch to solve issue which I encounter with image attached > by Wen Xu, the bug can be triggered with below scripts: > - mount image /mnt/f2fs/ > - cd /mnt/f2fs/foo/bar/ > - ls -l > > After applying that patch, the problem was gone. > > But when the bug triggeres, related call stack is not the same as reported > one, also I can't reproduce reported call stack with the method provided > from Wen Xu. > > I guess the right producing way is adding master key for encrypted file, I'd > like to confirm with Wen Xu. Hi Chao, Sorry for a late reply! Eh the first thing is that I never did anything like adding master key for encrypted file. Second, I feel I pasted wrong (mismatched) kernel message/PoC...but unfortunately I do not have a local copy on my laptop now. (In reply to Wen Xu from comment #4) > (In reply to Chao Yu from comment #3) > > Steve, > > > > I figure out that patch to solve issue which I encounter with image > attached > > by Wen Xu, the bug can be triggered with below scripts: > > - mount image /mnt/f2fs/ > > - cd /mnt/f2fs/foo/bar/ > > - ls -l > > > > After applying that patch, the problem was gone. > > > > But when the bug triggeres, related call stack is not the same as reported > > one, also I can't reproduce reported call stack with the method provided > > from Wen Xu. > > > > I guess the right producing way is adding master key for encrypted file, > I'd > > like to confirm with Wen Xu. > > Hi Chao, > > Sorry for a late reply! Eh the first thing is that I never did anything like > adding master key for encrypted file. Second, I feel I pasted wrong > (mismatched) kernel message/PoC...but unfortunately I do not have a local > copy on my laptop now. Hi Wen, Oops, if you got another similar kernel message, please let me know. BTW, let me tag status of this issue as NEEDINFO |