diff options
| author | Jaegeuk Kim | 2018-12-27 04:54:07 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2019-01-09 17:38:46 +0100 |
| commit | 5036fcd9b14516f62efae6ed0c42dfbb9798b643 (patch) | |
| tree | fda08e93e2949ffda04d4a0d5aa89fe7cc5d78c0 /fs/f2fs/xattr.c | |
| parent | f2fs: fix validation of the block count in sanity_check_raw_super (diff) | |
| download | kernel-qcow2-linux-5036fcd9b14516f62efae6ed0c42dfbb9798b643.tar.gz kernel-qcow2-linux-5036fcd9b14516f62efae6ed0c42dfbb9798b643.tar.xz kernel-qcow2-linux-5036fcd9b14516f62efae6ed0c42dfbb9798b643.zip | |
f2fs: sanity check of xattr entry size
commit 64beba0558fce7b59e9a8a7afd77290e82a22163 upstream.
There is a security report where f2fs_getxattr() has a hole to expose wrong
memory region when the image is malformed like this.
f2fs_getxattr: entry->e_name_len: 4, size: 12288, buffer_size: 16384, len: 4
Cc: <stable@vger.kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/f2fs/xattr.c')
| -rw-r--r-- | fs/f2fs/xattr.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c index 77a010e625f5..087e53a2d96c 100644 --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -291,7 +291,7 @@ static int read_xattr_block(struct inode *inode, void *txattr_addr) static int lookup_all_xattrs(struct inode *inode, struct page *ipage, unsigned int index, unsigned int len, const char *name, struct f2fs_xattr_entry **xe, - void **base_addr) + void **base_addr, int *base_size) { void *cur_addr, *txattr_addr, *last_addr = NULL; nid_t xnid = F2FS_I(inode)->i_xattr_nid; @@ -302,8 +302,8 @@ static int lookup_all_xattrs(struct inode *inode, struct page *ipage, if (!size && !inline_size) return -ENODATA; - txattr_addr = f2fs_kzalloc(F2FS_I_SB(inode), - inline_size + size + XATTR_PADDING_SIZE, GFP_NOFS); + *base_size = inline_size + size + XATTR_PADDING_SIZE; + txattr_addr = f2fs_kzalloc(F2FS_I_SB(inode), *base_size, GFP_NOFS); if (!txattr_addr) return -ENOMEM; @@ -315,8 +315,10 @@ static int lookup_all_xattrs(struct inode *inode, struct page *ipage, *xe = __find_inline_xattr(inode, txattr_addr, &last_addr, index, len, name); - if (*xe) + if (*xe) { + *base_size = inline_size; goto check; + } } /* read from xattr node block */ @@ -477,6 +479,7 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name, int error = 0; unsigned int size, len; void *base_addr = NULL; + int base_size; if (name == NULL) return -EINVAL; @@ -487,7 +490,7 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name, down_read(&F2FS_I(inode)->i_xattr_sem); error = lookup_all_xattrs(inode, ipage, index, len, name, - &entry, &base_addr); + &entry, &base_addr, &base_size); up_read(&F2FS_I(inode)->i_xattr_sem); if (error) return error; @@ -501,6 +504,11 @@ int f2fs_getxattr(struct inode *inode, int index, const char *name, if (buffer) { char *pval = entry->e_name + entry->e_name_len; + + if (base_size - (pval - (char *)base_addr) < size) { + error = -ERANGE; + goto out; + } memcpy(buffer, pval, size); } error = size; |