[Bug 199183] Invalid pointer dereference in ext4_xattr_inode_hash when mounting and later operating on a crafted image

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.kernel.org/show_bug.cgi?id=199183

--- Comment #3 from Wen Xu (wen.xu@xxxxxxxxxx) ---
Sorry, it was my mistake. 

After debugging the kernel again, I found that it crashes here:
https://elixir.bootlin.com/linux/v4.15/source/fs/ext4/ext4.h#L2005

static inline u32 ext4_chksum(struct ext4_sb_info *sbi, u32 crc,
                              const void *address, unsigned int length)
{
        struct {
                struct shash_desc shash;
                char ctx[4];
        } desc;
        int err;

        BUG_ON(crypto_shash_descsize(sbi->s_chksum_driver)!=sizeof(desc.ctx));
<-

sbi->s_chksum_driver may not always be set up and can be NULL, while 

static inline unsigned int crypto_shash_descsize(struct crypto_shash *tfm)
{
        return tfm->descsize;
}

the function crypto_shash_descsize() directly dereferences the pointer. 

By the way, I reproduce it on Linux 4.15.0-12-generic used by latest Ubuntu
18.04.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.



[Index of Archives]     [Reiser Filesystem Development]     [Ceph FS]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Linux FS]     [Yosemite National Park]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Device Mapper]     [Linux Media]

  Powered by Linux