Bug 210865
| Summary: | ubifs: Read out-of-bounds in ubifs_jnl_write_inode() | ||
|---|---|---|---|
| Product: | File System | Reporter: | Zhihao Cheng (chengzhihao1) |
| Component: | Other | Assignee: | fs_other |
| Status: | NEW --- | ||
| Severity: | normal | ||
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 5.10 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: |
test.sh
print.patch |
||
|
Description
Zhihao Cheng
2020-12-23 03:09:18 UTC
1. The memory area allocated in ubifs_jnl_write_inode() is not aligned with 8 bytes:
ino_start = ino = kmalloc(write_len, GFP_NOFS);
2. When ino_start passed into write_head -> ubifs_wbuf_write_nolock:
n = aligned_len >> c->max_write_shift;
if (n) {
n <<= c->max_write_shift;
err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n);
// Read oob occurs here, read n bytes from buf, and buf is passed from @ino_start which is not 8 bytes aligned(write_len < n). Program read (n - write_len) more bytes.
}
Reproducer:
0. config KASAN && apply print.patch
1. mount ubifs on /root/temp
2. run test.sh
3. wait 1~2 minutes
Created attachment 294305 [details]
test.sh
Created attachment 294307 [details]
print.patch
(In reply to Zhihao Cheng from comment #1) > 1. The memory area allocated in ubifs_jnl_write_inode() is not aligned with > 8 bytes: > ino_start = ino = kmalloc(write_len, GFP_NOFS); > 2. When ino_start passed into write_head -> ubifs_wbuf_write_nolock: > n = aligned_len >> c->max_write_shift; > if (n) { > n <<= c->max_write_shift; > err = ubifs_leb_write(c, wbuf->lnum, buf + written, wbuf->offs, n); > // Read oob occurs here, read n bytes from buf, and buf is passed from > @ino_start which is not 8 bytes aligned(write_len < n). Program read (n - > write_len) more bytes. > } > > > Reproducer: > 0. config KASAN && apply print.patch > 1. mount ubifs on /root/temp > 2. run test.sh cd /root/temp ls // change atime for link_file > 3. wait 1~2 minutes |