From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08870C63697 for ; Thu, 26 Nov 2020 15:57:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B8FD121D40 for ; Thu, 26 Nov 2020 15:57:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391501AbgKZP56 (ORCPT ); Thu, 26 Nov 2020 10:57:58 -0500 Received: from mx2.suse.de ([195.135.220.15]:50036 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2391338AbgKZP55 (ORCPT ); Thu, 26 Nov 2020 10:57:57 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id A545CACD5; Thu, 26 Nov 2020 15:57:55 +0000 (UTC) Received: by quack2.suse.cz (Postfix, from userid 1000) id E4EED1E10D0; Thu, 26 Nov 2020 16:57:54 +0100 (CET) Date: Thu, 26 Nov 2020 16:57:54 +0100 From: Jan Kara To: Rustam Kovhaev Cc: alex.shi@linux.alibaba.com, jack@suse.cz, akpm@linux-foundation.org, yeyunfeng@huawei.com, reiserfs-devel@vger.kernel.org, linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org Subject: Re: [PATCH] reiserfs: add check for an invalid ih_entry_count Message-ID: <20201126155754.GK422@quack2.suse.cz> References: <20201101140958.3650143-1-rkovhaev@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20201101140958.3650143-1-rkovhaev@gmail.com> User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun 01-11-20 06:09:58, Rustam Kovhaev wrote: > when directory item has an invalid value set for ih_entry_count it might > trigger use-after-free or out-of-bounds read in bin_search_in_dir_item() > > ih_entry_count * IH_SIZE for directory item should not be larger than > ih_item_len > > Reported-and-tested-by: syzbot+83b6f7cf9922cae5c4d7@syzkaller.appspotmail.com > Link: https://syzkaller.appspot.com/bug?extid=83b6f7cf9922cae5c4d7 > Signed-off-by: Rustam Kovhaev Thanks! I've added the patch to my tree and will push it to Linus. Honza > --- > fs/reiserfs/stree.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c > index 8bf88d690729..476a7ff49482 100644 > --- a/fs/reiserfs/stree.c > +++ b/fs/reiserfs/stree.c > @@ -454,6 +454,12 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) > "(second one): %h", ih); > return 0; > } > + if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) { > + reiserfs_warning(NULL, "reiserfs-5093", > + "item entry count seems wrong %h", > + ih); > + return 0; > + } > prev_location = ih_location(ih); > } > > -- > 2.28.0 > -- Jan Kara SUSE Labs, CR