* [PATCH v2] fs: btrfs: fix out of bounds write
@ 2024-06-18 21:41 Alex Shumsky
2024-06-18 22:21 ` Qu Wenruo
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Alex Shumsky @ 2024-06-18 21:41 UTC (permalink / raw)
To: u-boot
Cc: Alex Shumsky, Dan Carpenter, Marek Behún, Qu Wenruo,
Tom Rini, linux-btrfs
Fix btrfs_read/read_and_truncate_page write out of bounds of destination
buffer. Old behavior break bootstd malloc'd buffers of exact file size.
Previously this OOB write have not been noticed because distroboot usually
read files into huge static memory areas.
Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
---
Changes in v2:
- fix error path handling
- add Fixes tag
- use min3
fs/btrfs/inode.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 4691612eda..3998ffc2c8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path *path,
extent_type = btrfs_file_extent_type(leaf, fi);
if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
ret = btrfs_read_extent_inline(path, fi, buf);
- memcpy(dest, buf + page_off, min(page_len, ret));
+ if (ret < 0) {
+ free(buf);
+ return ret;
+ }
+ memcpy(dest, buf + page_off, min3(page_len, ret, len));
free(buf);
return len;
}
@@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
free(buf);
return ret;
}
- memcpy(dest, buf + page_off, page_len);
+ memcpy(dest, buf + page_off, min(page_len, len));
free(buf);
return len;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2] fs: btrfs: fix out of bounds write
2024-06-18 21:41 [PATCH v2] fs: btrfs: fix out of bounds write Alex Shumsky
@ 2024-06-18 22:21 ` Qu Wenruo
[not found] ` <CAF4oh-NEUG4rVqiUg_wFVaRF+_dFCXQNbrTPNA90Y2iGqksh2Q@mail.gmail.com>
2024-06-28 19:49 ` Tom Rini
2 siblings, 0 replies; 4+ messages in thread
From: Qu Wenruo @ 2024-06-18 22:21 UTC (permalink / raw)
To: Alex Shumsky, u-boot
Cc: Dan Carpenter, Marek Behún, Qu Wenruo, Tom Rini, linux-btrfs
在 2024/6/19 07:11, Alex Shumsky 写道:
> Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> Previously this OOB write have not been noticed because distroboot usually
> read files into huge static memory areas.
>
> Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
> Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Thanks,
Qu
> ---
>
> Changes in v2:
> - fix error path handling
> - add Fixes tag
> - use min3
>
> fs/btrfs/inode.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> index 4691612eda..3998ffc2c8 100644
> --- a/fs/btrfs/inode.c
> +++ b/fs/btrfs/inode.c
> @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path *path,
> extent_type = btrfs_file_extent_type(leaf, fi);
> if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
> ret = btrfs_read_extent_inline(path, fi, buf);
> - memcpy(dest, buf + page_off, min(page_len, ret));
> + if (ret < 0) {
> + free(buf);
> + return ret;
> + }
> + memcpy(dest, buf + page_off, min3(page_len, ret, len));
> free(buf);
> return len;
> }
> @@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path *path,
> free(buf);
> return ret;
> }
> - memcpy(dest, buf + page_off, page_len);
> + memcpy(dest, buf + page_off, min(page_len, len));
> free(buf);
> return len;
> }
^ permalink raw reply [flat|nested] 4+ messages in thread[parent not found: <CAF4oh-NEUG4rVqiUg_wFVaRF+_dFCXQNbrTPNA90Y2iGqksh2Q@mail.gmail.com>]
* Re: [PATCH v2] fs: btrfs: fix out of bounds write
[not found] ` <CAF4oh-NEUG4rVqiUg_wFVaRF+_dFCXQNbrTPNA90Y2iGqksh2Q@mail.gmail.com>
@ 2024-06-24 22:25 ` Tom Rini
0 siblings, 0 replies; 4+ messages in thread
From: Tom Rini @ 2024-06-24 22:25 UTC (permalink / raw)
To: Alex ThreeD
Cc: u-boot, Dan Carpenter, Marek Behún, Qu Wenruo, linux-btrfs
[-- Attachment #1: Type: text/plain, Size: 2073 bytes --]
On Tue, Jun 25, 2024 at 01:22:01AM +0300, Alex ThreeD wrote:
> Hi all,
>
> Is there something on my side needed to push this forward?
I will pick it up for -next in a while, thanks.
>
> On Wed, Jun 19, 2024 at 12:41 AM Alex Shumsky <alexthreed@gmail.com> wrote:
>
> > Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> > buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> > Previously this OOB write have not been noticed because distroboot usually
> > read files into huge static memory areas.
> >
> > Signed-off-by: Alex Shumsky <alexthreed@gmail.com>
> > Fixes: e342718 ("fs: btrfs: Implement btrfs_file_read()")
> > ---
> >
> > Changes in v2:
> > - fix error path handling
> > - add Fixes tag
> > - use min3
> >
> > fs/btrfs/inode.c | 8 ++++++--
> > 1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
> > index 4691612eda..3998ffc2c8 100644
> > --- a/fs/btrfs/inode.c
> > +++ b/fs/btrfs/inode.c
> > @@ -640,7 +640,11 @@ static int read_and_truncate_page(struct btrfs_path
> > *path,
> > extent_type = btrfs_file_extent_type(leaf, fi);
> > if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
> > ret = btrfs_read_extent_inline(path, fi, buf);
> > - memcpy(dest, buf + page_off, min(page_len, ret));
> > + if (ret < 0) {
> > + free(buf);
> > + return ret;
> > + }
> > + memcpy(dest, buf + page_off, min3(page_len, ret, len));
> > free(buf);
> > return len;
> > }
> > @@ -652,7 +656,7 @@ static int read_and_truncate_page(struct btrfs_path
> > *path,
> > free(buf);
> > return ret;
> > }
> > - memcpy(dest, buf + page_off, page_len);
> > + memcpy(dest, buf + page_off, min(page_len, len));
> > free(buf);
> > return len;
> > }
> > --
> > 2.34.1
> >
> >
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] fs: btrfs: fix out of bounds write
2024-06-18 21:41 [PATCH v2] fs: btrfs: fix out of bounds write Alex Shumsky
2024-06-18 22:21 ` Qu Wenruo
[not found] ` <CAF4oh-NEUG4rVqiUg_wFVaRF+_dFCXQNbrTPNA90Y2iGqksh2Q@mail.gmail.com>
@ 2024-06-28 19:49 ` Tom Rini
2 siblings, 0 replies; 4+ messages in thread
From: Tom Rini @ 2024-06-28 19:49 UTC (permalink / raw)
To: u-boot, Alex Shumsky
Cc: Dan Carpenter, Marek Behún, Qu Wenruo, linux-btrfs
On Wed, 19 Jun 2024 00:41:38 +0300, Alex Shumsky wrote:
> Fix btrfs_read/read_and_truncate_page write out of bounds of destination
> buffer. Old behavior break bootstd malloc'd buffers of exact file size.
> Previously this OOB write have not been noticed because distroboot usually
> read files into huge static memory areas.
>
>
Applied to u-boot/next, thanks!
--
Tom
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-06-28 19:49 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-18 21:41 [PATCH v2] fs: btrfs: fix out of bounds write Alex Shumsky
2024-06-18 22:21 ` Qu Wenruo
[not found] ` <CAF4oh-NEUG4rVqiUg_wFVaRF+_dFCXQNbrTPNA90Y2iGqksh2Q@mail.gmail.com>
2024-06-24 22:25 ` Tom Rini
2024-06-28 19:49 ` Tom Rini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox