Bug 214785
| Summary: | ubifs: Read out-of-bounds in ubifs_jnl_write_inode() | ||
|---|---|---|---|
| Product: | File System | Reporter: | Zhihao Cheng (chengzhihao1) |
| Component: | Other | Assignee: | fs_other |
| Status: | NEW --- | ||
| Severity: | normal | ||
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 5.15-rc5 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: |
print.patch
write_symlink.sh |
||
|
Description
Zhihao Cheng
2021-10-21 02:25:54 UTC
Function ubifs_wbuf_write_nolock() may access buf out of bounds in following process:
ubifs_wbuf_write_nolock
aligned_len = ALIGN(len, 8); // Assume len = 4089, aligned_len = 4096
if (aligned_len <= wbuf->avail) ... // Not satisfy
if (wbuf->used) {
ubifs_leb_write() // Fill some data in avail wbuf
len -= wbuf->avail; // len is still not 8-bytes aligned
aligned_len -= wbuf->avail;
}
n = aligned_len >> c->max_write_shift;
if (n) {
n <<= c->max_write_shift;
err = ubifs_leb_write(c, wbuf->lnum, buf + written,
wbuf->offs, n); // n > len, read out of bounds less than (n-len)8 bytes
}
Reproducer: 1. apply print.patch, and compile kernel (UBIFS/UBI/NANDSIM = m, CONFIG_UBIFS_ATIME_SUPPORT=y) 2. Run write_symlink.sh (Wait 1min~ to see read oob) Created attachment 299291 [details]
print.patch
Created attachment 299293 [details]
write_symlink.sh
|