Messages in this thread |  | | From | 주형정 <> | | Date | Sun, 8 Mar 2026 17:44:27 +0900 | | Subject | [BUG] adfs: mount-time null-ptr-deref in range [0x10-0x17] in adfs_read_map() |
| |
Hello,
I am reporting a filesystem bug reproduced on current mainline with KASAN enabled.
Target file: fs/adfs/map.c Subsystem: fs/adfs Git head: 5ee8dbf54602dc340d6235b1d6aa17c0f283f48c Kernel release: 7.0.0-rc2+ Case ID: case-20260306T142346Z-30e0
Root cause: The boot-block mount path accepts a disc record with `nzones==0` because `adfs_validate_bblk()` only gates on `adfs_checkbblk()` and `adfs_checkdiscrecord()`, and `adfs_checkdiscrecord()` never enforces a nonzero zone count. `adfs_read_map()` then computes `nzones = dr->nzones | dr->nzones_high << 8`, calls `kmalloc_objs(*dm, nzones)` with zero, gets a `ZERO_SIZE_PTR` rather than `NULL`, and immediately passes it to `adfs_map_layout()`, which writes `dm[0]` and later `dm[nzones - 1]`, causing a mount-time kernel null/low-address dereference.
Observed crash: mount-time null-ptr-deref in range [0x0000000000000010-0x0000000000000017] in adfs_read_map()
KASAN excerpt: [ 144.659016][ T1] CPA protect Rodata RO: 0xff1100007364e000 - 0xff1100007364efff PFN 7364e req 8000000000000123 prevent 0000000000000002 [ 144.659565][ T1] CPA protect Rodata RO: 0xffffffffab64f000 - 0xffffffffab64ffff PFN 7364f req 8000000000000123 prevent 0000000000000002 [ 144.660563][ T1] CPA protect Rodata RO: 0xff1100007364f000 - 0xff1100007364ffff PFN 7364f req 8000000000000123 prevent 0000000000000002 [ 144.668921][ T1] Testing CPA: again [ 145.133922][ T1] debug: unmapping init [mem 0xffffffffa9396000-0xffffffffa93fffff] [ 145.136886][ T1] debug: unmapping init [mem 0xffffffffab650000-0xffffffffab7fffff] [ 157.130123][ T1] x86/mm: Checked W+X mappings: passed, no W+X pages found. [ 157.132907][ T1] rodata_test: all tests were successful [ 157.134666][ T1] Run /init as init process [kaudit] guest init start [kaudit] guest init start + '[' -x /poc/serial-mark ] + /poc/serial-mark '[kaudit] run.sh start\n' [kaudit] run.sh start\n[ 158.284872][ T145] serial-mark (145) used greatest stack depth: 8 bytes left + echo '[kaudit] trigger command: /poc/poc-bin' [kaudit] trigger command: /poc/poc-bin + /poc/poc-bin [ 158.729491][ T146] loop0: detected capacity change from 0 to 8 mounting /tmp/adfs-nzones0.img via /dev/loop0; expect crash in adfs_map_layout() [ 158.823801][ T146] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 158.824306][ T146] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 158.824306][ T146] CPU: 0 UID: 0 PID: 146 Comm: poc-bin Tainted: G W T 7.0.0-rc2+ #4 PREEMPT(lazy) f57869d565a4551be95743026afd79a1bf2712c7 [ 158.824306][ T146] Tainted: [W]=WARN, [T]=RANDSTRUCT [ 158.824306][ T146] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 158.824306][ T146] RIP: 0010:adfs_read_map+0x420/0xbc0 [ 158.824306][ T146] Code: 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 7f 05 00 00 0f b7 45 0a 48 8b 54 24 10 41 29 c7 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 44 89 7c 24 08 0f 85 12 07 00 00 48 8b 44 24 10 48 8d [ 158.824306][ T146] RSP: 0018:ffa00000014a7658 EFLAGS: 00000202 [ 158.824306][ T146] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 158.824306][ T146] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.824306][ T146] RBP: ff11000006345dc0 R08: 0000000000000000 R09: 0000000000000000 [ 158.824306][ T146] R10: 0000000000000000 R11: 0000000000000000 R12: ff11000004f04000 [ 158.824306][ T146] R13: ff11000006345dca R14: 0000000000000000 R15: 0000000000002000 [ 158.824306][ T146] FS: 00000000004ce3c0(0000) GS:ff110000ab608000(0000) knlGS:0000000000000000 [ 158.824306][ T146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 158.824306][ T146] CR2: 00000000004c91a0 CR3: 000000000b0af000 CR4: 00000000007516f0 [ 158.824306][ T146] PKRU: 55555554 [ 158.824306][ T146] Call Trace: [ 158.824306][ T146] <TASK> [ 158.824306][ T146] adfs_probe+0x3b7/0x540 [ 158.824306][ T146] ? __pfx_adfs_validate_bblk+0x40/0x40 [ 158.824306][ T146] ? __pfx_adfs_probe+0x40/0x40 [ 158.824306][ T146] ? shrinker_debugfs_rename+0x1bb/0x2c0 [ 158.824306][ T146] adfs_fill_super+0x179/0x640 [ 158.824306][ T146] ? __pfx_adfs_fill_super+0x40/0x40 [ 158.824306][ T146] ? kfree_const+0x5a/0x80 [ 158.824306][ T146] ? shrinker_debugfs_rename+0x1c0/0x2c0 [ 158.824306][ T146] ? __pfx_shrinker_debugfs_rename+0x40/0x40 [ 158.824306][ T146] ? __pfx_snprintf+0x40/0x40 [ 158.824306][ T146] ? tracer_preempt_on+0x44/0x5c0 [ 158.824306][ T146] ? _raw_spin_unlock+0x2d/0x80 [ 158.824306][ T146] ? set_blocksize+0x384/0x480 [ 158.824306][ T146] ? sb_set_blocksize+0x1b1/0x340 [ 158.824306][ T146] ? setup_bdev_super+0x431/0x900 [ 158.824306][ T146] ? __pfx_super_s_dev_set+0x40/0x40 [ 158.824306][ T146] get_tree_bdev_flags+0x3aa/0x680 [ 158.824306][ T146] ? __pfx_adfs_fill_super+0x40/0x40 [ 158.824306][ T146] ? __pfx_get_tree_bdev_flags+0x40/0x40 [ 158.824306][ T146] ? rcu_is_watching+0x12/0x100 [ 158.824306][ T146] ? cap_capable+0x142/0x380 [ 158.824306][ T146] vfs_get_tree+0x98/0x380 [ 158.824306][ T146] fc_mount+0x1f/0x240 [ 158.824306][ T146] do_new_mount+0x3d6/0x700 [ 158.824306][ T146] ? __pfx_do_new_mount+0x40/0x40 [ 158.824306][ T146] ? cap_capable+0x142/0x380 [ 158.824306][ T146] ? bpf_lsm_capable+0xe/0x40 [ 158.824306][ T146] ? security_capable+0x307/0x380 [ 158.824306][ T146] path_mount+0x4bb/0x1500 [ 158.824306][ T146] ? kmem_cache_free+0x169/0x7c0 [ 158.824306][ T146] ? putname+0xb9/0x140 [ 158.824306][ T146] ? __pfx_path_mount+0x40/0x40 [ 158.824306][ T146] ? putname+0xb9/0x140 [ 158.824306][ T146] __x64_sys_mount+0x2a8/0x340 [ 158.824306][ T146] ? __pfx___x64_sys_mount+0x40/0x40 [ 158.824306][ T146] ? tracer_hardirqs_on+0x3c9/0x5c0 [ 158.824306][ T146] ? do_syscall_64+0xa7/0x940 [ 158.824306][ T146] do_syscall_64+0x141/0x940 [ 158.824306][ T146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.824306][ T146] RIP: 0033:0x44a10e [ 158.824306][ T146] Code: 48 c7 c0 ff ff ff ff eb aa e8 0e 06 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 158.824306][ T146] RSP: 002b:00007fffa4a988c8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 158.824306][ T146] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000044a10e [ 158.824306][ T146] RDX: 00000000004980f6 RSI: 000000000049802d RDI: 00007fffa4a98970 [ 158.824306][ T146] RBP: 0000000000000003 R08: 00000000004af4bd R09: 746365707865203b [ 158.824306][ T146] R10: 0000000000000001 R11: 0000000000000202 R12: 00007fffa4a98970 [ 158.824306][ T146] R13: 000000000049806e R14: 00007fffa4a988e0 R15: 0000000000000004 [ 158.824306][ T146] </TASK> [ 158.824306][ T146] Modules linked in: [ 158.854456][ T146] ---[ end trace 0000000000000000 ]--- [ 158.855680][ T146] RIP: 0010:adfs_read_map+0x420/0xbc0 [ 158.856500][ T146] Code: 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 7f 05 00 00 0f b7 45 0a 48 8b 54 24 10 41 29 c7 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 44 89 7c 24 08 0f 85 12 07 00 00 48 8b 44 24 10 48 8d [ 158.857115][ T146] RSP: 0018:ffa00000014a7658 EFLAGS: 00000202 [ 158.857587][ T146] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 158.857962][ T146] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.858320][ T146] RBP: ff11000006345dc0 R08: 0000000000000000 R09: 0000000000000000 [ 158.858701][ T146] R10: 0000000000000000 R11: 0000000000000000 R12: ff11000004f04000 [ 158.859091][ T146] R13: ff11000006345dca R14: 0000000000000000 R15: 0000000000002000 [ 158.859473][ T146] FS: 00000000004ce3c0(0000) GS:ff110000ab608000(0000) knlGS:0000000000000000 [ 158.859883][ T146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 158.860567][ T146] CR2: 00000000004c91a0 CR3: 000000000b0af000 CR4: 00000000007516f0 [ 158.860946][ T146] PKRU: 55555554
|  |