2022-11-30 15:09:44

by Shigeru Yoshida

Subject: [PATCH] fs/ntfs3: Fix slab-out-of-bounds in ntfs_trim_fs()

ntfs_trim_fs() should loop with wnd->nwnd, not wnd->nbits. KASAN
detects this as an out-of-bounds access like below:

==================================================================
BUG: KASAN: slab-out-of-bounds in ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
Read of size 2 at addr ffff8881745b4f02 by task repro/19678

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-2.fc37 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
print_report (mm/kasan/report.c:285 mm/kasan/report.c:395)
? __virt_addr_valid (arch/x86/mm/physaddr.c:66)
? __phys_addr (arch/x86/mm/physaddr.c:32 (discriminator 4))
? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:497)
? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
ntfs_ioctl (fs/ntfs3/file.c:41 fs/ntfs3/file.c:57)
? ntfs_fiemap (fs/ntfs3/file.c:51)
? bpf_lsm_file_ioctl (./include/linux/lsm_hook_defs.h:165)
? ntfs_fiemap (fs/ntfs3/file.c:51)
__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:870 fs/ioctl.c:856 fs/ioctl.c:856)
do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)

Signed-off-by: Shigeru Yoshida <[email protected]>
---
fs/ntfs3/bitmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c
index e92bbd754365..1930640be31a 100644
--- a/fs/ntfs3/bitmap.c
+++ b/fs/ntfs3/bitmap.c
@@ -1424,7 +1424,7 @@ int ntfs_trim_fs(struct ntfs_sb_info *sbi, struct fstrim_range *range)

down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS);

- for (; iw < wnd->nbits; iw++, wbit = 0) {
+ for (; iw < wnd->nwnd; iw++, wbit = 0) {
CLST lcn_wnd = iw * wbits;
struct buffer_head *bh;

--
2.38.1

2022-12-26 15:54:53

by Konstantin Komarov

Subject: Re: [PATCH] fs/ntfs3: Fix slab-out-of-bounds in ntfs_trim_fs()

On 30.11.2022 18:57, Shigeru Yoshida wrote:
> ntfs_trim_fs() should loop with wnd->nwnd, not wnd->nbits. KASAN
> detects this as an out-of-bounds access like below:
>
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
> Read of size 2 at addr ffff8881745b4f02 by task repro/19678
>
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-2.fc37 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4))
> print_report (mm/kasan/report.c:285 mm/kasan/report.c:395)
> ? __virt_addr_valid (arch/x86/mm/physaddr.c:66)
> ? __phys_addr (arch/x86/mm/physaddr.c:32 (discriminator 4))
> ? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
> ? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
> kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:497)
> ? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
> ntfs_trim_fs (fs/ntfs3/bitmap.c:1434)
> ntfs_ioctl (fs/ntfs3/file.c:41 fs/ntfs3/file.c:57)
> ? ntfs_fiemap (fs/ntfs3/file.c:51)
> ? bpf_lsm_file_ioctl (./include/linux/lsm_hook_defs.h:165)
> ? ntfs_fiemap (fs/ntfs3/file.c:51)
> __x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:870 fs/ioctl.c:856 fs/ioctl.c:856)
> do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
>
> Signed-off-by: Shigeru Yoshida <[email protected]>
> ---
> fs/ntfs3/bitmap.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c
> index e92bbd754365..1930640be31a 100644
> --- a/fs/ntfs3/bitmap.c
> +++ b/fs/ntfs3/bitmap.c
> @@ -1424,7 +1424,7 @@ int ntfs_trim_fs(struct ntfs_sb_info *sbi, struct fstrim_range *range)
>
> down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS);
>
> - for (; iw < wnd->nbits; iw++, wbit = 0) {
> + for (; iw < wnd->nwnd; iw++, wbit = 0) {
> CLST lcn_wnd = iw * wbits;
> struct buffer_head *bh;
>

Thanks for work, this bug has already been fixed:

https://lore.kernel.org/ntfs3/[email protected]/