lkml.org 
[lkml]   [2020]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 052/107] jffs2: fix UAF problem
    Date
    From: Zhe Li <lizhe67@huawei.com>

    [ Upstream commit 798b7347e4f29553db4b996393caf12f5b233daf ]

    The log of UAF problem is listed below.
    BUG: KASAN: use-after-free in jffs2_rmdir+0xa4/0x1cc [jffs2] at addr c1f165fc
    Read of size 4 by task rm/8283
    =============================================================================
    BUG kmalloc-32 (Tainted: P B O ): kasan: bad access detected
    -----------------------------------------------------------------------------

    INFO: Allocated in 0xbbbbbbbb age=3054364 cpu=0 pid=0
    0xb0bba6ef
    jffs2_write_dirent+0x11c/0x9c8 [jffs2]
    __slab_alloc.isra.21.constprop.25+0x2c/0x44
    __kmalloc+0x1dc/0x370
    jffs2_write_dirent+0x11c/0x9c8 [jffs2]
    jffs2_do_unlink+0x328/0x5fc [jffs2]
    jffs2_rmdir+0x110/0x1cc [jffs2]
    vfs_rmdir+0x180/0x268
    do_rmdir+0x2cc/0x300
    ret_from_syscall+0x0/0x3c
    INFO: Freed in 0x205b age=3054364 cpu=0 pid=0
    0x2e9173
    jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
    jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
    jffs2_garbage_collect_dirent.isra.3+0x21c/0x288 [jffs2]
    jffs2_garbage_collect_live+0x16bc/0x1800 [jffs2]
    jffs2_garbage_collect_pass+0x678/0x11d4 [jffs2]
    jffs2_garbage_collect_thread+0x1e8/0x3b0 [jffs2]
    kthread+0x1a8/0x1b0
    ret_from_kernel_thread+0x5c/0x64
    Call Trace:
    [c17ddd20] [c02452d4] kasan_report.part.0+0x298/0x72c (unreliable)
    [c17ddda0] [d2509680] jffs2_rmdir+0xa4/0x1cc [jffs2]
    [c17dddd0] [c026da04] vfs_rmdir+0x180/0x268
    [c17dde00] [c026f4e4] do_rmdir+0x2cc/0x300
    [c17ddf40] [c001a658] ret_from_syscall+0x0/0x3c

    The root cause is that we don't get "jffs2_inode_info.sem" before
    we scan list "jffs2_inode_info.dents" in function jffs2_rmdir.
    This patch add codes to get "jffs2_inode_info.sem" before we scan
    "jffs2_inode_info.dents" to slove the UAF problem.

    Signed-off-by: Zhe Li <lizhe67@huawei.com>
    Reviewed-by: Hou Tao <houtao1@huawei.com>
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/jffs2/dir.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
    index f20cff1194bb6..776493713153f 100644
    --- a/fs/jffs2/dir.c
    +++ b/fs/jffs2/dir.c
    @@ -590,10 +590,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
    int ret;
    uint32_t now = JFFS2_NOW();

    + mutex_lock(&f->sem);
    for (fd = f->dents ; fd; fd = fd->next) {
    - if (fd->ino)
    + if (fd->ino) {
    + mutex_unlock(&f->sem);
    return -ENOTEMPTY;
    + }
    }
    + mutex_unlock(&f->sem);

    ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name,
    dentry->d_name.len, f, now);
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-24 11:40    [W:4.942 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site