• Valentin Vidic's avatar
    ocfs2: mount fails with buffer overflow in strlen · b15fa922
    Valentin Vidic authored
    Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an
    ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the
    trace below.  Problem seems to be that strings for cluster stack and
    cluster name are not guaranteed to be null terminated in the disk
    representation, while strlcpy assumes that the source string is always
    null terminated.  This causes a read outside of the source string
    triggering the buffer overflow detection.
    
      detected buffer overflow in strlen
      ------------[ cut here ]------------
      kernel BUG at lib/string.c:1149!
      invalid opcode: 0000 [#1] SMP PTI
      CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1
        Debian 5.14.6-2
      RIP: 0010:fortify_panic+0xf/0x11
      ...
      Call Trace:
       ocfs2_initialize_super.isra.0.cold+0xc/0x18 [ocfs2]
       ocfs2_fill_super+0x359/0x19b0 [ocfs2]
       mount_bdev+0x185/0x1b0
       legacy_get_tree+0x27/0x40
       vfs_get_tree+0x25/0xb0
       path_mount+0x454/0xa20
       __x64_sys_mount+0x103/0x140
       do_syscall_64+0x3b/0xc0
       entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    Link: https://lkml.kernel.org/r/20210929180654.32460-1-vvidic@valentin-vidic.from.hrSigned-off-by: default avatarValentin Vidic <vvidic@valentin-vidic.from.hr>
    Reviewed-by: default avatarJoseph Qi <joseph.qi@linux.alibaba.com>
    Cc: Mark Fasheh <mark@fasheh.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Changwei Ge <gechangwei@live.cn>
    Cc: Gang He <ghe@suse.com>
    Cc: Jun Piao <piaojun@huawei.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    b15fa922
super.c 69.2 KB