Edward Lo c9db0ff046 fs/ntfs3: Return error for inconsistent extended attributes ... ntfs_read_ea is called when we want to read extended attributes. There are some sanity checks for the validity of the EAs. However, it fails to return a proper error code for the inconsistent attributes, which might lead to unpredicted memory accesses after return. [ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0 [ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199 [ 138.931132] [ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4 [ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 138.947327] Call Trace: [ 138.949557] <TASK> [ 138.951539] dump_stack_lvl+0x4d/0x67 [ 138.956834] print_report+0x16f/0x4a6 [ 138.960798] ? ntfs_set_ea+0x453/0xbf0 [ 138.964437] ? kasan_complete_mode_report_info+0x7d/0x200 [ 138.969793] ? ntfs_set_ea+0x453/0xbf0 [ 138.973523] kasan_report+0xb8/0x140 [ 138.976740] ? ntfs_set_ea+0x453/0xbf0 [ 138.980578] __asan_store4+0x76/0xa0 [ 138.984669] ntfs_set_ea+0x453/0xbf0 [ 138.988115] ? __pfx_ntfs_set_ea+0x10/0x10 [ 138.993390] ? kernel_text_address+0xd3/0xe0 [ 138.998270] ? __kernel_text_address+0x16/0x50 [ 139.002121] ? unwind_get_return_address+0x3e/0x60 [ 139.005659] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 139.010177] ? arch_stack_walk+0xa2/0x100 [ 139.013657] ? filter_irq_stacks+0x27/0x80 [ 139.017018] ntfs_setxattr+0x405/0x440 [ 139.022151] ? __pfx_ntfs_setxattr+0x10/0x10 [ 139.026569] ? kvmalloc_node+0x2d/0x120 [ 139.030329] ? kasan_save_stack+0x41/0x60 [ 139.033883] ? kasan_save_stack+0x2a/0x60 [ 139.037338] ? kasan_set_track+0x29/0x40 [ 139.040163] ? kasan_save_alloc_info+0x1f/0x30 [ 139.043588] ? __kasan_kmalloc+0x8b/0xa0 [ 139.047255] ? __kmalloc_node+0x68/0x150 [ 139.051264] ? kvmalloc_node+0x2d/0x120 [ 139.055301] ? vmemdup_user+0x2b/0xa0 [ 139.058584] __vfs_setxattr+0x121/0x170 [ 139.062617] ? __pfx___vfs_setxattr+0x10/0x10 [ 139.066282] __vfs_setxattr_noperm+0x97/0x300 [ 139.070061] __vfs_setxattr_locked+0x145/0x170 [ 139.073580] vfs_setxattr+0x137/0x2a0 [ 139.076641] ? __pfx_vfs_setxattr+0x10/0x10 [ 139.080223] ? __kasan_check_write+0x18/0x20 [ 139.084234] do_setxattr+0xce/0x150 [ 139.087768] setxattr+0x126/0x140 [ 139.091250] ? __pfx_setxattr+0x10/0x10 [ 139.094948] ? __virt_addr_valid+0xcb/0x140 [ 139.097838] ? __call_rcu_common.constprop.0+0x1c7/0x330 [ 139.102688] ? debug_smp_processor_id+0x1b/0x30 [ 139.105985] ? kasan_quarantine_put+0x5b/0x190 [ 139.109980] ? putname+0x84/0xa0 [ 139.113886] ? __kasan_slab_free+0x11e/0x1b0 [ 139.117961] ? putname+0x84/0xa0 [ 139.121316] ? preempt_count_sub+0x1c/0xd0 [ 139.124427] ? __mnt_want_write+0xae/0x100 [ 139.127836] ? mnt_want_write+0x8f/0x150 [ 139.130954] path_setxattr+0x164/0x180 [ 139.133998] ? __pfx_path_setxattr+0x10/0x10 [ 139.137853] ? __pfx_ksys_pwrite64+0x10/0x10 [ 139.141299] ? debug_smp_processor_id+0x1b/0x30 [ 139.145714] ? fpregs_assert_state_consistent+0x6b/0x80 [ 139.150796] __x64_sys_setxattr+0x71/0x90 [ 139.155407] do_syscall_64+0x3f/0x90 [ 139.159035] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 139.163843] RIP: 0033:0x7f108cae4469 [ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 [ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc [ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469 [ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6 [ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618 [ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0 [ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15: 0000000000000000 Signed-off-by: Edward Lo <loyuantsung@gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>		2023-07-03 00:21:22 +04:00
..
9p	Including fixes from netfilter.	2023-05-05 19:12:01 -07:00
adfs	fs: port ->setattr() to pass mnt_idmap	2023-01-19 09:24:02 +01:00
affs	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
afs	afs: Fix waiting for writeback then skipping folio	2023-06-19 14:30:58 +01:00
autofs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
befs	befs: Convert befs_symlink_read_folio() to use a folio	2022-08-02 12:34:03 -04:00
bfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
btrfs	for-6.4-rc7-tag	2023-06-23 16:09:53 -07:00
cachefiles	fs/cachefiles: simplify one-level sysctl registration for cachefiles_sysctls	2023-04-13 11:49:35 -07:00
ceph	ceph: fix use-after-free bug for inodes when flushing capsnaps	2023-06-08 08:56:25 +02:00
coda	sysctl-6.4-rc1	2023-04-27 16:52:33 -07:00
configfs	fs: consolidate duplicate dt_type helpers	2023-04-03 09:23:54 +02:00
cramfs	fs/cramfs/inode.c: initialize file_ra_state	2023-03-02 21:54:23 -08:00
crypto	fscrypt: optimize fscrypt_initialize()	2023-04-06 11:16:39 -07:00
debugfs	ARM: SoC drivers for 6.3	2023-02-27 10:04:49 -08:00
devpts	devpts: simplify two-level sysctl registration for pty_kern_table	2023-03-13 12:36:34 +01:00
dlm	Networking changes for 6.4.	2023-04-26 16:07:23 -07:00
ecryptfs	fs: drop unused posix acl handlers	2023-03-06 09:57:12 +01:00
efivarfs	A healthy mix of EFI contributions this time:	2023-02-23 14:41:48 -08:00
efs
erofs	erofs: use HIPRI by default if per-cpu kthreads are enabled	2023-05-23 16:57:08 +08:00
exfat	Description for this pull request:	2023-03-01 08:42:27 -08:00
exportfs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
ext2	\n	2023-04-26 09:07:46 -07:00
ext4	ext4: drop the call to ext4_error() from ext4_get_group_info()	2023-06-14 22:24:05 -04:00
f2fs	f2fs update for 6.4-rc1	2023-04-26 09:42:10 -07:00
fat	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
freevxfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
fscache	fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()	2023-01-30 12:51:54 +00:00
fuse	Driver core changes for 6.4-rc1	2023-04-27 11:53:57 -07:00
gfs2	gfs2: Don't get stuck writing page onto itself under direct I/O	2023-06-01 14:55:43 +02:00
hfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
hfsplus	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()	2023-04-12 11:29:32 +02:00
hostfs	um: hostfs: define our own API boundary	2023-04-20 23:04:40 +02:00
hpfs	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
hugetlbfs	mm: move 'mmap_min_addr' logic from callers into vm_unmapped_area()	2023-04-21 14:52:05 -07:00
iomap	New code for 6.4:	2023-04-29 10:35:48 -07:00
isofs	- hfs and hfsplus kmap API modernization from Fabio Francesco	2022-10-12 11:00:22 -07:00
jbd2	jdb2: Don't refuse invalidation of already invalidated buffers	2023-04-14 19:38:50 -04:00
jffs2	fs: rename generic posix acl handlers	2023-03-06 09:57:13 +01:00
jfs	write_one_page series	2023-04-24 19:20:27 -07:00
kernfs	Driver core changes for 6.4-rc1	2023-04-27 11:53:57 -07:00
lockd	nfsd-6.4 fixes:	2023-05-17 09:56:01 -07:00
minix	Merge branch 'work.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2023-02-24 19:01:15 -08:00
netfs	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
nfs	NFSv4.2: Fix a potential double free with READ_PLUS	2023-05-19 17:11:59 -04:00
nfs_common	NFSv4.2: remove MODULE_LICENSE in non-modules	2023-04-13 13:13:52 -07:00
nfsd	nfsd-6.4 fixes:	2023-06-02 13:38:55 -04:00
nilfs2	nilfs2: prevent general protection fault in nilfs_clear_dirty_page()	2023-06-19 13:19:35 -07:00
nls
notify	inotify: Avoid reporting event with invalid wd	2023-04-25 12:36:55 +02:00
ntfs	ntfs: simplfy one-level sysctl registration for ntfs_sysctls	2023-04-13 11:49:35 -07:00
ntfs3	fs/ntfs3: Return error for inconsistent extended attributes	2023-07-03 00:21:22 +04:00
ocfs2	ocfs2: check new file size on fallocate call	2023-06-12 11:31:52 -07:00
omfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
openpromfs
orangefs	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
overlayfs	ovl: check for ->listxattr() support	2023-03-06 09:57:13 +01:00
proc	sysctl: remove register_sysctl_paths()	2023-05-02 19:24:16 -07:00
pstore	pstore update for v6.4-rc1	2023-04-27 17:03:40 -07:00
qnx4	qnx4: credit contributors in CREDITS	2023-03-14 12:56:30 -06:00
qnx6	qnx6: credit contributor and mark filesystem orphan	2023-03-14 12:56:30 -06:00
quota	quota: mark PRINT_QUOTA_WARNING as BROKEN	2023-04-14 13:06:50 +02:00
ramfs	mm, treewide: redefine MAX_ORDER sanely	2023-04-05 19:42:46 -07:00
reiserfs	\n	2023-04-26 09:07:46 -07:00
romfs	mm/nommu: factor out check for NOMMU shared mappings into is_nommu_shared_mapping()	2023-01-18 17:12:56 -08:00
smb	four smb3 server fixes, all also for stable	2023-06-20 11:50:40 -07:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-03 17:52:25 -08:00
sysfs
sysv	sysv: switch to put_and_unmap_page()	2023-03-12 20:03:41 -04:00
tracefs	fs: port ->mkdir() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
ubifs	ubifs: Fix memleak when insert_old_idx() failed	2023-04-23 23:36:38 +02:00
udf	udf: use wrapper i_blocksize() in udf_discard_prealloc()	2023-03-13 11:16:16 +01:00
ufs	ufs: don't flush page immediately for DIRSYNC directories	2023-03-28 16:20:14 -07:00
unicode	unicode: remove MODULE_LICENSE in non-modules	2023-04-13 13:13:54 -07:00
vboxsf	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
verity	fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds	2023-04-11 19:23:23 -07:00
xfs	xfs: collect errors from inodegc for unlinked inode recovery	2023-06-05 14:48:15 +10:00
zonefs	zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space	2023-03-30 20:56:02 +09:00
aio.c	Merge branch 'mm-hotfixes-stable' into mm-stable	2023-02-10 15:34:48 -08:00
anon_inodes.c	dynamic_dname(): drop unused dentry argument	2022-08-20 11:34:04 -04:00
attr.c	nfs: use vfs setgid helper	2023-03-30 08:51:48 +02:00
bad_inode.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
binfmt_elf_fdpic.c	ELF: fix all "Elf" typos	2023-04-08 13:45:37 -07:00
binfmt_elf_test.c
binfmt_elf.c	Mainly singleton patches all over the place. Series of note are:	2023-04-27 19:57:00 -07:00
binfmt_flat.c
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2022-12-02 13:57:04 -08:00
binfmt_script.c
buffer.c	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2022-12-02 17:48:59 +01:00
compat_binfmt_elf.c
coredump.c	fork, vhost: Use CLONE_THREAD to fix freezer/ps regression	2023-06-01 17:15:33 -04:00
d_path.c	d_path.c: typo fix...	2022-08-20 11:34:33 -04:00
dax.c	fsdax: force clear dirty mark if CoW	2023-04-05 18:06:23 -07:00
dcache.c	tmpfile API change	2022-10-10 19:45:17 -07:00
direct-io.c	__blockdev_direct_IO(): get rid of submit_io callback	2023-03-05 20:27:41 -05:00
drop_caches.c
eventfd.c	eventfd: use wait_event_interruptible_locked_irq() helper	2023-04-06 10:01:50 +02:00
eventpoll.c	epoll: ep_autoremove_wake_function should use list_del_init_careful	2023-06-12 11:31:52 -07:00
exec.c	tracing updates for 6.4:	2023-04-28 15:57:53 -07:00
fcntl.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
fhandle.c	do_sys_name_to_handle(): constify path	2022-09-01 17:36:39 -04:00
file_table.c	filelock: move file locking definitions to separate header file	2023-01-11 06:52:32 -05:00
file.c	fs: prevent out-of-bounds array speculation when closing a file descriptor	2023-03-09 22:46:21 -05:00
filesystems.c
fs_context.c
fs_parser.c	ext4: journal_path mount options should follow links	2022-12-01 10:46:54 -05:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	for-6.4/block-2023-05-06	2023-05-06 08:28:58 -07:00
fsopen.c
init.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
inode.c	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
internal.h	five ksmbd server fixes, and new lock_rename_child VFS helper routine	2023-04-29 11:10:39 -07:00
ioctl.c	fs: port inode_owner_or_capable() to mnt_idmap	2023-01-19 09:24:29 +01:00
Kconfig	smb: move client and server files to common directory fs/smb	2023-05-24 16:29:21 -05:00
Kconfig.binfmt	Xtensa updates for v6.1	2022-10-10 14:21:11 -07:00
kernel_read_file.c
libfs.c	fs: consolidate duplicate dt_type helpers	2023-04-03 09:23:54 +02:00
locks.c	filelocks: use mount idmapping for setlease permission check	2023-03-09 22:36:12 +01:00
Makefile	smb: move client and server files to common directory fs/smb	2023-05-24 16:29:21 -05:00
mbcache.c	ext4: fix deadlock due to mbcache entry corruption	2022-12-08 21:49:25 -05:00
mnt_idmapping.c	fs: move mnt_idmap	2023-01-19 09:24:30 +01:00
mount.h
mpage.c	mpage: use folios in bio end_io handler	2023-04-18 16:30:02 -07:00
namei.c	five ksmbd server fixes, and new lock_rename_child VFS helper routine	2023-04-29 11:10:39 -07:00
namespace.c	fget() to fdget() conversions	2023-04-24 19:14:20 -07:00
no-block.c
nsfs.c	kill the last remaining user of proc_ns_fget()	2023-04-20 22:55:35 -04:00
open.c	open: return EINVAL for O_DIRECTORY | O_CREAT	2023-03-22 11:06:55 +01:00
pipe.c	pipe: check for IOCB_NOWAIT alongside O_NONBLOCK	2023-05-12 17:17:27 +02:00
pnode.c	pnode: pass mountpoint directly	2023-04-06 14:53:38 +02:00
pnode.h
posix_acl.c	acl: don't depend on IOP_XATTR	2023-03-06 09:59:20 +01:00
proc_namespace.c
read_write.c	iov_iter: add iter_iov_addr() and iter_iov_len() helpers	2023-03-30 08:12:29 -06:00
readdir.c	Change calling conventions for filldir_t	2022-08-17 17:25:04 -04:00
remap_range.c	fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap	2023-01-19 09:24:29 +01:00
select.c
seq_file.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
signalfd.c
splice.c	pipe-nonblock-2023-05-06	2023-05-06 08:15:20 -07:00
stack.c
stat.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
statfs.c	statfs: enforce statfs[64] structure initialization	2023-05-17 15:20:17 +02:00
super.c	Revert "mm: shrinkers: convert shrinker_rwsem to mutex"	2023-06-19 13:19:33 -07:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c	mm/uffd: allow vma to merge as much as possible	2023-06-12 11:31:50 -07:00
utimes.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
xattr.c	fs: don't call posix_acl_listxattr in generic_listxattr	2023-05-17 15:25:20 +02:00