linux-kernel - [PATCH v2] hfs: Fix OOB Write in hfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 2 Dec 2022 03:00:38 +0000
From:   Peng Zhang <zhangpeng362@...wei.com>
To:     <zippel@...ux-m68k.org>, <akpm@...l.org>, <slava@...eyko.com>,
        <akpm@...ux-foundation.org>
CC:     <willy@...radead.org>, <damien.lemoal@...nsource.wdc.com>,
        <jlayton@...nel.org>, <ira.weiny@...el.com>,
        <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <sunnanyong@...wei.com>, <wangkefeng.wang@...wei.com>,
        ZhangPeng <zhangpeng362@...wei.com>,
        <syzbot+dc3b1cf9111ab5fe98e7@...kaller.appspotmail.com>
Subject: [PATCH v2] hfs: Fix OOB Write in hfs_asc2mac

From: ZhangPeng <zhangpeng362@...wei.com>

Syzbot reported a OOB Write bug:

loop0: detected capacity change from 0 to 64
==================================================================
BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0
fs/hfs/trans.c:133
Write of size 1 at addr ffff88801848314e by task syz-executor391/3632

Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
 print_address_description+0x74/0x340 mm/kasan/report.c:284
 print_report+0x107/0x1f0 mm/kasan/report.c:395
 kasan_report+0xcd/0x100 mm/kasan/report.c:495
 hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133
 hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28
 hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31
 lookup_open fs/namei.c:3391 [inline]
 open_last_lookups fs/namei.c:3481 [inline]
 path_openat+0x10e6/0x2df0 fs/namei.c:3710
 do_filp_open+0x264/0x4f0 fs/namei.c:3740

If in->len is much larger than HFS_NAMELEN(31) which is the maximum
length of an HFS filename, a OOB write could occur in hfs_asc2mac(). In
that case, when the dst reaches the boundary, the srclen is still
greater than 0, which causes a OOB write.
Fix this by adding a check on dstlen in while() before writing to dst
address.

Fixes: 328b92278650 ("[PATCH] hfs: NLS support")
Reported-by: syzbot+dc3b1cf9111ab5fe98e7@...kaller.appspotmail.com
Signed-off-by: ZhangPeng <zhangpeng362@...wei.com>
Reviewed-by: Viacheslav Dubeyko <slava@...eyko.com>
---
v2:
- Add RB from Slava
- Change the location of the check for dstlen
---
 fs/hfs/trans.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/hfs/trans.c b/fs/hfs/trans.c
index 39f5e343bf4d..fdb0edb8a607 100644
--- a/fs/hfs/trans.c
+++ b/fs/hfs/trans.c
@@ -109,7 +109,7 @@ void hfs_asc2mac(struct super_block *sb, struct hfs_name *out, const struct qstr
 	if (nls_io) {
 		wchar_t ch;
 
-		while (srclen > 0) {
+		while (srclen > 0 && dstlen > 0) {
 			size = nls_io->char2uni(src, srclen, &ch);
 			if (size < 0) {
 				ch = '?';
-- 
2.25.1