ping?
On 8/13/23 00:47, Shigeru Yoshida wrote:
> KASAN found the following issue:
>
> BUG: KASAN: use-after-free in memcmp+0x172/0x1c0
> Read of size 8 at addr ffff88802d88a002 by task repro/4557
>
> CPU: 0 PID: 4557 Comm: repro Not tainted 6.5.0-rc5-00296-gf8de32cc060b-dirty #20
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
> Call Trace:
> <TASK>
> dump_stack_lvl+0xd3/0x1b0
> print_report+0xc4/0x630
> ? __virt_addr_valid+0x5e/0x2d0
> ? __phys_addr+0xc6/0x140
> kasan_report+0xda/0x110
> ? memcmp+0x172/0x1c0
> ? memcmp+0x172/0x1c0
> memcmp+0x172/0x1c0
> ? __bread_gfp+0x79/0x310
> ntfs_fill_super+0x722/0x43a0
> ? put_ntfs+0x330/0x330
> ? vsprintf+0x30/0x30
> ? set_blocksize+0x2c0/0x360
> get_tree_bdev+0x43e/0x7d0
> ? put_ntfs+0x330/0x330
> vfs_get_tree+0x88/0x350
> path_mount+0x69f/0x1ec0
> ? kmem_cache_free+0xf0/0x4a0
> ? finish_automount+0xa50/0xa50
> ? putname+0x105/0x140
> __x64_sys_mount+0x293/0x310
> ? copy_mnt_ns+0xb60/0xb60
> ? syscall_enter_from_user_mode+0x26/0x80
> do_syscall_64+0x39/0xb0
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f2d6bf29eaa
> Code: 48 8b 0d 71 df 0a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 c8
> RSP: 002b:00007ffcf8924638 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 0000000000423e00 RCX: 00007f2d6bf29eaa
> RDX: 0000000020000080 RSI: 00000000200000c0 RDI: 00007ffcf8924770
> RBP: 00007ffcf8924800 R08: 00007ffcf8924670 R09: 0000000000000000
> R10: 0000000000000040 R11: 0000000000000202 R12: 00007ffcf8924978
> R13: 00007ffcf8924988 R14: 0000000000402c65 R15: 00007f2d6c014a60
> </TASK>
>
> dev_size variable is used to calculate the LBO of the alternative boot
> in ntfs_init_from_boot(). dev_size is set to the number of bytes of
> the device, but it can be modified when the NTFS sector size and the
> media sector size are different. So, using dev_size can cause the
> above issue in that case.
>
> This patch fixes this issue by resetting dev_size to the actual number
> of bytes of the device before calculating the LBO of the alternative
> boot.
>
> Fixes: 6a4cd3ea7d77 ("fs/ntfs3: Alternative boot if primary boot is corrupted")
> Signed-off-by: Shigeru Yoshida <syoshida@xxxxxxxxxx>
> ---
> fs/ntfs3/super.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
> index 1a02072b6b0e..43b698353840 100644
> --- a/fs/ntfs3/super.c
> +++ b/fs/ntfs3/super.c
> @@ -1067,7 +1067,10 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
> out:
> if (err == -EINVAL && !bh->b_blocknr && dev_size > PAGE_SHIFT) {
> u32 block_size = min_t(u32, sector_size, PAGE_SIZE);
> - u64 lbo = dev_size - sizeof(*boot);
> + u64 lbo;
> +
> + dev_size = bdev_nr_bytes(sb->s_bdev);
> + lbo = dev_size - sizeof(*boot);
>
> /*
> * Try alternative boot (last sector)
