[PATCH] lib/e2p: fix stack smashing on EXT2_IOC_GET/SETVERSION over FUSE

[PATCH] lib/e2p: fix stack smashing on EXT2_IOC_GET/SETVERSION over FUSE

[Shachar Sharon]

When using utilities like lsattr/chattr on a FUSE backing file-system,
invoking the fgetversion or fsetversion functions can result in an
abort crash due to "*** stack smashing detected ***".

The underlying cause lies in a data structure mismatch between the
variable allocation space in user-space and the ioctl encoding
expectations defined by Linux: the ioctl command token incorporates the
'long' primitive data size, so the kernel explicitly encodes a 64-bit
target memory region pointer when deployed on x86_64. FUSE driver
enforce the _IOR-decoded payload envelope, hence it uses 8-byte buffer
to accommodate the incoming user-space daemon response. When finalizing
the ioctl transaction back down to user space, it writes all 8-bytes
directly into the 4-bytes memory reference provided by e2fsprogs.

Reproduce: compile with '-fstack-protector-strong' and
'-D_FORTIFY_SOURCE=3' (fedor44, 7.2.5-200.fc44.x86_64):

  $ lsattr -v ./foo
  *** stack smashing detected ***: terminated
  Aborted                    (core dumped) lsattr -v ./foo

Solution: change ioctl arg to 'long' but use only lower 32-bits of
result.

Signed-off-by: Shachar Sharon <synarete@gmail.com>
---
 lib/e2p/fgetversion.c | 4 ++--
 lib/e2p/fsetversion.c | 7 ++++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/e2p/fgetversion.c b/lib/e2p/fgetversion.c
index f3a5b4cd..eaac46c6 100644
--- a/lib/e2p/fgetversion.c
+++ b/lib/e2p/fgetversion.c
@@ -45,7 +45,7 @@
 
 int fgetversion(const char *name, unsigned long *version)
 {
-	unsigned int ver = -1;
+	long ver = 0;
 	int rc = -1;
 #if HAVE_EXT2_IOCTLS
 # if !APPLE_DARWIN
@@ -68,7 +68,7 @@ int fgetversion(const char *name, unsigned long *version)
 	errno = EOPNOTSUPP;
 #endif /* ! HAVE_EXT2_IOCTLS */
 	if (rc == 0)
-		*version = ver;
+		*version = (unsigned long)ver & 0xffffffffUL;
 
 	return rc;
 }
diff --git a/lib/e2p/fsetversion.c b/lib/e2p/fsetversion.c
index 5f844b55..9b599c19 100644
--- a/lib/e2p/fsetversion.c
+++ b/lib/e2p/fsetversion.c
@@ -47,12 +47,13 @@ int fsetversion (const char * name, unsigned long version)
 {
 #if HAVE_EXT2_IOCTLS
 #if !APPLE_DARWIN
-	int fd, r, ver, save_errno = 0;
+	int fd, r, save_errno = 0;
+	long ver;
 
 	fd = open (name, OPEN_FLAGS);
 	if (fd == -1)
 		return -1;
-	ver = (int) version;
+	ver = (long) (version & 0xffffffffUL);
 	r = ioctl (fd, EXT2_IOC_SETVERSION, &ver);
 	if (r == -1)
 		save_errno = errno;
@@ -61,7 +62,7 @@ int fsetversion (const char * name, unsigned long version)
 		errno = save_errno;
 	return r;
 #else
-   int ver = (int)version;
+	long ver = (long)(version & 0xffffffffUL);
    return syscall(SYS_fsctl, name, EXT2_IOC_SETVERSION, &ver, 0);
 #endif
 #else /* ! HAVE_EXT2_IOCTLS */
-- 
2.55.0