[PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[Christian Brauner]

The vfs_getxattr_alloc() interface is a special-purpose in-kernel api
that does a racy query-size+allocate-buffer+retrieve-data. It is used by
EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues
where 9p returned values that amount to allocating about 8000GB worth of
memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has
no reason to allow getting xattr values that are larger than
XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr
values and nothing currently goes beyond that limit afaict. Let it check
for that and reject requests that are larger than that.

Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1]
Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 fs/xattr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/xattr.c b/fs/xattr.c
index 09d927603433..a53c930e3018 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry,
 	if (error < 0)
 		return error;
 
+	if (error > XATTR_SIZE_MAX)
+		return -E2BIG;
+
 	if (!value || (error > xattr_size)) {
 		value = krealloc(*xattr_value, error + 1, flags);
 		if (!value)
-- 
2.43.0

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[Seth Forshee]

On Tue, Mar 05, 2024 at 01:27:06PM +0100, Christian Brauner wrote:
> The vfs_getxattr_alloc() interface is a special-purpose in-kernel api
> that does a racy query-size+allocate-buffer+retrieve-data. It is used by
> EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues
> where 9p returned values that amount to allocating about 8000GB worth of
> memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has
> no reason to allow getting xattr values that are larger than
> XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr
> values and nothing currently goes beyond that limit afaict. Let it check
> for that and reject requests that are larger than that.
> 
> Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1]
> Signed-off-by: Christian Brauner <brauner@kernel.org>

Makes sense.

Reviewed-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[Serge E. Hallyn]

On Tue, Mar 05, 2024 at 01:27:06PM +0100, Christian Brauner wrote:
> The vfs_getxattr_alloc() interface is a special-purpose in-kernel api
> that does a racy query-size+allocate-buffer+retrieve-data. It is used by
> EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues
> where 9p returned values that amount to allocating about 8000GB worth of
> memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has
> no reason to allow getting xattr values that are larger than
> XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr
> values and nothing currently goes beyond that limit afaict. Let it check
> for that and reject requests that are larger than that.
> 
> Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1]
> Signed-off-by: Christian Brauner <brauner@kernel.org>

Acked-by: Serge Hallyn <serge@hallyn.com>

> ---
>  fs/xattr.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/fs/xattr.c b/fs/xattr.c
> index 09d927603433..a53c930e3018 100644
> --- a/fs/xattr.c
> +++ b/fs/xattr.c
> @@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry,
>  	if (error < 0)
>  		return error;
>  
> +	if (error > XATTR_SIZE_MAX)
> +		return -E2BIG;
> +
>  	if (!value || (error > xattr_size)) {
>  		value = krealloc(*xattr_value, error + 1, flags);
>  		if (!value)
> -- 
> 2.43.0
> 

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[Christian Brauner]

On Tue, 05 Mar 2024 13:27:06 +0100, Christian Brauner wrote:
> The vfs_getxattr_alloc() interface is a special-purpose in-kernel api
> that does a racy query-size+allocate-buffer+retrieve-data. It is used by
> EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues
> where 9p returned values that amount to allocating about 8000GB worth of
> memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has
> no reason to allow getting xattr values that are larger than
> XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr
> values and nothing currently goes beyond that limit afaict. Let it check
> for that and reject requests that are larger than that.
> 
> [...]

Applied to the vfs.misc branch of the vfs/vfs.git tree.
Patches in the vfs.misc branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.misc

[1/1] xattr: restrict vfs_getxattr_alloc() allocation size
      https://git.kernel.org/vfs/vfs/c/82a4c8736d72

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[Jarkko Sakkinen]

On Tue Mar 5, 2024 at 2:27 PM EET, Christian Brauner wrote:
> The vfs_getxattr_alloc() interface is a special-purpose in-kernel api
> that does a racy query-size+allocate-buffer+retrieve-data. It is used by
> EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues
> where 9p returned values that amount to allocating about 8000GB worth of
> memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has
> no reason to allow getting xattr values that are larger than
> XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr
> values and nothing currently goes beyond that limit afaict. Let it check
> for that and reject requests that are larger than that.
>
> Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1]
> Signed-off-by: Christian Brauner <brauner@kernel.org>
> ---
>  fs/xattr.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/xattr.c b/fs/xattr.c
> index 09d927603433..a53c930e3018 100644
> --- a/fs/xattr.c
> +++ b/fs/xattr.c
> @@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry,
>  	if (error < 0)
>  		return error;
>  
> +	if (error > XATTR_SIZE_MAX)
> +		return -E2BIG;
> +
>  	if (!value || (error > xattr_size)) {
>  		value = krealloc(*xattr_value, error + 1, flags);
>  		if (!value)

I wonder if this should even categorized as a bug fix and get
backported. Good catch!

BR, Jarkko

Re: [PATCH] xattr: restrict vfs_getxattr_alloc() allocation size

[Jarkko Sakkinen]

On Thu Mar 7, 2024 at 10:01 PM EET, Jarkko Sakkinen wrote:
> On Tue Mar 5, 2024 at 2:27 PM EET, Christian Brauner wrote:
> > The vfs_getxattr_alloc() interface is a special-purpose in-kernel api
> > that does a racy query-size+allocate-buffer+retrieve-data. It is used by
> > EVM, IMA, and fscaps to retrieve xattrs. Recently, we've seen issues
> > where 9p returned values that amount to allocating about 8000GB worth of
> > memory (cf. [1]). That's now fixed in 9p. But vfs_getxattr_alloc() has
> > no reason to allow getting xattr values that are larger than
> > XATTR_MAX_SIZE as that's the limit we use for setting and getting xattr
> > values and nothing currently goes beyond that limit afaict. Let it check
> > for that and reject requests that are larger than that.
> >
> > Link: https://lore.kernel.org/r/ZeXcQmHWcYvfCR93@do-x1extreme [1]
> > Signed-off-by: Christian Brauner <brauner@kernel.org>
> > ---
> >  fs/xattr.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/fs/xattr.c b/fs/xattr.c
> > index 09d927603433..a53c930e3018 100644
> > --- a/fs/xattr.c
> > +++ b/fs/xattr.c
> > @@ -395,6 +395,9 @@ vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry,
> >  	if (error < 0)
> >  		return error;
> >  
> > +	if (error > XATTR_SIZE_MAX)
> > +		return -E2BIG;
> > +
> >  	if (!value || (error > xattr_size)) {
> >  		value = krealloc(*xattr_value, error + 1, flags);
> >  		if (!value)
>
> I wonder if this should even categorized as a bug fix and get
> backported. Good catch!

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

BR, Jarkko