+ ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch added to mm-nonmm-unstable branch

+ ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch added to mm-nonmm-unstable branch

[Andrew Morton]

The patch titled
     Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: Ferry Meng <mengferry@linux.alibaba.com>
Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
Date: Mon, 20 May 2024 10:40:24 +0800

xattr in ocfs2 maybe 'non-indexed', which saved with additional space
requested.  It's better to check if the memory is out of bound before
memcmp, although this possibility mainly comes from crafted poisonous
images.

Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.com
Signed-off-by: Ferry Meng <mengferry@linux.alibaba.com>
Signed-off-by-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reported-by: lei lu <llfamsec@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/xattr.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/fs/ocfs2/xattr.c~ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry
+++ a/fs/ocfs2/xattr.c
@@ -1068,7 +1068,7 @@ static int ocfs2_xattr_find_entry(struct
 {
 	struct ocfs2_xattr_entry *entry;
 	size_t name_len;
-	int i, cmp = 1;
+	int i, name_offset, cmp = 1;
 
 	if (name == NULL)
 		return -EINVAL;
@@ -1083,10 +1083,15 @@ static int ocfs2_xattr_find_entry(struct
 		cmp = name_index - ocfs2_xattr_get_type(entry);
 		if (!cmp)
 			cmp = name_len - entry->xe_name_len;
-		if (!cmp)
-			cmp = memcmp(name, (xs->base +
-				     le16_to_cpu(entry->xe_name_offset)),
-				     name_len);
+		if (!cmp) {
+			name_offset = le16_to_cpu(entry->xe_name_offset);
+			if ((xs->base + name_offset + name_len) > xs->end) {
+				ocfs2_error(inode->i_sb,
+					    "corrupted xattr entries");
+				return -EFSCORRUPTED;
+			}
+			cmp = memcmp(name, (xs->base + name_offset), name_len);
+		}
 		if (cmp == 0)
 			break;
 		entry += 1;
_

Patches currently in -mm which might be from mengferry@linux.alibaba.com are

ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch
ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch

Re: + ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch added to mm-nonmm-unstable branch

[Joseph Qi]

On 5/23/24 6:13 AM, Andrew Morton wrote:
> The patch titled
>      Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
> has been added to the -mm mm-nonmm-unstable branch.  Its filename is
>      ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch
> 
> This patch will shortly appear at
>      https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch
> 
> This patch will later appear in the mm-nonmm-unstable branch at
>     git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> 
> Before you just go and hit "reply", please:
>    a) Consider who else should be cc'ed
>    b) Prefer to cc a suitable mailing list as well
>    c) Ideally: find the original patch on the mailing list and do a
>       reply-to-all to that, adding suitable additional cc's
> 
> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
> 
> The -mm tree is included into linux-next via the mm-everything
> branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there every 2-3 working days
> 
> ------------------------------------------------------
> From: Ferry Meng <mengferry@linux.alibaba.com>
> Subject: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
> Date: Mon, 20 May 2024 10:40:24 +0800
> 
> xattr in ocfs2 maybe 'non-indexed', which saved with additional space
> requested.  It's better to check if the memory is out of bound before
> memcmp, although this possibility mainly comes from crafted poisonous
> images.
> 
> Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.com
> Signed-off-by: Ferry Meng <mengferry@linux.alibaba.com>
> Signed-off-by-by: Joseph Qi <joseph.qi@linux.alibaba.com>

A typo here.
s/Signed-off-by-by/Signed-off-by

> Reported-by: lei lu <llfamsec@gmail.com>
> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> Cc: Changwei Ge <gechangwei@live.cn>
> Cc: Gang He <ghe@suse.com>
> Cc: Joel Becker <jlbec@evilplan.org>
> Cc: Jun Piao <piaojun@huawei.com>
> Cc: Junxiao Bi <junxiao.bi@oracle.com>
> Cc: Mark Fasheh <mark@fasheh.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
> 
>  fs/ocfs2/xattr.c |   15 ++++++++++-----
>  1 file changed, 10 insertions(+), 5 deletions(-)
> 
> --- a/fs/ocfs2/xattr.c~ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry
> +++ a/fs/ocfs2/xattr.c
> @@ -1068,7 +1068,7 @@ static int ocfs2_xattr_find_entry(struct
>  {
>  	struct ocfs2_xattr_entry *entry;
>  	size_t name_len;
> -	int i, cmp = 1;
> +	int i, name_offset, cmp = 1;
>  
>  	if (name == NULL)
>  		return -EINVAL;
> @@ -1083,10 +1083,15 @@ static int ocfs2_xattr_find_entry(struct
>  		cmp = name_index - ocfs2_xattr_get_type(entry);
>  		if (!cmp)
>  			cmp = name_len - entry->xe_name_len;
> -		if (!cmp)
> -			cmp = memcmp(name, (xs->base +
> -				     le16_to_cpu(entry->xe_name_offset)),
> -				     name_len);
> +		if (!cmp) {
> +			name_offset = le16_to_cpu(entry->xe_name_offset);
> +			if ((xs->base + name_offset + name_len) > xs->end) {
> +				ocfs2_error(inode->i_sb,
> +					    "corrupted xattr entries");
> +				return -EFSCORRUPTED;
> +			}
> +			cmp = memcmp(name, (xs->base + name_offset), name_len);
> +		}
>  		if (cmp == 0)
>  			break;
>  		entry += 1;
> _
> 
> Patches currently in -mm which might be from mengferry@linux.alibaba.com are
> 
> ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch
> ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xattr_find_entry.patch