From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFF9EC43387 for ; Mon, 7 Jan 2019 12:59:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C4C922089F for ; Mon, 7 Jan 2019 12:59:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1546865988; bh=XpfWEeSu3lEWuml9/FStMfS2vmcSWWwnXg8ZsgIIouQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=lRkTjxXe3H6D9fkKVQQUqmISrJDGuWfBJlU/KkCBZh2qcshvYzUgGKLCQNGDkZ7ol oV5oSGtR35sp/w2xGAIUabL6RsW1nAN2HxAqX2eVUX24au9Dt0vDza7a49euRBiLQ9 NPTD9mx7PGSer4cUQ2F5yArt3W5av0VrTK1/uAjg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730314AbfAGM7r (ORCPT ); Mon, 7 Jan 2019 07:59:47 -0500 Received: from mail.kernel.org ([198.145.29.99]:47286 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729173AbfAGM7o (ORCPT ); Mon, 7 Jan 2019 07:59:44 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4310E206BB; Mon, 7 Jan 2019 12:59:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1546865983; bh=XpfWEeSu3lEWuml9/FStMfS2vmcSWWwnXg8ZsgIIouQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DL61b6hOVxbGuo6LfV1S4uIQjNLsc5CilrfP2lQ27E//WXKGj+B9p1T3Ik9HUbKa4 f7Yc1/IhF4gDHyNl6mwmuquMGOT69X6iYSyUF/z12LrKcdSBAJUYRfEd/B6Ucam0lz 7juYFthalQGs82eLQ86zkKm4z17XbfEgwi+YV9ss= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jaegeuk Kim Subject: [PATCH 4.19 140/170] f2fs: sanity check of xattr entry size Date: Mon, 7 Jan 2019 13:32:47 +0100 Message-Id: <20190107104509.513223763@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190107104452.953560660@linuxfoundation.org> References: <20190107104452.953560660@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jaegeuk Kim commit 64beba0558fce7b59e9a8a7afd77290e82a22163 upstream. There is a security report where f2fs_getxattr() has a hole to expose wrong memory region when the image is malformed like this. f2fs_getxattr: entry->e_name_len: 4, size: 12288, buffer_size: 16384, len: 4 Cc: Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman --- fs/f2fs/xattr.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) --- a/fs/f2fs/xattr.c +++ b/fs/f2fs/xattr.c @@ -291,7 +291,7 @@ static int read_xattr_block(struct inode static int lookup_all_xattrs(struct inode *inode, struct page *ipage, unsigned int index, unsigned int len, const char *name, struct f2fs_xattr_entry **xe, - void **base_addr) + void **base_addr, int *base_size) { void *cur_addr, *txattr_addr, *last_addr = NULL; nid_t xnid = F2FS_I(inode)->i_xattr_nid; @@ -302,8 +302,8 @@ static int lookup_all_xattrs(struct inod if (!size && !inline_size) return -ENODATA; - txattr_addr = f2fs_kzalloc(F2FS_I_SB(inode), - inline_size + size + XATTR_PADDING_SIZE, GFP_NOFS); + *base_size = inline_size + size + XATTR_PADDING_SIZE; + txattr_addr = f2fs_kzalloc(F2FS_I_SB(inode), *base_size, GFP_NOFS); if (!txattr_addr) return -ENOMEM; @@ -315,8 +315,10 @@ static int lookup_all_xattrs(struct inod *xe = __find_inline_xattr(inode, txattr_addr, &last_addr, index, len, name); - if (*xe) + if (*xe) { + *base_size = inline_size; goto check; + } } /* read from xattr node block */ @@ -477,6 +479,7 @@ int f2fs_getxattr(struct inode *inode, i int error = 0; unsigned int size, len; void *base_addr = NULL; + int base_size; if (name == NULL) return -EINVAL; @@ -487,7 +490,7 @@ int f2fs_getxattr(struct inode *inode, i down_read(&F2FS_I(inode)->i_xattr_sem); error = lookup_all_xattrs(inode, ipage, index, len, name, - &entry, &base_addr); + &entry, &base_addr, &base_size); up_read(&F2FS_I(inode)->i_xattr_sem); if (error) return error; @@ -501,6 +504,11 @@ int f2fs_getxattr(struct inode *inode, i if (buffer) { char *pval = entry->e_name + entry->e_name_len; + + if (base_size - (pval - (char *)base_addr) < size) { + error = -ERANGE; + goto out; + } memcpy(buffer, pval, size); } error = size;