Re: [syzbot] [udf?] KMSAN: uninit-value in udf_update_tag

[Jan Kara <jack@suse.cz>]

[-- Attachment #1: Type: text/plain, Size: 2622 bytes --]

On Thu 28-12-23 02:34:28, syzbot wrote:
> syzbot found the following issue on:
> 
> HEAD commit:    861deac3b092 Linux 6.7-rc7
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=16e0171ae80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=e0c7078a6b901aa3
> dashboard link: https://syzkaller.appspot.com/bug?extid=d31185aa54170f7fc1f5
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17561579e80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1277e7a5e80000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/0ea60ee8ed32/disk-861deac3.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/6d69fdc33021/vmlinux-861deac3.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/f0158750d452/bzImage-861deac3.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/f35551f8a991/mount_0.gz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d31185aa54170f7fc1f5@syzkaller.appspotmail.com
> 
> =======================================================
> UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
> =====================================================
> BUG: KMSAN: uninit-value in crc_itu_t_byte include/linux/crc-itu-t.h:22 [inline]
> BUG: KMSAN: uninit-value in crc_itu_t+0x287/0x2e0 lib/crc-itu-t.c:60
>  crc_itu_t_byte include/linux/crc-itu-t.h:22 [inline]
>  crc_itu_t+0x287/0x2e0 lib/crc-itu-t.c:60
>  udf_update_tag+0x5c/0x2a0 fs/udf/misc.c:261
>  udf_rename+0x13dd/0x16a0 fs/udf/namei.c:877
>  vfs_rename+0x1a79/0x1fa0 fs/namei.c:4844
>  do_renameat2+0x1571/0x1ca0 fs/namei.c:4996
>  __do_sys_rename fs/namei.c:5042 [inline]
>  __se_sys_rename fs/namei.c:5040 [inline]
>  __x64_sys_rename+0xec/0x140 fs/namei.c:5040
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>  do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
>  entry_SYSCALL_64_after_hwframe+0x63/0x6b
> 
> Local variable diriter created at:
>  udf_rename+0xbb/0x16a0 fs/udf/namei.c:768
>  vfs_rename+0x1a79/0x1fa0 fs/namei.c:4844
> 
> CPU: 0 PID: 5011 Comm: syz-executor409 Not tainted 6.7.0-rc7-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
> =====================================================
> 

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 6ba59ff4227927d3a8530fc2973b80e94b54d58f

									Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

[-- Attachment #2: 0001-udf-Fix-bogus-checksum-computation-in-udf_rename.patch --]
[-- Type: text/x-patch, Size: 1646 bytes --]

From 1657db149c4c596cf1b2451b73f72db94b612800 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Mon, 17 Jun 2024 12:57:50 +0200
Subject: [PATCH] udf: Fix bogus checksum computation in udf_rename()

Syzbot reports uninitialized memory access in udf_rename() when updating
checksum of '..' directory entry of a moved directory. This is indeed
true as we pass on-stack diriter.fi to the udf_update_tag() and because
that has only struct fileIdentDesc included in it and not the impUse or
name fields, the checksumming function is going to checksum random stack
contents beyond the end of the structure. This is actually harmless
because the following udf_fiiter_write_fi() will recompute the checksum
from on-disk buffers where everything is properly included. So all that
is needed is just removing the bogus calculation.

Fixes: e9109a92d2a9 ("udf: Convert udf_rename() to new directory iteration code")
Link: https://lore.kernel.org/all/000000000000cf405f060d8f75a9@google.com/T/
Reported-by: syzbot+d31185aa54170f7fc1f5@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/udf/namei.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index 1308109fd42d..78a603129dd5 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -876,8 +876,6 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir,
 	if (has_diriter) {
 		diriter.fi.icb.extLocation =
 					cpu_to_lelb(UDF_I(new_dir)->i_location);
-		udf_update_tag((char *)&diriter.fi,
-			       udf_dir_entry_len(&diriter.fi));
 		udf_fiiter_write_fi(&diriter, NULL);
 		udf_fiiter_release(&diriter);
 	}
-- 
2.35.3