linux-kernel - Re: fix fs/quota/dquot.c oops error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20201102150439.GC23988@quack2.suse.cz>
Date:   Mon, 2 Nov 2020 16:04:39 +0100
From:   Jan Kara <jack@...e.cz>
To:     1 <liuyingbiao1005@....com>
Cc:     linux-kernel <linux-kernel@...r.kernel.org>, jack <jack@...e.com>
Subject: Re: fix fs/quota/dquot.c oops error

On Mon 02-11-20 16:38:00, 1 wrote:
>    An oops error will appear if you follow the steps below:
>    1.gcc -o test test.c
>    2.sudo ./test
> 
> 
>    The error can be found in the dmesg file , in the function of
>    "dquot_add_space".  Because a pointer named "dquot" is illegal , so it
>    need to use functions to detect the pointer.  Through the test, it is
>    found that this function named "access_ok" meets the requirements.

Thanks for the patch but it is not correct.  A proper fix for this syzbot
reproducer is to add more sanity checking into quota code to verify quota
file headers are not corrupted. Because these corrupted headers cause bogus
return values from get_free_blk() and possibly other quota functions which
then confuse __dquot_initialize().

								Honza

-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR