Files
linux/include/linux
David Howells 9f0933ac02 fscache: fix OOB Read in __fscache_acquire_volume
The type of a->key[0] is char in fscache_volume_same().  If the length
of cache volume key is greater than 127, the value of a->key[0] is less
than 0.  In this case, klen becomes much larger than 255 after type
conversion, because the type of klen is size_t.  As a result, memcmp()
is read out of bounds.

This causes a slab-out-of-bounds Read in __fscache_acquire_volume(), as
reported by Syzbot.

Fix this by changing the type of the stored key to "u8 *" rather than
"char *" (it isn't a simple string anyway).  Also put in a check that
the volume name doesn't exceed NAME_MAX.

  BUG: KASAN: slab-out-of-bounds in memcmp+0x16f/0x1c0 lib/string.c:757
  Read of size 8 at addr ffff888016f3aa90 by task syz-executor344/3613
  Call Trace:
   memcmp+0x16f/0x1c0 lib/string.c:757
   memcmp include/linux/fortify-string.h:420 [inline]
   fscache_volume_same fs/fscache/volume.c:133 [inline]
   fscache_hash_volume fs/fscache/volume.c:171 [inline]
   __fscache_acquire_volume+0x76c/0x1080 fs/fscache/volume.c:328
   fscache_acquire_volume include/linux/fscache.h:204 [inline]
   v9fs_cache_session_get_cookie+0x143/0x240 fs/9p/cache.c:34
   v9fs_session_init+0x1166/0x1810 fs/9p/v9fs.c:473
   v9fs_mount+0xba/0xc90 fs/9p/vfs_super.c:126
   legacy_get_tree+0x105/0x220 fs/fs_context.c:610
   vfs_get_tree+0x89/0x2f0 fs/super.c:1530
   do_new_mount fs/namespace.c:3040 [inline]
   path_mount+0x1326/0x1e20 fs/namespace.c:3370
   do_mount fs/namespace.c:3383 [inline]
   __do_sys_mount fs/namespace.c:3591 [inline]
   __se_sys_mount fs/namespace.c:3568 [inline]
   __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568

Fixes: 62ab633523 ("fscache: Implement volume registration")
Reported-by: syzbot+a76f6a6e524cf2080aa3@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Zhang Peng <zhangpeng362@huawei.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
cc: Dominique Martinet <asmadeus@codewreck.org>
cc: Jeff Layton <jlayton@kernel.org>
cc: v9fs-developer@lists.sourceforge.net
cc: linux-cachefs@redhat.com
Link: https://lore.kernel.org/r/Y3OH+Dmi0QIOK18n@codewreck.org/ # Zhang Peng's v1 fix
Link: https://lore.kernel.org/r/20221115140447.2971680-1-zhangpeng362@huawei.com/ # Zhang Peng's v2 fix
Link: https://lore.kernel.org/r/166869954095.3793579.8500020902371015443.stgit@warthog.procyon.org.uk/ # v1
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-11-23 10:31:13 -08:00
..
2022-11-07 14:00:27 +01:00
2022-05-22 20:44:29 +01:00
2022-03-23 19:58:38 +01:00
2022-02-01 14:25:50 +02:00
2022-07-05 20:25:39 +02:00
2022-01-22 08:33:34 +02:00
2022-09-21 11:18:28 +09:00
2022-09-26 12:19:12 -07:00
2022-09-26 19:46:29 -07:00
2022-09-26 10:13:13 -07:00
2022-09-26 10:13:13 -07:00
2022-09-15 09:32:06 -07:00
2022-09-26 10:13:14 -07:00
2022-03-15 10:32:44 +01:00
2022-06-28 10:37:25 -03:00
2022-07-01 14:53:01 +02:00
2022-10-17 13:49:45 +02:00
2022-01-20 08:52:54 +02:00
2022-10-03 14:02:45 -07:00
2022-08-16 12:46:26 +02:00
2022-06-09 21:53:09 -07:00
2022-06-09 21:53:12 -07:00
2022-06-09 21:53:09 -07:00
2022-02-28 23:26:27 -08:00
2022-09-01 18:04:43 +02:00
2022-06-27 06:29:12 -06:00
2022-09-08 12:59:00 -06:00
2022-09-26 13:31:20 +02:00
2022-09-01 18:08:44 +02:00
2022-07-17 17:31:38 -07:00
2022-10-03 14:03:19 -07:00
2022-05-02 14:06:20 -06:00
2022-01-27 13:53:26 +00:00
2022-05-03 16:09:03 -04:00
2022-06-19 10:38:26 +01:00
2022-07-27 14:04:52 +02:00
2022-09-26 19:46:18 -07:00
2022-10-03 14:03:19 -07:00
2022-04-28 23:16:14 -07:00
2022-09-26 10:13:13 -07:00
2022-08-02 12:34:04 -04:00
2022-09-01 17:39:49 -04:00
2022-08-22 14:26:30 +01:00
2022-05-17 13:32:46 -04:00
2022-08-09 14:11:34 -04:00
2022-07-29 20:16:58 -04:00
2022-02-09 09:24:40 -05:00
2022-01-12 10:14:09 -06:00
2022-10-03 17:34:32 -07:00
2022-09-26 19:46:27 -07:00
2022-09-26 19:46:09 -07:00
2022-07-01 16:38:35 -06:00
2022-02-02 07:49:59 -07:00
2022-02-09 08:04:44 +01:00
2022-02-09 08:04:44 +01:00
2022-10-17 16:32:05 +02:00
2022-10-04 20:52:38 +02:00
2022-10-11 17:42:58 -06:00
2022-01-22 08:33:37 +02:00
2022-01-08 12:43:57 -06:00
2022-09-19 06:17:05 -07:00
2022-01-24 14:45:02 +01:00
2022-10-11 17:42:58 -06:00
2022-03-08 14:33:36 -06:00
2022-03-17 20:16:29 -07:00
2022-03-23 19:58:41 +01:00
2022-05-22 21:03:01 +01:00
2022-04-07 12:53:54 +02:00
2022-06-27 14:41:31 +02:00
2022-02-24 15:04:51 +00:00
2022-05-08 01:33:08 -07:00
2022-09-07 12:42:25 +01:00
2022-02-25 09:36:06 +01:00
2022-09-29 15:20:29 +02:00
2022-04-11 19:18:27 -06:00
2022-03-22 15:57:11 -07:00
2022-09-22 16:12:34 +02:00
2022-09-22 16:12:34 +02:00
2022-08-31 13:37:32 +02:00
2022-09-01 11:42:12 +01:00
2022-09-16 10:56:08 +01:00
2022-08-28 16:52:28 +01:00
2022-10-07 09:32:40 -04:00
2022-11-10 12:03:36 -07:00
2022-09-26 19:46:18 -07:00
2022-06-13 09:54:52 -07:00
2022-09-26 19:46:18 -07:00
2022-09-28 10:00:16 +02:00
2022-07-10 21:17:30 -04:00