linux-kernel - [PATCH] reiserfs: added check in case of bad disk in search_by_entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 11 Sep 2022 18:05:51 +0300
From:   Vadim Shakirov <shakirov@...ras.ru>
To:     reiserfs-devel@...r.kernel.org
Cc:     Vadim@...r.kernel.org, Shakirov@...r.kernel.org,
        linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org,
        Shakirov Vadim <shakirov@...ras.ru>
Subject: [PATCH] reiserfs: added check in case of bad disk in search_by_entry_key

From: Vadim Shakirov

Syzkaller has detected a bug in the search_by_entry_key function when the disk is bad.
For example, when we mount a disk using the search_by_key function, we are looking for an item_head that describes the .privroot directory. On the correct disk, either the desired position will be found, or the position following the desired element will be returned (since the key by which we are looking for may have an offset greater than that of the sought item_head), and using PATH_LAST_POSITION(path)-- the desired element is found.

But in the case of a bad disk, it may happen the item_head of the stat-file of the directory exists, but the item_head itself of the directory file does not exist. In this case, after ITEM_NOT_FOUND is returned from searh_by_key and PATH_LAST_POSITION(path)-- is executed, the location will point to the item_head of the stat file in this directory - dir_id and object_id will match, and the offset of the stat file is 0. And then we will treat the item_head of the stat file as if it were the item_head of a directory.

Signed-off-by: Shakirov Vadim <shakirov@...ras.ru>
---
 fs/reiserfs/namei.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index 1594687582f0..c6db8db6a391 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -133,6 +133,12 @@ int search_by_entry_key(struct super_block *sb, const struct cpu_key *key,
 		}
 		PATH_LAST_POSITION(path)--;

+		if (!is_direntry_le_ih(tp_item_head(path)) ||
+		    COMP_SHORT_KEYS(&(tp_item_head(path))->ih_key, key)) {
+			pathrelse(path);
+			return IO_ERROR;
+		}
+
 	case ITEM_FOUND:
 		break;

-- 
2.25.1