* [PATCH] fs: btrfs: fix out of bounds write
@ 2024-06-17 19:49 Alex Shumsky
2024-06-17 22:22 ` Qu Wenruo
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Alex Shumsky @ 2024-06-17 19:49 UTC (permalink / raw)
To: u-boot
Cc: Alex Shumsky, Dan Carpenter, Marek Behún, Qu Wenruo,
Tom Rini, linux-btrfs
Fix btrfs_read/read_and_truncate_page write out of bounds of destination
buffer. Old behavior break bootstd malloc'd buffers of exact file size.
Previously this OOB write have not been noticed because distroboot usually
read files into huge static memory areas.
Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
---
fs/btrfs/inode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 4691612eda..b51f578b49 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -640,7 +640,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
extent_type = btrfs_file_extent_type(leaf, fi);
if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
ret = btrfs_read_extent_inline(path, fi, buf);
- memcpy(dest, buf + page_off, min(page_len, ret));
+ memcpy(dest, buf + page_off, min(min(page_len, ret), len));
free(buf);
return len;
}
@@ -652,7 +652,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
free(buf);
return ret;
}
- memcpy(dest, buf + page_off, page_len);
+ memcpy(dest, buf + page_off, min(page_len, len));
free(buf);
return len;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] fs: btrfs: fix out of bounds write
2024-06-17 19:49 [PATCH] fs: btrfs: fix out of bounds write Alex Shumsky
@ 2024-06-17 22:22 ` Qu Wenruo
2024-06-18 6:03 ` David Disseldorp
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Qu Wenruo @ 2024-06-17 22:22 UTC (permalink / raw)
To: Alex Shumsky, u-boot
Cc: Dan Carpenter, Marek Behún, Tom Rini, linux-btrfs
在 2024/6/18 05:19, Alex Shumsky 写道:
> Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> Previously this OOB write have not been noticed because distroboot usually
> read files into huge static memory areas.
>
> Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Thanks,
Qu
> ---
>
> fs/btrfs/inode.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index 4691612eda..b51f578b49 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -640,7 +640,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
> extent_type = btrfs_file_extent_type(leaf, fi);
> if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
> ret = btrfs_read_extent_inline(path, fi, buf);
> - memcpy(dest, buf + page_off, min(page_len, ret));
> + memcpy(dest, buf + page_off, min(min(page_len, ret), len));
> free(buf);
> return len;
> }
> @@ -652,7 +652,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
> free(buf);
> return ret;
> }
> - memcpy(dest, buf + page_off, page_len);
> + memcpy(dest, buf + page_off, min(page_len, len));
> free(buf);
> return len;
> }
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fs: btrfs: fix out of bounds write
2024-06-17 19:49 [PATCH] fs: btrfs: fix out of bounds write Alex Shumsky
2024-06-17 22:22 ` Qu Wenruo
@ 2024-06-18 6:03 ` David Disseldorp
2024-06-18 6:41 ` Dan Carpenter
2024-06-18 7:45 ` Marek Behún
3 siblings, 0 replies; 5+ messages in thread
From: David Disseldorp @ 2024-06-18 6:03 UTC (permalink / raw)
To: Alex Shumsky
Cc: u-boot, Dan Carpenter, Marek Behún, Qu Wenruo, Tom Rini,
linux-btrfs
On Mon, 17 Jun 2024 22:49:47 +0300, Alex Shumsky wrote:
> Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> Previously this OOB write have not been noticed because distroboot usually
> read files into huge static memory areas.
>
> Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
> ---
>
> fs/btrfs/inode.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index 4691612eda..b51f578b49 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -640,7 +640,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
> extent_type = btrfs_file_extent_type(leaf, fi);
> if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
> ret = btrfs_read_extent_inline(path, fi, buf);
> - memcpy(dest, buf + page_off, min(page_len, ret));
> + memcpy(dest, buf + page_off, min(min(page_len, ret), len));
This looks (still) broken for the compressed inline extent error paths,
where ret=-errno .
nit: please prefix your patch subject with "uboot" so that casual
linux-btrfs readers like me don't get confused by matching kernel file
paths.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fs: btrfs: fix out of bounds write
2024-06-17 19:49 [PATCH] fs: btrfs: fix out of bounds write Alex Shumsky
2024-06-17 22:22 ` Qu Wenruo
2024-06-18 6:03 ` David Disseldorp
@ 2024-06-18 6:41 ` Dan Carpenter
2024-06-18 7:45 ` Marek Behún
3 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2024-06-18 6:41 UTC (permalink / raw)
To: Alex Shumsky; +Cc: u-boot, Marek Behún, Qu Wenruo, Tom Rini, linux-btrfs
On Mon, Jun 17, 2024 at 10:49:47PM +0300, Alex Shumsky wrote:
> Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> Previously this OOB write have not been noticed because distroboot usually
> read files into huge static memory areas.
>
> Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
Could you add a Fixes tag?
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fs: btrfs: fix out of bounds write
2024-06-17 19:49 [PATCH] fs: btrfs: fix out of bounds write Alex Shumsky
` (2 preceding siblings ...)
2024-06-18 6:41 ` Dan Carpenter
@ 2024-06-18 7:45 ` Marek Behún
3 siblings, 0 replies; 5+ messages in thread
From: Marek Behún @ 2024-06-18 7:45 UTC (permalink / raw)
To: Alex Shumsky; +Cc: u-boot, Dan Carpenter, Qu Wenruo, Tom Rini, linux-btrfs
On Mon, 17 Jun 2024 22:49:47 +0300
Alex Shumsky <alexthreed@gmail.com> wrote:
> Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> Previously this OOB write have not been noticed because distroboot usually
> read files into huge static memory areas.
>
> Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
> ---
>
> fs/btrfs/inode.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index 4691612eda..b51f578b49 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -640,7 +640,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
> extent_type = btrfs_file_extent_type(leaf, fi);
> if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
> ret = btrfs_read_extent_inline(path, fi, buf);
> - memcpy(dest, buf + page_off, min(page_len, ret));
> + memcpy(dest, buf + page_off, min(min(page_len, ret), len));
Use min3() instead of min(min())
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-06-18 7:46 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-17 19:49 [PATCH] fs: btrfs: fix out of bounds write Alex Shumsky
2024-06-17 22:22 ` Qu Wenruo
2024-06-18 6:03 ` David Disseldorp
2024-06-18 6:41 ` Dan Carpenter
2024-06-18 7:45 ` Marek Behún
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox