linux-kernel - [PATCH] hfs: Fix OOB Write in hfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 26 Nov 2022 04:36:12 +0000
From:   Peng Zhang <zhangpeng362@...wei.com>
To:     <zippel@...ux-m68k.org>, <akpm@...l.org>
CC:     <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <sunnanyong@...wei.com>, <wangkefeng.wang@...wei.com>,
        ZhangPeng <zhangpeng362@...wei.com>,
        <syzbot+dc3b1cf9111ab5fe98e7@...kaller.appspotmail.com>
Subject: [PATCH] hfs: Fix OOB Write in hfs_asc2mac

From: ZhangPeng <zhangpeng362@...wei.com>

Syzbot reported a OOB Write bug:

loop0: detected capacity change from 0 to 64
==================================================================
BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0
fs/hfs/trans.c:133
Write of size 1 at addr ffff88801848314e by task syz-executor391/3632

Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
 print_address_description+0x74/0x340 mm/kasan/report.c:284
 print_report+0x107/0x1f0 mm/kasan/report.c:395
 kasan_report+0xcd/0x100 mm/kasan/report.c:495
 hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133
 hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28
 hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31
 lookup_open fs/namei.c:3391 [inline]
 open_last_lookups fs/namei.c:3481 [inline]
 path_openat+0x10e6/0x2df0 fs/namei.c:3710
 do_filp_open+0x264/0x4f0 fs/namei.c:3740

If in->len is much larger than HFS_NAMELEN(31) which is the maximum
length of an HFS filename, a OOB Write could occur in hfs_asc2mac(). In
that case, when the dst reaches the boundary, the srclen is still
greater than 0, which causes a OOB Write.
Fix this by adding a Check on dstlen before Writing to dst address.

Fixes: 328b92278650 ("[PATCH] hfs: NLS support")
Reported-by: syzbot+dc3b1cf9111ab5fe98e7@...kaller.appspotmail.com
Signed-off-by: ZhangPeng <zhangpeng362@...wei.com>
---
 fs/hfs/trans.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/hfs/trans.c b/fs/hfs/trans.c
index 39f5e343bf4d..886158db07b3 100644
--- a/fs/hfs/trans.c
+++ b/fs/hfs/trans.c
@@ -130,6 +130,8 @@ void hfs_asc2mac(struct super_block *sb, struct hfs_name *out, const struct qstr
 				dst += size;
 				dstlen -= size;
 			} else {
+				if (dstlen == 0)
+					goto out;
 				*dst++ = ch > 0xff ? '?' : ch;
 				dstlen--;
 			}
-- 
2.25.1