All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jan Kara <jack@suse.cz>
To: Cong Wang <amwang@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	Jan Kara <jack@suse.cz>,
	linux-kernel@vger.kernel.org, xfs@oss.sgi.com
Subject: Re: [Patch] quota: do not leak info to user-space
Date: Mon, 13 May 2013 12:04:23 +0200	[thread overview]
Message-ID: <20130513100423.GD400@quack.suse.cz> (raw)
In-Reply-To: <1368177873-4819-1-git-send-email-amwang@redhat.com>

On Fri 10-05-13 17:24:33, Cong Wang wrote:
> From: Cong Wang <amwang@redhat.com>
> 
> There is a hole in struct fs_quota_stat, so we have to
> zero the struct on stack before copying it to user-space.
> 
> Cc: Jan Kara <jack@suse.cz>
> Signed-off-by: Cong Wang <amwang@redhat.com>
  Good point. I've merged the patch.

BTW for XFS folks: The structure definition looks somewhat odd (unaligned
definition of qs_flags, qs_uquota starts only at 32-bit boundary although
it has 64-bit fields in it) and I wouldn't be surprised if it needed compat
wrapper for 32-bit apps on some architectures...

								Honza
> 
> ---
> diff --git a/fs/quota/quota.c b/fs/quota/quota.c
> index c7314f1..2b0c182 100644
> --- a/fs/quota/quota.c
> +++ b/fs/quota/quota.c
> @@ -211,6 +211,7 @@ static int quota_getxstate(struct super_block *sb, void __user *addr)
>  
>  	if (!sb->s_qcop->get_xstate)
>  		return -ENOSYS;
> +	memset(&fqs, 0, sizeof(fqs));
>  	ret = sb->s_qcop->get_xstate(sb, &fqs);
>  	if (!ret && copy_to_user(addr, &fqs, sizeof(fqs)))
>  		return -EFAULT;
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

WARNING: multiple messages have this Message-ID (diff)
From: Jan Kara <jack@suse.cz>
To: Cong Wang <amwang@redhat.com>
Cc: linux-kernel@vger.kernel.org,
	Andrew Morton <akpm@linux-foundation.org>,
	Jan Kara <jack@suse.cz>,
	xfs@oss.sgi.com
Subject: Re: [Patch] quota: do not leak info to user-space
Date: Mon, 13 May 2013 12:04:23 +0200	[thread overview]
Message-ID: <20130513100423.GD400@quack.suse.cz> (raw)
In-Reply-To: <1368177873-4819-1-git-send-email-amwang@redhat.com>

On Fri 10-05-13 17:24:33, Cong Wang wrote:
> From: Cong Wang <amwang@redhat.com>
> 
> There is a hole in struct fs_quota_stat, so we have to
> zero the struct on stack before copying it to user-space.
> 
> Cc: Jan Kara <jack@suse.cz>
> Signed-off-by: Cong Wang <amwang@redhat.com>
  Good point. I've merged the patch.

BTW for XFS folks: The structure definition looks somewhat odd (unaligned
definition of qs_flags, qs_uquota starts only at 32-bit boundary although
it has 64-bit fields in it) and I wouldn't be surprised if it needed compat
wrapper for 32-bit apps on some architectures...

								Honza
> 
> ---
> diff --git a/fs/quota/quota.c b/fs/quota/quota.c
> index c7314f1..2b0c182 100644
> --- a/fs/quota/quota.c
> +++ b/fs/quota/quota.c
> @@ -211,6 +211,7 @@ static int quota_getxstate(struct super_block *sb, void __user *addr)
>  
>  	if (!sb->s_qcop->get_xstate)
>  		return -ENOSYS;
> +	memset(&fqs, 0, sizeof(fqs));
>  	ret = sb->s_qcop->get_xstate(sb, &fqs);
>  	if (!ret && copy_to_user(addr, &fqs, sizeof(fqs)))
>  		return -EFAULT;
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR

  reply	other threads:[~2013-05-13 10:04 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-05-10  9:24 [Patch] quota: do not leak info to user-space Cong Wang
2013-05-13 10:04 ` Jan Kara [this message]
2013-05-13 10:04   ` Jan Kara
2013-05-13 10:18   ` Jan Kara
2013-05-13 10:18     ` Jan Kara
2013-05-14  5:33     ` Cong Wang
2013-05-14  5:33       ` Cong Wang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130513100423.GD400@quack.suse.cz \
    --to=jack@suse.cz \
    --cc=akpm@linux-foundation.org \
    --cc=amwang@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=xfs@oss.sgi.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.