From: Greg Kroah-Hartman Date: Sat, 13 May 2023 09:28:08 +0000 (+0900) Subject: 5.15-stable patches X-Git-Tag: v4.14.315~70 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b6c0103a894b347c6e5b836a935f4eed76e099eb;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lookup.patch fs-ntfs3-refactoring-of-various-minor-issues.patch --- diff --git a/queue-5.15/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lookup.patch b/queue-5.15/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lookup.patch new file mode 100644 index 00000000000..439dd28f52b --- /dev/null +++ b/queue-5.15/fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lookup.patch @@ -0,0 +1,76 @@ +From 254e69f284d7270e0abdc023ee53b71401c3ba0c Mon Sep 17 00:00:00 2001 +From: ZhangPeng +Date: Fri, 25 Nov 2022 10:21:59 +0000 +Subject: fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() + +From: ZhangPeng + +commit 254e69f284d7270e0abdc023ee53b71401c3ba0c upstream. + +Syzbot reported a null-ptr-deref bug: + +ntfs3: loop0: Different NTFS' sector size (1024) and media sector size +(512) +ntfs3: loop0: Mark volume as dirty due to NTFS errors +general protection fault, probably for non-canonical address +0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +RIP: 0010:d_flags_for_inode fs/dcache.c:1980 [inline] +RIP: 0010:__d_add+0x5ce/0x800 fs/dcache.c:2796 +Call Trace: + + d_splice_alias+0x122/0x3b0 fs/dcache.c:3191 + lookup_open fs/namei.c:3391 [inline] + open_last_lookups fs/namei.c:3481 [inline] + path_openat+0x10e6/0x2df0 fs/namei.c:3688 + do_filp_open+0x264/0x4f0 fs/namei.c:3718 + do_sys_openat2+0x124/0x4e0 fs/open.c:1310 + do_sys_open fs/open.c:1326 [inline] + __do_sys_open fs/open.c:1334 [inline] + __se_sys_open fs/open.c:1330 [inline] + __x64_sys_open+0x221/0x270 fs/open.c:1330 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +If the MFT record of ntfs inode is not a base record, inode->i_op can be +NULL. And a null-ptr-deref may happen: + +ntfs_lookup() + dir_search_u() # inode->i_op is set to NULL + d_splice_alias() + __d_add() + d_flags_for_inode() # inode->i_op->get_link null-ptr-deref + +Fix this by adding a Check on inode->i_op before calling the +d_splice_alias() function. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Reported-by: syzbot+a8f26a403c169b7593fe@syzkaller.appspotmail.com +Signed-off-by: ZhangPeng +Signed-off-by: Konstantin Komarov +Cc: Rudi Heitbaum +Signed-off-by: Greg Kroah-Hartman +--- + fs/ntfs3/namei.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/fs/ntfs3/namei.c ++++ b/fs/ntfs3/namei.c +@@ -96,6 +96,16 @@ static struct dentry *ntfs_lookup(struct + inode = ERR_PTR(-EINVAL); + } + ++ /* ++ * Check for a null pointer ++ * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL. ++ * This causes null pointer dereference in d_splice_alias(). ++ */ ++ if (!IS_ERR(inode) && inode->i_op == NULL) { ++ iput(inode); ++ inode = ERR_PTR(-EINVAL); ++ } ++ + return d_splice_alias(inode, dentry); + } + diff --git a/queue-5.15/fs-ntfs3-refactoring-of-various-minor-issues.patch b/queue-5.15/fs-ntfs3-refactoring-of-various-minor-issues.patch new file mode 100644 index 00000000000..a898f5f1702 --- /dev/null +++ b/queue-5.15/fs-ntfs3-refactoring-of-various-minor-issues.patch @@ -0,0 +1,57 @@ +From 6827d50b2c430c329af442b64c9176d174f56521 Mon Sep 17 00:00:00 2001 +From: Konstantin Komarov +Date: Fri, 30 Dec 2022 14:58:25 +0400 +Subject: fs/ntfs3: Refactoring of various minor issues + +From: Konstantin Komarov + +commit 6827d50b2c430c329af442b64c9176d174f56521 upstream. + +Removed unused macro. +Changed null pointer checking. +Fixed inconsistent indenting. + +Signed-off-by: Konstantin Komarov +Cc: Rudi Heitbaum +Signed-off-by: Greg Kroah-Hartman +--- + fs/ntfs3/bitmap.c | 3 ++- + fs/ntfs3/namei.c | 2 +- + fs/ntfs3/ntfs.h | 3 --- + 3 files changed, 3 insertions(+), 5 deletions(-) + +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -666,7 +666,8 @@ int wnd_init(struct wnd_bitmap *wnd, str + if (!wnd->bits_last) + wnd->bits_last = wbits; + +- wnd->free_bits = kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS | __GFP_NOWARN); ++ wnd->free_bits = ++ kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS | __GFP_NOWARN); + if (!wnd->free_bits) + return -ENOMEM; + +--- a/fs/ntfs3/namei.c ++++ b/fs/ntfs3/namei.c +@@ -91,7 +91,7 @@ static struct dentry *ntfs_lookup(struct + * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL. + * This causes null pointer dereference in d_splice_alias(). + */ +- if (!IS_ERR(inode) && inode->i_op == NULL) { ++ if (!IS_ERR_OR_NULL(inode) && !inode->i_op) { + iput(inode); + inode = ERR_PTR(-EINVAL); + } +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -436,9 +436,6 @@ static inline u64 attr_svcn(const struct + return attr->non_res ? le64_to_cpu(attr->nres.svcn) : 0; + } + +-/* The size of resident attribute by its resident size. */ +-#define BYTES_PER_RESIDENT(b) (0x18 + (b)) +- + static_assert(sizeof(struct ATTRIB) == 0x48); + static_assert(sizeof(((struct ATTRIB *)NULL)->res) == 0x08); + static_assert(sizeof(((struct ATTRIB *)NULL)->nres) == 0x38); diff --git a/queue-5.15/series b/queue-5.15/series index 2a33e567ad3..bf20fbb9e23 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -96,3 +96,5 @@ drm-amdgpu-fix-vram-recover-doesn-t-work-after-whole-gpu-reset-v2.patch drm-amdgpu-disable-sdma-ecc-irq-only-when-sdma-ras-is-enabled-in-suspend.patch hid-wacom-set-a-default-resolution-for-older-tablets.patch hid-wacom-insert-timestamp-to-packed-bluetooth-bt-events.patch +fs-ntfs3-fix-null-ptr-deref-on-inode-i_op-in-ntfs_lookup.patch +fs-ntfs3-refactoring-of-various-minor-issues.patch