linux-kernel - Re: [PATCH v2] erofs: avoid using multiple devices with different type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d6dbcc0a-71d8-472a-aa62-89d7ba586cbc@linux.alibaba.com>
Date: Thu, 15 May 2025 09:50:02 +0800
From: Gao Xiang <hsiangkao@...ux.alibaba.com>
To: Sheng Yong <shengyong2021@...il.com>, xiang@...nel.org, chao@...nel.org,
 zbestahu@...il.com, jefflexu@...ux.alibaba.com, dhavale@...gle.com,
 lihongbo22@...wei.com
Cc: linux-erofs@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
 Sheng Yong <shengyong1@...omi.com>
Subject: Re: [PATCH v2] erofs: avoid using multiple devices with different
 type



On 2025/5/15 09:48, Sheng Yong wrote:
> From: Sheng Yong <shengyong1@...omi.com>
> 
> For multiple devices, both primary and extra devices should be the
> same type. `erofs_init_device` has already guaranteed that if the
> primary is a file-backed device, extra devices should also be
> regular files.
> 
> However, if the primary is a block device while the extra device
> is a file-backed device, `erofs_init_device` will get an ENOTBLK,
> which is not treated as an error in `erofs_fc_get_tree`, and that
> leads to an UAF:
> 
>    erofs_fc_get_tree
>      get_tree_bdev_flags(erofs_fc_fill_super)
>        erofs_read_superblock
>          erofs_init_device  // sbi->dif0 is not inited yet,
>                             // return -ENOTBLK
>        deactivate_locked_super
>          free(sbi)
>      if (err is -ENOTBLK)
>        sbi->dif0.file = filp_open()  // sbi UAF
> 
> So if -ENOTBLK is hitted in `erofs_init_device`, it means the
> primary device must be a block device, and the extra device
> is not a block device. The error can be converted to -EINVAL.
> 
> Fixes: fb176750266a ("erofs: add file-backed mount support")
> Signed-off-by: Sheng Yong <shengyong1@...omi.com>

Reviewed-by: Gao Xiang <hsiangkao@...ux.alibaba.com>

Thanks,
Gao Xiang