linux-kernel - [PATCH 0/2] Fix out-of-bound access if pagecache of udf device is corrupted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230613032254.1235752-1-haowenchao2@huawei.com>
Date:   Tue, 13 Jun 2023 11:22:52 +0800
From:   Wenchao Hao <haowenchao2@...wei.com>
To:     Jan Kara <jack@...e.com>, <linux-kernel@...r.kernel.org>
CC:     <linfeilong@...wei.com>, Wenchao Hao <haowenchao2@...wei.com>
Subject: [PATCH 0/2] Fix out-of-bound access if pagecache of udf device is corrupted

Following steps would cause out-of-bound access and even cause kernel
panic when using udf:

dd if=/dev/zero of=udf.img bs=1M count=512
mkfs.udf udf.img
mount -o loop -t udf udf.img /mnt
dd if=/dev/random of=/dev/loop0 bs=512 count=1 seek=128
umount /mnt

[if /mnt is mounted on /dev/loop0]

It is because we did not check if udf_sb_info->s_lvid_bh is valid in
udf_sb_lvidiu().

Although it's illegal to write backend device since filesystem has been
mounted, but we should avoid kernel panic if it happened.

The first patch add a helper function to check if the data is valid.
The second patch just call the helper function, if check failed, return
NULL from udf_sb_lvidiu()

Wenchao Hao (2):
  udf: add helper function udf_check_tagged_bh to check tagged page
  udf:check if buffer head's data when getting lvidiu

 fs/udf/misc.c    | 60 ++++++++++++++++++++++++++++--------------------
 fs/udf/super.c   |  2 ++
 fs/udf/udfdecl.h |  1 +
 3 files changed, 38 insertions(+), 25 deletions(-)

-- 
2.35.3