Re: [PATCH RESEND] get_fs_type: Validate fs type string argument

[Chandan Rajendra <chandan@linux.vnet.ibm.com>]

On Tuesday, November 20, 2018 11:06:42 AM IST Chandan Rajendra wrote:
> On ppc64le, When a string with PAGE_SIZE - 1 (i.e. 64k-1) length is
> passed as a "filesystem type" argument to the mount(2) syscall,
> copy_mount_string() ends up allocating 64k (the PAGE_SIZE on ppc64le)
> worth of space for holding the string in kernel's address space.
> 
> Later, in set_precision() (invoked by get_fs_type() ->
> __request_module() -> vsnprintf()), we end up assigning
> strlen(fs-type-string) i.e. 65535 as the
> value to 'struct printf_spec'->precision member. This field has a width
> of 16 bits and it is a signed data type. Hence an invalid value ends
> up getting assigned. This causes the "WARN_ONCE(spec->precision != prec,
> "precision %d too large", prec)" statement inside set_precision() to be
> executed.
> 
> This commit fixes the bug by validating the length of the "filesystem
> type" argument passed to get_fs_type() function.
>

The following is a trivial userspace program to recreate the issue,

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <sys/mount.h>

#define BUFSIZE 65536

char buf[BUFSIZE];

int main(int argc, char *argv[])
{
        int ret;

        if (argc != 3) {
                fprintf(stderr, "Usage: %s <device> <mount point>.\n", argv[0]);
                exit(1);
        }

        memset(buf, 1, BUFSIZE);

        buf[BUFSIZE-1] = '\0';
        printf("strlen(buf) = %lu.\n", strlen(buf));
        ret = mount(argv[1], argv[2], buf, 0, NULL);
        if (ret) {
                perror("mount");
                exit(0);
        }

        exit(1);
}

-- 
chandan