| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2a38980f-2ce7-45e9-adf2-ce04c68be398@paragon-software.com>
Date: Thu, 20 Nov 2025 09:44:53 +0100
From: Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
To: YangWen <anmuxixixi@...il.com>
CC: <ntfs3@...ts.linux.dev>, <linux-kernel@...r.kernel.org>,
<syzbot+d77c546c60db651a389c@...kaller.appspotmail.com>
Subject: Re: [PATCH] ntfs3: fix use-after-free of sbi->options in cmp_fnames
On 9/10/25 17:17, YangWen wrote:
> BUG: KASAN: slab-use-after-free in cmp_fnames+0x292/0x2a0 fs/ntfs3/index.c:50
> Read of size 2 at addr ffff88801f6da2dc by task syz.7.385/9323
>
> CPU: 0 UID: 0 PID: 9323 Comm: syz.7.385 Tainted: G W 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT_{RT,(full)}
> Tainted: [W]=WARN
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
> Call Trace:
> <TASK>
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0xca/0x240 mm/kasan/report.c:482
> kasan_report+0x118/0x150 mm/kasan/report.c:595
> cmp_fnames+0x292/0x2a0 fs/ntfs3/index.c:50
> hdr_find_e+0x3c6/0x630 fs/ntfs3/index.c:762
> indx_find+0x516/0xba0 fs/ntfs3/index.c:1186
> dir_search_u+0x15f/0x2c0 fs/ntfs3/dir.c:254
> ntfs_lookup+0xfb/0x1f0 fs/ntfs3/namei.c:85
> lookup_one_qstr_excl+0x12e/0x360 fs/namei.c:1697
> filename_create+0x224/0x3c0 fs/namei.c:4140
> do_mknodat+0x184/0x4d0 fs/namei.c:4272
> __do_sys_mknodat fs/namei.c:4313 [inline]
> __se_sys_mknodat fs/namei.c:4310 [inline]
> __x64_sys_mknodat+0xa7/0xc0 fs/namei.c:4310
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f763f38ebe9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f763d5d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
> RAX: ffffffffffffffda RBX: 00007f763f5b6090 RCX: 00007f763f38ebe9
> RDX: 00000000000021c0 RSI: 0000200000000040 RDI: ffffffffffffff9c
> RBP: 00007f763f411e19 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000103 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f763f5b6128 R14: 00007f763f5b6090 R15: 00007ffca1693878
> </TASK>
>
> Allocated by task 9322:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
> poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
> __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
> kasan_kmalloc include/linux/kasan.h:260 [inline]
> __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4396
> kmalloc_noprof include/linux/slab.h:905 [inline]
> kzalloc_noprof include/linux/slab.h:1039 [inline]
> __ntfs_init_fs_context fs/ntfs3/super.c:1761 [inline]
> ntfs_init_fs_context+0x54/0x4c0 fs/ntfs3/super.c:1806
> alloc_fs_context+0x659/0x7e0 fs/fs_context.c:318
> do_remount fs/namespace.c:3299 [inline]
> path_mount+0xc25/0xfe0 fs/namespace.c:4112
> do_mount fs/namespace.c:4133 [inline]
> __do_sys_mount fs/namespace.c:4344 [inline]
> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Freed by task 9322:
> kasan_save_stack mm/kasan/common.c:47 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
> kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
> poison_slab_object mm/kasan/common.c:243 [inline]
> __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
> kasan_slab_free include/linux/kasan.h:233 [inline]
> slab_free_hook mm/slub.c:2417 [inline]
> slab_free mm/slub.c:4680 [inline]
> kfree+0x195/0x550 mm/slub.c:4879
> put_fs_context+0x123/0x790 fs/fs_context.c:524
> do_remount fs/namespace.c:3326 [inline]
> path_mount+0xe57/0xfe0 fs/namespace.c:4112
> do_mount fs/namespace.c:4133 [inline]
> __do_sys_mount fs/namespace.:qc:4344 [inline]
> __se_sys_mount+0x317/0x410 fs/namespace.c:4321
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> The root cause is that sbi->options points directly to fc->fs_private.
> If fc->fs_private is freed while sbi still exists, sbi->options becomes
> a dangling pointer.
>
> This patch ensures that sbi->options is a separate copy of fc->fs_private
> and duplicates nls_name if present. On superblock release or error,
> sbi->options->nls_name and sbi->options are freed and sbi->options
> is set to NULL to avoid any dangling pointer.
>
> Reported-by: syzbot+d77c546c60db651a389c@...kaller.appspotmail.com
> Signed-off-by: YangWen <anmuxixixi@...il.com>
> ---
> fs/ntfs3/super.c | 47 +++++++++++++++++++++++++++++++++++++++--------
> 1 file changed, 39 insertions(+), 8 deletions(-)
>
> diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
> index ddff94c091b8..6f4aab96e999 100644
> --- a/fs/ntfs3/super.c
> +++ b/fs/ntfs3/super.c
> @@ -697,6 +697,14 @@ static void ntfs_put_super(struct super_block *sb)
>
> /* Mark rw ntfs as clear, if possible. */
> ntfs_set_state(sbi, NTFS_DIRTY_CLEAR);
> +
> + if (sbi->options) {
> + unload_nls(sbi->options->nls);
> + kfree(sbi->options->nls);
> + kfree(sbi->options);
> + sbi->options = NULL;
> + }
> +
> ntfs3_put_sbi(sbi);
> }
>
> @@ -1198,7 +1206,8 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
> int err;
> struct ntfs_sb_info *sbi = sb->s_fs_info;
> struct block_device *bdev = sb->s_bdev;
> - struct ntfs_mount_options *options;
> + struct ntfs_mount_options *fc_opts;
> + struct ntfs_mount_options *options = NULL;
> struct inode *inode;
> struct ntfs_inode *ni;
> size_t i, tt, bad_len, bad_frags;
> @@ -1215,21 +1224,36 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
> ref.high = 0;
>
> sbi->sb = sb;
> - sbi->options = options = fc->fs_private;
> - fc->fs_private = NULL;
> + fc_opts = fc->fs_private;
> + if (!fc_opts) {
> + errorf(fc, "missing mount options");
> + return -EINVAL;
> + }
> + options = kmemdup(fc_opts, sizeof(*fc_opts), GFP_KERNEL);
> + if (!options)
> + return -ENOMEM;
> +
> + if (fc_opts->nls_name) {
> + options->nls_name = kstrdup(fc_opts->nls_name, GFP_KERNEL);
> + if (!options->nls_name) {
> + kfree(options);
> + return -ENOMEM;
> + }
> + }
> + sbi->options = options;
> sb->s_flags |= SB_NODIRATIME;
> sb->s_magic = 0x7366746e; // "ntfs"
> sb->s_op = &ntfs_sops;
> sb->s_export_op = &ntfs_export_ops;
> sb->s_time_gran = NTFS_TIME_GRAN; // 100 nsec
> sb->s_xattr = ntfs_xattr_handlers;
> - if (options->nocase)
> + if (sbi->options->nocase)
> set_default_d_op(sb, &ntfs_dentry_ops);
>
> - options->nls = ntfs_load_nls(options->nls_name);
> - if (IS_ERR(options->nls)) {
> - options->nls = NULL;
> - errorf(fc, "Cannot load nls %s", options->nls_name);
> + sbi->options->nls = ntfs_load_nls(sbi->options->nls_name);
> + if (IS_ERR(sbi->options->nls)) {
> + sbi->options->nls = NULL;
> + errorf(fc, "Cannot load nls %s", fc_opts->nls_name);
> err = -EINVAL;
> goto out;
> }
> @@ -1641,6 +1665,13 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
> put_inode_out:
> iput(inode);
> out:
> + if (sbi && sbi->options) {
> + unload_nls(sbi->options->nls);
> + kfree(sbi->options->nls);
> + kfree(sbi->options);
> + sbi->options = NULL;
> + }
> +
> ntfs3_put_sbi(sbi);
> kfree(boot2);
> ntfs3_put_sbi(sbi);
Thanks. Applied, will be sent in the next pull request.
Regards,
Konstantin
Powered by blists - more mailing lists