In the Linux kernel, the following vulnerability has been resolved:
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2xaremove()
Syzkaller is able to provoke null-ptr-dereference in ocfs2xaremove():
[ 57.319872] (a.out,1161,7):ocfs2xaremove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2xacleanupvaluetruncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2xablockwipenamevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? douseraddrfault+0x3e5/0x740 [ 57.333778] ? excpagefault+0x70/0x170 [ 57.334016] ? asmexcpagefault+0x2b/0x30 [ 57.334263] ? _pfxocfs2xablockwipenamevalue+0x10/0x10 [ 57.334596] ? ocfs2xablockwipenamevalue+0x2a/0xc0 [ 57.334913] ocfs2xaremoveentry+0x23/0xc0 [ 57.335164] ocfs2xaset+0x704/0xcf0 [ 57.335381] ? _rawspinunlock+0x1a/0x40 [ 57.335620] ? ocfs2inodecacheunlock+0x16/0x20 [ 57.335915] ? tracepreempton+0x1e/0x70 [ 57.336153] ? startthishandle+0x16c/0x500 [ 57.336410] ? preemptcountsub+0x50/0x80 [ 57.336656] ? rawreadunlock+0x20/0x40 [ 57.336906] ? startthishandle+0x16c/0x500 [ 57.337162] ocfs2xattrblockset+0xa6/0x1e0 [ 57.337424] _ocfs2xattrsethandle+0x1fd/0x5d0 [ 57.337706] ? ocfs2starttrans+0x13d/0x290 [ 57.337971] ocfs2xattrset+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2xattrtrustedset+0x28/0x30 [ 57.338665] ? ocfs2xattrtrustedset+0x28/0x30 [ 57.338948] _vfsremovexattr+0x92/0xc0 [ 57.339182] _vfsremovexattrlocked+0xd5/0x190 [ 57.339456] ? preemptcountsub+0x50/0x80 [ 57.339705] vfsremovexattr+0x5f/0x100 [...]
Reproducer uses faultinject facility to fail ocfs2xaremove() -> ocfs2xavalue_truncate() with -ENOMEM.
In this case the comment mentions that we can return 0 if ocfs2xacleanupvaluetruncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2xaremoveentry(loc);' twice: * 1st: in ocfs2xacleanupvaluetruncate(); * 2nd: returning back to ocfs2xa_remove() instead of going to 'out'.
Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy.
[ { "signature_type": "Line", "id": "CVE-2024-50265-0ffae0e6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd73c942eed76a014c7a5597e6926435274d2c4c", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50265-1537a0e6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86dd0e8d42828923c68ad506933336bcd6f2317d", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50265-25033b0e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@168a9b8303fcb0317db4c06b23ce1c0ce2af4e10", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-25c9a8ea", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a7e6dcf90fe7721d0863067b6ca9a9442134692", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50265-28188591", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b63c0e01fba40e3992bc627272ec7b618ccaef7", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-28c25fbf", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b63c0e01fba40e3992bc627272ec7b618ccaef7", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-3ab22315", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38cbf13b2e7a31362babe411f7c2c3c52cd2734b", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-69018056", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86dd0e8d42828923c68ad506933336bcd6f2317d", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50265-6d2b4776", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38cbf13b2e7a31362babe411f7c2c3c52cd2734b", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50265-738109e5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b5369528ee63c88371816178a05b5e664c87386", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50265-884c4bc6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a7e6dcf90fe7721d0863067b6ca9a9442134692", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-98f100fc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc8fe8c83145041cb6c80cac21f6173a3ff0204", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-b06fb7b8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd73c942eed76a014c7a5597e6926435274d2c4c", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50265-c87bdb08", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcc8fe8c83145041cb6c80cac21f6173a3ff0204", "signature_version": "v1", "target": { "file": "fs/ocfs2/xattr.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "207576984413466283687928734971938909982", "136205504850217300168841519084863839178", "332441983760337781765317294625826662929", "201300620669975069009795169815770603279", "133683487843214940528204188395997709897" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-e240cb38", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@168a9b8303fcb0317db4c06b23ce1c0ce2af4e10", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50265-f46b0901", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b5369528ee63c88371816178a05b5e664c87386", "signature_version": "v1", "target": { "function": "ocfs2_xa_remove", "file": "fs/ocfs2/xattr.c" }, "digest": { "function_hash": "45817478526100974772922297742691069423", "length": 385.0 }, "deprecated": false } ]