Commit 9f0933ac authored by David Howells's avatar David Howells Committed by Linus Torvalds
Browse files

fscache: fix OOB Read in __fscache_acquire_volume 



The type of a->key[0] is char in fscache_volume_same().  If the length
of cache volume key is greater than 127, the value of a->key[0] is less
than 0.  In this case, klen becomes much larger than 255 after type
conversion, because the type of klen is size_t.  As a result, memcmp()
is read out of bounds.

This causes a slab-out-of-bounds Read in __fscache_acquire_volume(), as
reported by Syzbot.

Fix this by changing the type of the stored key to "u8 *" rather than
"char *" (it isn't a simple string anyway).  Also put in a check that
the volume name doesn't exceed NAME_MAX.

  BUG: KASAN: slab-out-of-bounds in memcmp+0x16f/0x1c0 lib/string.c:757
  Read of size 8 at addr ffff888016f3aa90 by task syz-executor344/3613
  Call Trace:
   memcmp+0x16f/0x1c0 lib/string.c:757
   memcmp include/linux/fortify-string.h:420 [inline]
   fscache_volume_same fs/fscache/volume.c:133 [inline]
   fscache_hash_volume fs/fscache/volume.c:171 [inline]
   __fscache_acquire_volume+0x76c/0x1080 fs/fscache/volume.c:328
   fscache_acquire_volume include/linux/fscache.h:204 [inline]
   v9fs_cache_session_get_cookie+0x143/0x240 fs/9p/cache.c:34
   v9fs_session_init+0x1166/0x1810 fs/9p/v9fs.c:473
   v9fs_mount+0xba/0xc90 fs/9p/vfs_super.c:126
   legacy_get_tree+0x105/0x220 fs/fs_context.c:610
   vfs_get_tree+0x89/0x2f0 fs/super.c:1530
   do_new_mount fs/namespace.c:3040 [inline]
   path_mount+0x1326/0x1e20 fs/namespace.c:3370
   do_mount fs/namespace.c:3383 [inline]
   __do_sys_mount fs/namespace.c:3591 [inline]
   __se_sys_mount fs/namespace.c:3568 [inline]
   __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568

Fixes: 62ab6335 ("fscache: Implement volume registration")
Reported-by: default avatar <syzbot+a76f6a6e524cf2080aa3@syzkaller.appspotmail.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Reviewed-by: default avatarJingbo Xu <jefflexu@linux.alibaba.com>
cc: Dominique Martinet <asmadeus@codewreck.org>
cc: Jeff Layton <jlayton@kernel.org>
cc: v9fs-developer@lists.sourceforge.net
cc: linux-cachefs@redhat.com
Link: https://lore.kernel.org/r/Y3OH+Dmi0QIOK18n@codewreck.org/ # Zhang Peng's v1 fix
Link: https://lore.kernel.org/r/20221115140447.2971680-1-zhangpeng362@huawei.com/ # Zhang Peng's v2 fix
Link: https://lore.kernel.org/r/166869954095.3793579.8500020902371015443.stgit@warthog.procyon.org.uk/

 # v1
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent eb708140

fs/fscache/volume.c

+5 −2
Original line number Diff line number Diff line
@@ -203,7 +203,11 @@ static struct fscache_volume *fscache_alloc_volume(const char *volume_key, 
	struct fscache_volume *volume;

	struct fscache_cache *cache;

	size_t klen, hlen;

	char *key;

	u8 *key;



	klen = strlen(volume_key);

	if (klen > NAME_MAX)

		return NULL;



	if (!coherency_data)

		coherency_len = 0;
@@ -229,7 +233,6 @@ static struct fscache_volume *fscache_alloc_volume(const char *volume_key, 
	/* Stick the length on the front of the key and pad it out to make

	 * hashing easier.

	 */

	klen = strlen(volume_key);

	hlen = round_up(1 + klen + 1, sizeof(__le32));

	key = kzalloc(hlen, GFP_KERNEL);

	if (!key)

include/linux/fscache.h

+1 −1
Original line number Diff line number Diff line
@@ -75,7 +75,7 @@ struct fscache_volume { 
	atomic_t			n_accesses;	/* Number of cache accesses in progress */

	unsigned int			debug_id;

	unsigned int			key_hash;	/* Hash of key string */

	char				*key;		/* Volume ID, eg. "afs@example.com@1234" */

	u8				*key;		/* Volume ID, eg. "afs@example.com@1234" */

	struct list_head		proc_link;	/* Link in /proc/fs/fscache/volumes */

	struct hlist_bl_node		hash_link;	/* Link in hash table */

	struct work_struct		work;