|
Jiri Slaby |
df78f4 |
From: Kees Cook <keescook@chromium.org>
|
|
Jiri Slaby |
df78f4 |
Date: Wed, 4 Jan 2023 13:09:12 -0800
|
|
Jiri Slaby |
df78f4 |
Subject: [PATCH] ext4: Fix function prototype mismatch for ext4_feat_ktype
|
|
Jiri Slaby |
df78f4 |
References: bsc#1012628
|
|
Jiri Slaby |
df78f4 |
Patch-mainline: 6.2.1
|
|
Jiri Slaby |
df78f4 |
Git-commit: 118901ad1f25d2334255b3d50512fa20591531cd
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
commit 118901ad1f25d2334255b3d50512fa20591531cd upstream.
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
|
|
Jiri Slaby |
df78f4 |
indirect call targets are validated against the expected function
|
|
Jiri Slaby |
df78f4 |
pointer prototype to make sure the call target is valid to help mitigate
|
|
Jiri Slaby |
df78f4 |
ROP attacks. If they are not identical, there is a failure at run time,
|
|
Jiri Slaby |
df78f4 |
which manifests as either a kernel panic or thread getting killed.
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
ext4_feat_ktype was setting the "release" handler to "kfree", which
|
|
Jiri Slaby |
df78f4 |
doesn't have a matching function prototype. Add a simple wrapper
|
|
Jiri Slaby |
df78f4 |
with the correct prototype.
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
This was found as a result of Clang's new -Wcast-function-type-strict
|
|
Jiri Slaby |
df78f4 |
flag, which is more sensitive than the simpler -Wcast-function-type,
|
|
Jiri Slaby |
df78f4 |
which only checks for type width mismatches.
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
Note that this code is only reached when ext4 is a loadable module and
|
|
Jiri Slaby |
df78f4 |
it is being unloaded:
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698)
|
|
Jiri Slaby |
df78f4 |
...
|
|
Jiri Slaby |
df78f4 |
RIP: 0010:kobject_put+0xbb/0x1b0
|
|
Jiri Slaby |
df78f4 |
...
|
|
Jiri Slaby |
df78f4 |
Call Trace:
|
|
Jiri Slaby |
df78f4 |
<TASK>
|
|
Jiri Slaby |
df78f4 |
ext4_exit_sysfs+0x14/0x60 [ext4]
|
|
Jiri Slaby |
df78f4 |
cleanup_module+0x67/0xedb [ext4]
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
Fixes: b99fee58a20a ("ext4: create ext4_feat kobject dynamically")
|
|
Jiri Slaby |
df78f4 |
Cc: Theodore Ts'o <tytso@mit.edu>
|
|
Jiri Slaby |
df78f4 |
Cc: Eric Biggers <ebiggers@kernel.org>
|
|
Jiri Slaby |
df78f4 |
Cc: stable@vger.kernel.org
|
|
Jiri Slaby |
df78f4 |
Build-tested-by: Gustavo A. R. Silva <gustavoars@kernel.org>
|
|
Jiri Slaby |
df78f4 |
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
|
|
Jiri Slaby |
df78f4 |
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
|
|
Jiri Slaby |
df78f4 |
Link: https://lore.kernel.org/r/20230103234616.never.915-kees@kernel.org
|
|
Jiri Slaby |
df78f4 |
Signed-off-by: Kees Cook <keescook@chromium.org>
|
|
Jiri Slaby |
df78f4 |
Reviewed-by: Eric Biggers <ebiggers@google.com>
|
|
Jiri Slaby |
df78f4 |
Link: https://lore.kernel.org/r/20230104210908.gonna.388-kees@kernel.org
|
|
Jiri Slaby |
df78f4 |
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Jiri Slaby |
df78f4 |
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
|
|
Jiri Slaby |
df78f4 |
---
|
|
Jiri Slaby |
df78f4 |
fs/ext4/sysfs.c | 7 ++++++-
|
|
Jiri Slaby |
df78f4 |
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c
|
|
Jiri Slaby |
df78f4 |
index d233c24e..e2b8b343 100644
|
|
Jiri Slaby |
df78f4 |
--- a/fs/ext4/sysfs.c
|
|
Jiri Slaby |
df78f4 |
+++ b/fs/ext4/sysfs.c
|
|
Jiri Slaby |
df78f4 |
@@ -491,6 +491,11 @@ static void ext4_sb_release(struct kobject *kobj)
|
|
Jiri Slaby |
df78f4 |
complete(&sbi->s_kobj_unregister);
|
|
Jiri Slaby |
df78f4 |
}
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
+static void ext4_feat_release(struct kobject *kobj)
|
|
Jiri Slaby |
df78f4 |
+{
|
|
Jiri Slaby |
df78f4 |
+ kfree(kobj);
|
|
Jiri Slaby |
df78f4 |
+}
|
|
Jiri Slaby |
df78f4 |
+
|
|
Jiri Slaby |
df78f4 |
static const struct sysfs_ops ext4_attr_ops = {
|
|
Jiri Slaby |
df78f4 |
.show = ext4_attr_show,
|
|
Jiri Slaby |
df78f4 |
.store = ext4_attr_store,
|
|
Jiri Slaby |
df78f4 |
@@ -505,7 +510,7 @@ static struct kobj_type ext4_sb_ktype = {
|
|
Jiri Slaby |
df78f4 |
static struct kobj_type ext4_feat_ktype = {
|
|
Jiri Slaby |
df78f4 |
.default_groups = ext4_feat_groups,
|
|
Jiri Slaby |
df78f4 |
.sysfs_ops = &ext4_attr_ops,
|
|
Jiri Slaby |
df78f4 |
- .release = (void (*)(struct kobject *))kfree,
|
|
Jiri Slaby |
df78f4 |
+ .release = ext4_feat_release,
|
|
Jiri Slaby |
df78f4 |
};
|
|
Jiri Slaby |
df78f4 |
|
|
Jiri Slaby |
df78f4 |
void ext4_notify_error_sysfs(struct ext4_sb_info *sbi)
|
|
Jiri Slaby |
df78f4 |
--
|
|
Jiri Slaby |
df78f4 |
2.35.3
|
|
Jiri Slaby |
df78f4 |
|